Executive summary
Evyweb/simple-ddd-toolkit scores 66 out of 100, but it is rated At risk while a critical security finding is open; the score itself is unchanged. The project hasn't declared a stable release yet, so its lenses are rated against a lower bar than a released product's, while the score itself is worked out as for any repository.
The weakest lens counts most in the score, and here that is Maturity, which scores 56 and is rated Adequate. Its Architecture documentation dimension scores 0 out of 10, and until that reaches 4, Maturity can't be rated higher than Adequate. The first actions are to record your significant design decisions and to improve Documentation Quality — currently 7.0/10, and if Maturity rose to 70, the score would rise from 66 to about 72.
19 findings are critical: 15 in Dependency Vulnerabilities and four in Static Analysis (SAST).
Watchdog couldn't measure 7 dimensions in this code, among them License Compliance, Internal API Consistency and Navigability, so they are left out of the score. The product code is 431 lines.
Code Health
98 ★
Exemplary
Architecture
69
Strong
Maturity
56
Adequate, capped by Architecture documentation
Production Readiness
72
Adequate, capped by Security & performance tooling
Security and Compliance
70
Adequate, capped by Dependency Vulnerabilities
Domain Modelling
100 ★
Exemplary
Performance
100 ★
Exemplary
How the score is built: what each lens counts for
The lenses don't count equally. The weakest lens counts most, the next weakest a little less, and so on, so a weak area pulls the score down instead of being averaged away. In the bar below, each part's width shows how much that lens counts and its colour shows its rating. Improving the widest part moves the score most, and as that lens improves, it counts for less, because another lens becomes the weakest.
Maturity 56 · counts for 46%Architecture 69 · counts for 25%Security and Compliance 70 · counts for 14%Production Readiness 72 · counts for 8%Code Health 98 · counts for 4%Domain Modelling 100 · counts for 2%Performance 100 · counts for 1%
If Maturity rose from 56 to 70, the lowest score rated Strong, the score would rise from 66 to about 72.
Code composition: what the lines of code are
Product code 28%Tests 72%
New since the last survey: 3 findings
- Dependency Vulnerabilities · REDACTED
- Dependency Vulnerabilities · REDACTED
- Supply-chain Provenance & Signing · REDACTED
Fixed since the last survey: 3 findings
- Dependency Vulnerabilities · Critical CVE: REDACTED REDACTED
- Dependency Vulnerabilities · High CVE: [GHSA redacted] REDACTED
- Supply-chain Provenance & Signing REDACTED
Rebuild cost: about €2,800 · Estimate
| Cost to rebuild | €930 to €4,700, for 15 to 49 hours of work, about 0.1 person-years for one engineer |
|---|---|
| Difficulty of the problem | High, judged from the kind of software and how it is built. Code that solves a harder problem, such as payments or medical bookings, costs more per line to write. |
| Quality factor | ×0.9 at a score of 66. Better code takes more work to write, so the factor is ×1.0 at a score of 70, lower below it and higher above it. |
| Size | Very small: 431 lines of product code |
Top priorities
1
Record your significant design decisions.
Write one short document per decision, giving its date, the situation, the decision and its consequences, and keep them together with your other design documents. A docs/adr folder with each file named by number and title is the easiest place to find them.
2
Improve Documentation Quality — currently 7.0/10.
3
Explain in the README how to run the tests.
Add a section called Testing to the README in the repository's top folder, saying how to run the test suite.
Diagnosis: what the measurements show together
If you do one thing first
Record your significant design decisions. Of all the actions in this report, it raises the score most for the work it takes: about 8 points for medium effort. The next survey will show the change in the score.
Architecture: which parts of the code depend on which
| uses → | 1 specs.useCase.FakePresenterPort | 2 src.bus.command.Command | 3 src.bus.command.CommandHandler | 4 src.bus.command.ICommandHandler | 5 src.bus.middleware.Middleware | 6 src.bus.query.Query | 7 src.domainEvent.DomainEvent | 8 src.entity.Entity | 9 src.errors.CustomError | 10 src.logger.Logger | 11 src.valueObject.ValueObject | 12 specs.aggregate.LogUsernameChangedCommand | 13 specs.aggregate.UsernameUpdatedEvent | 14 specs.bus.command.FakeCommand | 15 specs.bus.commandBus.FakeInvalidCommandHandler | 16 specs.bus.commandBus.FakeUpdateNameCommand | 17 specs.bus.query.FakeViewCurrentNameQuery | 18 specs.logger.FakeLogger | 19 specs.useCase.FakePresenter | 20 specs.useCase.FakeUseCase | 21 src.bus.Bus | 22 src.bus.middleware.CommandLoggerMiddleware | 23 src.bus.middleware.QueryLoggerMiddleware | 24 src.errors.DomainError | 25 src.eventBus.IEventMiddleware | 26 src.valueObject.uuid.UUID | 27 specs.aggregate.LogUsernameChangedCommandHandler | 28 specs.aggregate.UsernameChangedEventHandler | 29 specs.bus.command.FakeCommandHandler | 30 specs.bus.command.FakeCommandHandlerWithReturnedValue | 31 specs.bus.commandBus.FakeUpdateNameCommandHandler | 32 specs.bus.commandBus.FakeUpdateNameWithReturnedValueCommandHandler | 33 specs.bus.query.FakeViewCurrentNameQueryHandler | 34 specs.entity.FakeUserData | 35 src.eventBus.EventBusPort | 36 src.eventBus.EventLoggingMiddleware | 37 specs.entity.FakeUserEntity | 38 src.aggregate.Aggregate | 39 src.eventBus.EventBus | 40 specs.aggregate.FakeUserAggregate |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 specs.useCase.FakePresenterPort | ||||||||||||||||||||||||||||||||||||||||
| 2 src.bus.command.Command | ||||||||||||||||||||||||||||||||||||||||
| 3 src.bus.command.CommandHandler | ||||||||||||||||||||||||||||||||||||||||
| 4 src.bus.command.ICommandHandler | ||||||||||||||||||||||||||||||||||||||||
| 5 src.bus.middleware.Middleware | ||||||||||||||||||||||||||||||||||||||||
| 6 src.bus.query.Query | ||||||||||||||||||||||||||||||||||||||||
| 7 src.domainEvent.DomainEvent | ||||||||||||||||||||||||||||||||||||||||
| 8 src.entity.Entity | ||||||||||||||||||||||||||||||||||||||||
| 9 src.errors.CustomError | ||||||||||||||||||||||||||||||||||||||||
| 10 src.logger.Logger | ||||||||||||||||||||||||||||||||||||||||
| 11 src.valueObject.ValueObject | ||||||||||||||||||||||||||||||||||||||||
| 12 specs.aggregate.LogUsernameChangedCommand | 1 | |||||||||||||||||||||||||||||||||||||||
| 13 specs.aggregate.UsernameUpdatedEvent | 1 | |||||||||||||||||||||||||||||||||||||||
| 14 specs.bus.command.FakeCommand | 1 | |||||||||||||||||||||||||||||||||||||||
| 15 specs.bus.commandBus.FakeInvalidCommandHandler | 1 | 1 | ||||||||||||||||||||||||||||||||||||||
| 16 specs.bus.commandBus.FakeUpdateNameCommand | 1 | |||||||||||||||||||||||||||||||||||||||
| 17 specs.bus.query.FakeViewCurrentNameQuery | 1 | |||||||||||||||||||||||||||||||||||||||
| 18 specs.logger.FakeLogger | 1 | |||||||||||||||||||||||||||||||||||||||
| 19 specs.useCase.FakePresenter | 1 | |||||||||||||||||||||||||||||||||||||||
| 20 specs.useCase.FakeUseCase | 1 | |||||||||||||||||||||||||||||||||||||||
| 21 src.bus.Bus | 1 | |||||||||||||||||||||||||||||||||||||||
| 22 src.bus.middleware.CommandLoggerMiddleware | 1 | 1 | 1 | |||||||||||||||||||||||||||||||||||||
| 23 src.bus.middleware.QueryLoggerMiddleware | 1 | 1 | 1 | |||||||||||||||||||||||||||||||||||||
| 24 src.errors.DomainError | 1 | |||||||||||||||||||||||||||||||||||||||
| 25 src.eventBus.IEventMiddleware | 1 | |||||||||||||||||||||||||||||||||||||||
| 26 src.valueObject.uuid.UUID | 1 | |||||||||||||||||||||||||||||||||||||||
| 27 specs.aggregate.LogUsernameChangedCommandHandler | 1 | 1 | 1 | |||||||||||||||||||||||||||||||||||||
| 28 specs.aggregate.UsernameChangedEventHandler | 1 | 1 | 1 | |||||||||||||||||||||||||||||||||||||
| 29 specs.bus.command.FakeCommandHandler | 1 | 1 | 1 | |||||||||||||||||||||||||||||||||||||
| 30 specs.bus.command.FakeCommandHandlerWithReturnedValue | 1 | 1 | 1 | |||||||||||||||||||||||||||||||||||||
| 31 specs.bus.commandBus.FakeUpdateNameCommandHandler | 1 | 1 | 1 | |||||||||||||||||||||||||||||||||||||
| 32 specs.bus.commandBus.FakeUpdateNameWithReturnedValueCommandHandler | 1 | 1 | 1 | |||||||||||||||||||||||||||||||||||||
| 33 specs.bus.query.FakeViewCurrentNameQueryHandler | 1 | |||||||||||||||||||||||||||||||||||||||
| 34 specs.entity.FakeUserData | 1 | |||||||||||||||||||||||||||||||||||||||
| 35 src.eventBus.EventBusPort | 1 | 1 | ||||||||||||||||||||||||||||||||||||||
| 36 src.eventBus.EventLoggingMiddleware | 1 | 1 | 1 | |||||||||||||||||||||||||||||||||||||
| 37 specs.entity.FakeUserEntity | 1 | 1 | ||||||||||||||||||||||||||||||||||||||
| 38 src.aggregate.Aggregate | 1 | 1 | 1 | |||||||||||||||||||||||||||||||||||||
| 39 src.eventBus.EventBus | 1 | 1 | 1 | |||||||||||||||||||||||||||||||||||||
| 40 specs.aggregate.FakeUserAggregate | 1 | 1 |
Uses a module listed above itPart of a loopThe module itself
12→2 specs.aggregate.LogUsernameChangedCommand uses src.bus.command.Command✕
- Connections
- 1 pair of types, where a type in specs.aggregate.LogUsernameChangedCommand uses a type in src.bus.command.Command.
- The types involved
specs.aggregate.LogUsernameChangedCommand.LogUsernameChangedCommand→src.bus.command.Command.Command
- Direction
- specs.aggregate.LogUsernameChangedCommand uses src.bus.command.Command, so a change to src.bus.command.Command can break specs.aggregate.LogUsernameChangedCommand, while a change to specs.aggregate.LogUsernameChangedCommand can't break src.bus.command.Command.
- Position
- Below the diagonal: specs.aggregate.LogUsernameChangedCommand uses a module listed above it, which is the healthy direction.
13→7 specs.aggregate.UsernameUpdatedEvent uses src.domainEvent.DomainEvent✕
- Connections
- 1 pair of types, where a type in specs.aggregate.UsernameUpdatedEvent uses a type in src.domainEvent.DomainEvent.
- The types involved
specs.aggregate.UsernameUpdatedEvent.UsernameUpdatedEvent→src.domainEvent.DomainEvent.DomainEvent
- Direction
- specs.aggregate.UsernameUpdatedEvent uses src.domainEvent.DomainEvent, so a change to src.domainEvent.DomainEvent can break specs.aggregate.UsernameUpdatedEvent, while a change to specs.aggregate.UsernameUpdatedEvent can't break src.domainEvent.DomainEvent.
- Position
- Below the diagonal: specs.aggregate.UsernameUpdatedEvent uses a module listed above it, which is the healthy direction.
14→2 specs.bus.command.FakeCommand uses src.bus.command.Command✕
- Connections
- 1 pair of types, where a type in specs.bus.command.FakeCommand uses a type in src.bus.command.Command.
- The types involved
specs.bus.command.FakeCommand.FakeCommand→src.bus.command.Command.Command
- Direction
- specs.bus.command.FakeCommand uses src.bus.command.Command, so a change to src.bus.command.Command can break specs.bus.command.FakeCommand, while a change to specs.bus.command.FakeCommand can't break src.bus.command.Command.
- Position
- Below the diagonal: specs.bus.command.FakeCommand uses a module listed above it, which is the healthy direction.
15→2 specs.bus.commandBus.FakeInvalidCommandHandler uses src.bus.command.Command✕
- Connections
- 1 pair of types, where a type in specs.bus.commandBus.FakeInvalidCommandHandler uses a type in src.bus.command.Command.
- The types involved
specs.bus.commandBus.FakeInvalidCommandHandler.FakeInvalidCommand→src.bus.command.Command.Command
- Direction
- specs.bus.commandBus.FakeInvalidCommandHandler uses src.bus.command.Command, so a change to src.bus.command.Command can break specs.bus.commandBus.FakeInvalidCommandHandler, while a change to specs.bus.commandBus.FakeInvalidCommandHandler can't break src.bus.command.Command.
- Position
- Below the diagonal: specs.bus.commandBus.FakeInvalidCommandHandler uses a module listed above it, which is the healthy direction.
15→4 specs.bus.commandBus.FakeInvalidCommandHandler uses src.bus.command.ICommandHandler✕
- Connections
- 1 pair of types, where a type in specs.bus.commandBus.FakeInvalidCommandHandler uses a type in src.bus.command.ICommandHandler.
- The types involved
specs.bus.commandBus.FakeInvalidCommandHandler.FakeInvalidCommandHandler→src.bus.command.ICommandHandler.ICommandHandler
- Direction
- specs.bus.commandBus.FakeInvalidCommandHandler uses src.bus.command.ICommandHandler, so a change to src.bus.command.ICommandHandler can break specs.bus.commandBus.FakeInvalidCommandHandler, while a change to specs.bus.commandBus.FakeInvalidCommandHandler can't break src.bus.command.ICommandHandler.
- Position
- Below the diagonal: specs.bus.commandBus.FakeInvalidCommandHandler uses a module listed above it, which is the healthy direction.
16→2 specs.bus.commandBus.FakeUpdateNameCommand uses src.bus.command.Command✕
- Connections
- 1 pair of types, where a type in specs.bus.commandBus.FakeUpdateNameCommand uses a type in src.bus.command.Command.
- The types involved
specs.bus.commandBus.FakeUpdateNameCommand.FakeUpdateNameCommand→src.bus.command.Command.Command
- Direction
- specs.bus.commandBus.FakeUpdateNameCommand uses src.bus.command.Command, so a change to src.bus.command.Command can break specs.bus.commandBus.FakeUpdateNameCommand, while a change to specs.bus.commandBus.FakeUpdateNameCommand can't break src.bus.command.Command.
- Position
- Below the diagonal: specs.bus.commandBus.FakeUpdateNameCommand uses a module listed above it, which is the healthy direction.
17→6 specs.bus.query.FakeViewCurrentNameQuery uses src.bus.query.Query✕
- Connections
- 1 pair of types, where a type in specs.bus.query.FakeViewCurrentNameQuery uses a type in src.bus.query.Query.
- The types involved
specs.bus.query.FakeViewCurrentNameQuery.FakeViewCurrentNameQuery→src.bus.query.Query.Query
- Direction
- specs.bus.query.FakeViewCurrentNameQuery uses src.bus.query.Query, so a change to src.bus.query.Query can break specs.bus.query.FakeViewCurrentNameQuery, while a change to specs.bus.query.FakeViewCurrentNameQuery can't break src.bus.query.Query.
- Position
- Below the diagonal: specs.bus.query.FakeViewCurrentNameQuery uses a module listed above it, which is the healthy direction.
18→10 specs.logger.FakeLogger uses src.logger.Logger✕
- Connections
- 1 pair of types, where a type in specs.logger.FakeLogger uses a type in src.logger.Logger.
- The types involved
specs.logger.FakeLogger.FakeLogger→src.logger.Logger.Logger
- Direction
- specs.logger.FakeLogger uses src.logger.Logger, so a change to src.logger.Logger can break specs.logger.FakeLogger, while a change to specs.logger.FakeLogger can't break src.logger.Logger.
- Position
- Below the diagonal: specs.logger.FakeLogger uses a module listed above it, which is the healthy direction.
19→1 specs.useCase.FakePresenter uses specs.useCase.FakePresenterPort✕
- Connections
- 1 pair of types, where a type in specs.useCase.FakePresenter uses a type in specs.useCase.FakePresenterPort.
- The types involved
specs.useCase.FakePresenter.FakePresenter→specs.useCase.FakePresenterPort.FakePresenterPort
- Direction
- specs.useCase.FakePresenter uses specs.useCase.FakePresenterPort, so a change to specs.useCase.FakePresenterPort can break specs.useCase.FakePresenter, while a change to specs.useCase.FakePresenter can't break specs.useCase.FakePresenterPort.
- Position
- Below the diagonal: specs.useCase.FakePresenter uses a module listed above it, which is the healthy direction.
20→1 specs.useCase.FakeUseCase uses specs.useCase.FakePresenterPort✕
- Connections
- 1 pair of types, where a type in specs.useCase.FakeUseCase uses a type in specs.useCase.FakePresenterPort.
- The types involved
specs.useCase.FakeUseCase.FakeUseCase→specs.useCase.FakePresenterPort.FakePresenterPort
- Direction
- specs.useCase.FakeUseCase uses specs.useCase.FakePresenterPort, so a change to specs.useCase.FakePresenterPort can break specs.useCase.FakeUseCase, while a change to specs.useCase.FakeUseCase can't break specs.useCase.FakePresenterPort.
- Position
- Below the diagonal: specs.useCase.FakeUseCase uses a module listed above it, which is the healthy direction.
21→5 src.bus.Bus uses src.bus.middleware.Middleware✕
- Connections
- 1 pair of types, where a type in src.bus.Bus uses a type in src.bus.middleware.Middleware.
- The types involved
src.bus.Bus.Bus→src.bus.middleware.Middleware.Middleware
- Direction
- src.bus.Bus uses src.bus.middleware.Middleware, so a change to src.bus.middleware.Middleware can break src.bus.Bus, while a change to src.bus.Bus can't break src.bus.middleware.Middleware.
- Position
- Below the diagonal: src.bus.Bus uses a module listed above it, which is the healthy direction.
22→2 src.bus.middleware.CommandLoggerMiddleware uses src.bus.command.Command✕
- Connections
- 1 pair of types, where a type in src.bus.middleware.CommandLoggerMiddleware uses a type in src.bus.command.Command.
- The types involved
src.bus.middleware.CommandLoggerMiddleware.CommandLoggerMiddleware→src.bus.command.Command.Command
- Direction
- src.bus.middleware.CommandLoggerMiddleware uses src.bus.command.Command, so a change to src.bus.command.Command can break src.bus.middleware.CommandLoggerMiddleware, while a change to src.bus.middleware.CommandLoggerMiddleware can't break src.bus.command.Command.
- Position
- Below the diagonal: src.bus.middleware.CommandLoggerMiddleware uses a module listed above it, which is the healthy direction.
22→5 src.bus.middleware.CommandLoggerMiddleware uses src.bus.middleware.Middleware✕
- Connections
- 1 pair of types, where a type in src.bus.middleware.CommandLoggerMiddleware uses a type in src.bus.middleware.Middleware.
- The types involved
src.bus.middleware.CommandLoggerMiddleware.CommandLoggerMiddleware→src.bus.middleware.Middleware.Middleware
- Direction
- src.bus.middleware.CommandLoggerMiddleware uses src.bus.middleware.Middleware, so a change to src.bus.middleware.Middleware can break src.bus.middleware.CommandLoggerMiddleware, while a change to src.bus.middleware.CommandLoggerMiddleware can't break src.bus.middleware.Middleware.
- Position
- Below the diagonal: src.bus.middleware.CommandLoggerMiddleware uses a module listed above it, which is the healthy direction.
22→10 src.bus.middleware.CommandLoggerMiddleware uses src.logger.Logger✕
- Connections
- 1 pair of types, where a type in src.bus.middleware.CommandLoggerMiddleware uses a type in src.logger.Logger.
- The types involved
src.bus.middleware.CommandLoggerMiddleware.CommandLoggerMiddleware→src.logger.Logger.Logger
- Direction
- src.bus.middleware.CommandLoggerMiddleware uses src.logger.Logger, so a change to src.logger.Logger can break src.bus.middleware.CommandLoggerMiddleware, while a change to src.bus.middleware.CommandLoggerMiddleware can't break src.logger.Logger.
- Position
- Below the diagonal: src.bus.middleware.CommandLoggerMiddleware uses a module listed above it, which is the healthy direction.
23→5 src.bus.middleware.QueryLoggerMiddleware uses src.bus.middleware.Middleware✕
- Connections
- 1 pair of types, where a type in src.bus.middleware.QueryLoggerMiddleware uses a type in src.bus.middleware.Middleware.
- The types involved
src.bus.middleware.QueryLoggerMiddleware.QueryLoggerMiddleware→src.bus.middleware.Middleware.Middleware
- Direction
- src.bus.middleware.QueryLoggerMiddleware uses src.bus.middleware.Middleware, so a change to src.bus.middleware.Middleware can break src.bus.middleware.QueryLoggerMiddleware, while a change to src.bus.middleware.QueryLoggerMiddleware can't break src.bus.middleware.Middleware.
- Position
- Below the diagonal: src.bus.middleware.QueryLoggerMiddleware uses a module listed above it, which is the healthy direction.
23→6 src.bus.middleware.QueryLoggerMiddleware uses src.bus.query.Query✕
- Connections
- 1 pair of types, where a type in src.bus.middleware.QueryLoggerMiddleware uses a type in src.bus.query.Query.
- The types involved
src.bus.middleware.QueryLoggerMiddleware.QueryLoggerMiddleware→src.bus.query.Query.Query
- Direction
- src.bus.middleware.QueryLoggerMiddleware uses src.bus.query.Query, so a change to src.bus.query.Query can break src.bus.middleware.QueryLoggerMiddleware, while a change to src.bus.middleware.QueryLoggerMiddleware can't break src.bus.query.Query.
- Position
- Below the diagonal: src.bus.middleware.QueryLoggerMiddleware uses a module listed above it, which is the healthy direction.
23→10 src.bus.middleware.QueryLoggerMiddleware uses src.logger.Logger✕
- Connections
- 1 pair of types, where a type in src.bus.middleware.QueryLoggerMiddleware uses a type in src.logger.Logger.
- The types involved
src.bus.middleware.QueryLoggerMiddleware.QueryLoggerMiddleware→src.logger.Logger.Logger
- Direction
- src.bus.middleware.QueryLoggerMiddleware uses src.logger.Logger, so a change to src.logger.Logger can break src.bus.middleware.QueryLoggerMiddleware, while a change to src.bus.middleware.QueryLoggerMiddleware can't break src.logger.Logger.
- Position
- Below the diagonal: src.bus.middleware.QueryLoggerMiddleware uses a module listed above it, which is the healthy direction.
24→9 src.errors.DomainError uses src.errors.CustomError✕
- Connections
- 1 pair of types, where a type in src.errors.DomainError uses a type in src.errors.CustomError.
- The types involved
src.errors.DomainError.DomainError→src.errors.CustomError.CustomError
- Direction
- src.errors.DomainError uses src.errors.CustomError, so a change to src.errors.CustomError can break src.errors.DomainError, while a change to src.errors.DomainError can't break src.errors.CustomError.
- Position
- Below the diagonal: src.errors.DomainError uses a module listed above it, which is the healthy direction.
25→7 src.eventBus.IEventMiddleware uses src.domainEvent.DomainEvent✕
- Connections
- 1 pair of types, where a type in src.eventBus.IEventMiddleware uses a type in src.domainEvent.DomainEvent.
- The types involved
src.eventBus.IEventMiddleware.IEventMiddleware→src.domainEvent.DomainEvent.DomainEvent
- Direction
- src.eventBus.IEventMiddleware uses src.domainEvent.DomainEvent, so a change to src.domainEvent.DomainEvent can break src.eventBus.IEventMiddleware, while a change to src.eventBus.IEventMiddleware can't break src.domainEvent.DomainEvent.
- Position
- Below the diagonal: src.eventBus.IEventMiddleware uses a module listed above it, which is the healthy direction.
26→11 src.valueObject.uuid.UUID uses src.valueObject.ValueObject✕
- Connections
- 1 pair of types, where a type in src.valueObject.uuid.UUID uses a type in src.valueObject.ValueObject.
- The types involved
src.valueObject.uuid.UUID.UUID→src.valueObject.ValueObject.ValueObject
- Direction
- src.valueObject.uuid.UUID uses src.valueObject.ValueObject, so a change to src.valueObject.ValueObject can break src.valueObject.uuid.UUID, while a change to src.valueObject.uuid.UUID can't break src.valueObject.ValueObject.
- Position
- Below the diagonal: src.valueObject.uuid.UUID uses a module listed above it, which is the healthy direction.
27→3 specs.aggregate.LogUsernameChangedCommandHandler uses src.bus.command.CommandHandler✕
- Connections
- 1 pair of types, where a type in specs.aggregate.LogUsernameChangedCommandHandler uses a type in src.bus.command.CommandHandler.
- The types involved
specs.aggregate.LogUsernameChangedCommandHandler.LogUsernameChangedCommandHandler→src.bus.command.CommandHandler.CommandHandler
- Direction
- specs.aggregate.LogUsernameChangedCommandHandler uses src.bus.command.CommandHandler, so a change to src.bus.command.CommandHandler can break specs.aggregate.LogUsernameChangedCommandHandler, while a change to specs.aggregate.LogUsernameChangedCommandHandler can't break src.bus.command.CommandHandler.
- Position
- Below the diagonal: specs.aggregate.LogUsernameChangedCommandHandler uses a module listed above it, which is the healthy direction.
27→10 specs.aggregate.LogUsernameChangedCommandHandler uses src.logger.Logger✕
- Connections
- 1 pair of types, where a type in specs.aggregate.LogUsernameChangedCommandHandler uses a type in src.logger.Logger.
- The types involved
specs.aggregate.LogUsernameChangedCommandHandler.LogUsernameChangedCommandHandler→src.logger.Logger.Logger
- Direction
- specs.aggregate.LogUsernameChangedCommandHandler uses src.logger.Logger, so a change to src.logger.Logger can break specs.aggregate.LogUsernameChangedCommandHandler, while a change to specs.aggregate.LogUsernameChangedCommandHandler can't break src.logger.Logger.
- Position
- Below the diagonal: specs.aggregate.LogUsernameChangedCommandHandler uses a module listed above it, which is the healthy direction.
27→12 specs.aggregate.LogUsernameChangedCommandHandler uses specs.aggregate.LogUsernameChangedCommand✕
- Connections
- 1 pair of types, where a type in specs.aggregate.LogUsernameChangedCommandHandler uses a type in specs.aggregate.LogUsernameChangedCommand.
- The types involved
specs.aggregate.LogUsernameChangedCommandHandler.LogUsernameChangedCommandHandler→specs.aggregate.LogUsernameChangedCommand.LogUsernameChangedCommand
- Direction
- specs.aggregate.LogUsernameChangedCommandHandler uses specs.aggregate.LogUsernameChangedCommand, so a change to specs.aggregate.LogUsernameChangedCommand can break specs.aggregate.LogUsernameChangedCommandHandler, while a change to specs.aggregate.LogUsernameChangedCommandHandler can't break specs.aggregate.LogUsernameChangedCommand.
- Position
- Below the diagonal: specs.aggregate.LogUsernameChangedCommandHandler uses a module listed above it, which is the healthy direction.
28→2 specs.aggregate.UsernameChangedEventHandler uses src.bus.command.Command✕
- Connections
- 1 pair of types, where a type in specs.aggregate.UsernameChangedEventHandler uses a type in src.bus.command.Command.
- The types involved
specs.aggregate.UsernameChangedEventHandler.UsernameChangedEventHandler→src.bus.command.Command.Command
- Direction
- specs.aggregate.UsernameChangedEventHandler uses src.bus.command.Command, so a change to src.bus.command.Command can break specs.aggregate.UsernameChangedEventHandler, while a change to specs.aggregate.UsernameChangedEventHandler can't break src.bus.command.Command.
- Position
- Below the diagonal: specs.aggregate.UsernameChangedEventHandler uses a module listed above it, which is the healthy direction.
28→13 specs.aggregate.UsernameChangedEventHandler uses specs.aggregate.UsernameUpdatedEvent✕
- Connections
- 1 pair of types, where a type in specs.aggregate.UsernameChangedEventHandler uses a type in specs.aggregate.UsernameUpdatedEvent.
- The types involved
specs.aggregate.UsernameChangedEventHandler.UsernameChangedEventHandler→specs.aggregate.UsernameUpdatedEvent.UsernameUpdatedEvent
- Direction
- specs.aggregate.UsernameChangedEventHandler uses specs.aggregate.UsernameUpdatedEvent, so a change to specs.aggregate.UsernameUpdatedEvent can break specs.aggregate.UsernameChangedEventHandler, while a change to specs.aggregate.UsernameChangedEventHandler can't break specs.aggregate.UsernameUpdatedEvent.
- Position
- Below the diagonal: specs.aggregate.UsernameChangedEventHandler uses a module listed above it, which is the healthy direction.
28→21 specs.aggregate.UsernameChangedEventHandler uses src.bus.Bus✕
- Connections
- 1 pair of types, where a type in specs.aggregate.UsernameChangedEventHandler uses a type in src.bus.Bus.
- The types involved
specs.aggregate.UsernameChangedEventHandler.UsernameChangedEventHandler→src.bus.Bus.Bus
- Direction
- specs.aggregate.UsernameChangedEventHandler uses src.bus.Bus, so a change to src.bus.Bus can break specs.aggregate.UsernameChangedEventHandler, while a change to specs.aggregate.UsernameChangedEventHandler can't break src.bus.Bus.
- Position
- Below the diagonal: specs.aggregate.UsernameChangedEventHandler uses a module listed above it, which is the healthy direction.
29→3 specs.bus.command.FakeCommandHandler uses src.bus.command.CommandHandler✕
- Connections
- 1 pair of types, where a type in specs.bus.command.FakeCommandHandler uses a type in src.bus.command.CommandHandler.
- The types involved
specs.bus.command.FakeCommandHandler.FakeCommandHandler→src.bus.command.CommandHandler.CommandHandler
- Direction
- specs.bus.command.FakeCommandHandler uses src.bus.command.CommandHandler, so a change to src.bus.command.CommandHandler can break specs.bus.command.FakeCommandHandler, while a change to specs.bus.command.FakeCommandHandler can't break src.bus.command.CommandHandler.
- Position
- Below the diagonal: specs.bus.command.FakeCommandHandler uses a module listed above it, which is the healthy direction.
29→10 specs.bus.command.FakeCommandHandler uses src.logger.Logger✕
- Connections
- 1 pair of types, where a type in specs.bus.command.FakeCommandHandler uses a type in src.logger.Logger.
- The types involved
specs.bus.command.FakeCommandHandler.FakeCommandHandler→src.logger.Logger.Logger
- Direction
- specs.bus.command.FakeCommandHandler uses src.logger.Logger, so a change to src.logger.Logger can break specs.bus.command.FakeCommandHandler, while a change to specs.bus.command.FakeCommandHandler can't break src.logger.Logger.
- Position
- Below the diagonal: specs.bus.command.FakeCommandHandler uses a module listed above it, which is the healthy direction.
29→14 specs.bus.command.FakeCommandHandler uses specs.bus.command.FakeCommand✕
- Connections
- 1 pair of types, where a type in specs.bus.command.FakeCommandHandler uses a type in specs.bus.command.FakeCommand.
- The types involved
specs.bus.command.FakeCommandHandler.FakeCommandHandler→specs.bus.command.FakeCommand.FakeCommand
- Direction
- specs.bus.command.FakeCommandHandler uses specs.bus.command.FakeCommand, so a change to specs.bus.command.FakeCommand can break specs.bus.command.FakeCommandHandler, while a change to specs.bus.command.FakeCommandHandler can't break specs.bus.command.FakeCommand.
- Position
- Below the diagonal: specs.bus.command.FakeCommandHandler uses a module listed above it, which is the healthy direction.
30→3 specs.bus.command.FakeCommandHandlerWithReturnedValue uses src.bus.command.CommandHandler✕
- Connections
- 1 pair of types, where a type in specs.bus.command.FakeCommandHandlerWithReturnedValue uses a type in src.bus.command.CommandHandler.
- The types involved
specs.bus.command.FakeCommandHandlerWithReturnedValue.FakeCommandHandlerWithReturnedValue→src.bus.command.CommandHandler.CommandHandler
- Direction
- specs.bus.command.FakeCommandHandlerWithReturnedValue uses src.bus.command.CommandHandler, so a change to src.bus.command.CommandHandler can break specs.bus.command.FakeCommandHandlerWithReturnedValue, while a change to specs.bus.command.FakeCommandHandlerWithReturnedValue can't break src.bus.command.CommandHandler.
- Position
- Below the diagonal: specs.bus.command.FakeCommandHandlerWithReturnedValue uses a module listed above it, which is the healthy direction.
30→10 specs.bus.command.FakeCommandHandlerWithReturnedValue uses src.logger.Logger✕
- Connections
- 1 pair of types, where a type in specs.bus.command.FakeCommandHandlerWithReturnedValue uses a type in src.logger.Logger.
- The types involved
specs.bus.command.FakeCommandHandlerWithReturnedValue.FakeCommandHandlerWithReturnedValue→src.logger.Logger.Logger
- Direction
- specs.bus.command.FakeCommandHandlerWithReturnedValue uses src.logger.Logger, so a change to src.logger.Logger can break specs.bus.command.FakeCommandHandlerWithReturnedValue, while a change to specs.bus.command.FakeCommandHandlerWithReturnedValue can't break src.logger.Logger.
- Position
- Below the diagonal: specs.bus.command.FakeCommandHandlerWithReturnedValue uses a module listed above it, which is the healthy direction.
30→14 specs.bus.command.FakeCommandHandlerWithReturnedValue uses specs.bus.command.FakeCommand✕
- Connections
- 1 pair of types, where a type in specs.bus.command.FakeCommandHandlerWithReturnedValue uses a type in specs.bus.command.FakeCommand.
- The types involved
specs.bus.command.FakeCommandHandlerWithReturnedValue.FakeCommandHandlerWithReturnedValue→specs.bus.command.FakeCommand.FakeCommand
- Direction
- specs.bus.command.FakeCommandHandlerWithReturnedValue uses specs.bus.command.FakeCommand, so a change to specs.bus.command.FakeCommand can break specs.bus.command.FakeCommandHandlerWithReturnedValue, while a change to specs.bus.command.FakeCommandHandlerWithReturnedValue can't break specs.bus.command.FakeCommand.
- Position
- Below the diagonal: specs.bus.command.FakeCommandHandlerWithReturnedValue uses a module listed above it, which is the healthy direction.
31→3 specs.bus.commandBus.FakeUpdateNameCommandHandler uses src.bus.command.CommandHandler✕
- Connections
- 1 pair of types, where a type in specs.bus.commandBus.FakeUpdateNameCommandHandler uses a type in src.bus.command.CommandHandler.
- The types involved
specs.bus.commandBus.FakeUpdateNameCommandHandler.FakeUpdateNameCommandHandler→src.bus.command.CommandHandler.CommandHandler
- Direction
- specs.bus.commandBus.FakeUpdateNameCommandHandler uses src.bus.command.CommandHandler, so a change to src.bus.command.CommandHandler can break specs.bus.commandBus.FakeUpdateNameCommandHandler, while a change to specs.bus.commandBus.FakeUpdateNameCommandHandler can't break src.bus.command.CommandHandler.
- Position
- Below the diagonal: specs.bus.commandBus.FakeUpdateNameCommandHandler uses a module listed above it, which is the healthy direction.
31→16 specs.bus.commandBus.FakeUpdateNameCommandHandler uses specs.bus.commandBus.FakeUpdateNameCommand✕
- Connections
- 1 pair of types, where a type in specs.bus.commandBus.FakeUpdateNameCommandHandler uses a type in specs.bus.commandBus.FakeUpdateNameCommand.
- The types involved
specs.bus.commandBus.FakeUpdateNameCommandHandler.FakeUpdateNameCommandHandler→specs.bus.commandBus.FakeUpdateNameCommand.FakeUpdateNameCommand
- Direction
- specs.bus.commandBus.FakeUpdateNameCommandHandler uses specs.bus.commandBus.FakeUpdateNameCommand, so a change to specs.bus.commandBus.FakeUpdateNameCommand can break specs.bus.commandBus.FakeUpdateNameCommandHandler, while a change to specs.bus.commandBus.FakeUpdateNameCommandHandler can't break specs.bus.commandBus.FakeUpdateNameCommand.
- Position
- Below the diagonal: specs.bus.commandBus.FakeUpdateNameCommandHandler uses a module listed above it, which is the healthy direction.
31→18 specs.bus.commandBus.FakeUpdateNameCommandHandler uses specs.logger.FakeLogger✕
- Connections
- 1 pair of types, where a type in specs.bus.commandBus.FakeUpdateNameCommandHandler uses a type in specs.logger.FakeLogger.
- The types involved
specs.bus.commandBus.FakeUpdateNameCommandHandler.FakeUpdateNameCommandHandler→specs.logger.FakeLogger.FakeLogger
- Direction
- specs.bus.commandBus.FakeUpdateNameCommandHandler uses specs.logger.FakeLogger, so a change to specs.logger.FakeLogger can break specs.bus.commandBus.FakeUpdateNameCommandHandler, while a change to specs.bus.commandBus.FakeUpdateNameCommandHandler can't break specs.logger.FakeLogger.
- Position
- Below the diagonal: specs.bus.commandBus.FakeUpdateNameCommandHandler uses a module listed above it, which is the healthy direction.
32→4 specs.bus.commandBus.FakeUpdateNameWithReturnedValueCommandHandler uses src.bus.command.ICommandHandler✕
- Connections
- 1 pair of types, where a type in specs.bus.commandBus.FakeUpdateNameWithReturnedValueCommandHandler uses a type in src.bus.command.ICommandHandler.
- The types involved
specs.bus.commandBus.FakeUpdateNameWithReturnedValueCommandHandler.FakeUpdateNameWithReturnedValueCommandHandler→src.bus.command.ICommandHandler.ICommandHandler
- Direction
- specs.bus.commandBus.FakeUpdateNameWithReturnedValueCommandHandler uses src.bus.command.ICommandHandler, so a change to src.bus.command.ICommandHandler can break specs.bus.commandBus.FakeUpdateNameWithReturnedValueCommandHandler, while a change to specs.bus.commandBus.FakeUpdateNameWithReturnedValueCommandHandler can't break src.bus.command.ICommandHandler.
- Position
- Below the diagonal: specs.bus.commandBus.FakeUpdateNameWithReturnedValueCommandHandler uses a module listed above it, which is the healthy direction.
32→16 specs.bus.commandBus.FakeUpdateNameWithReturnedValueCommandHandler uses specs.bus.commandBus.FakeUpdateNameCommand✕
- Connections
- 1 pair of types, where a type in specs.bus.commandBus.FakeUpdateNameWithReturnedValueCommandHandler uses a type in specs.bus.commandBus.FakeUpdateNameCommand.
- The types involved
specs.bus.commandBus.FakeUpdateNameWithReturnedValueCommandHandler.FakeUpdateNameWithReturnedValueCommandHandler→specs.bus.commandBus.FakeUpdateNameCommand.FakeUpdateNameCommand
- Direction
- specs.bus.commandBus.FakeUpdateNameWithReturnedValueCommandHandler uses specs.bus.commandBus.FakeUpdateNameCommand, so a change to specs.bus.commandBus.FakeUpdateNameCommand can break specs.bus.commandBus.FakeUpdateNameWithReturnedValueCommandHandler, while a change to specs.bus.commandBus.FakeUpdateNameWithReturnedValueCommandHandler can't break specs.bus.commandBus.FakeUpdateNameCommand.
- Position
- Below the diagonal: specs.bus.commandBus.FakeUpdateNameWithReturnedValueCommandHandler uses a module listed above it, which is the healthy direction.
32→18 specs.bus.commandBus.FakeUpdateNameWithReturnedValueCommandHandler uses specs.logger.FakeLogger✕
- Connections
- 1 pair of types, where a type in specs.bus.commandBus.FakeUpdateNameWithReturnedValueCommandHandler uses a type in specs.logger.FakeLogger.
- The types involved
specs.bus.commandBus.FakeUpdateNameWithReturnedValueCommandHandler.FakeUpdateNameWithReturnedValueCommandHandler→specs.logger.FakeLogger.FakeLogger
- Direction
- specs.bus.commandBus.FakeUpdateNameWithReturnedValueCommandHandler uses specs.logger.FakeLogger, so a change to specs.logger.FakeLogger can break specs.bus.commandBus.FakeUpdateNameWithReturnedValueCommandHandler, while a change to specs.bus.commandBus.FakeUpdateNameWithReturnedValueCommandHandler can't break specs.logger.FakeLogger.
- Position
- Below the diagonal: specs.bus.commandBus.FakeUpdateNameWithReturnedValueCommandHandler uses a module listed above it, which is the healthy direction.
33→17 specs.bus.query.FakeViewCurrentNameQueryHandler uses specs.bus.query.FakeViewCurrentNameQuery✕
- Connections
- 1 pair of types, where a type in specs.bus.query.FakeViewCurrentNameQueryHandler uses a type in specs.bus.query.FakeViewCurrentNameQuery.
- The types involved
specs.bus.query.FakeViewCurrentNameQueryHandler.FakeViewCurrentNameQueryHandler→specs.bus.query.FakeViewCurrentNameQuery.FakeViewCurrentNameQuery
- Direction
- specs.bus.query.FakeViewCurrentNameQueryHandler uses specs.bus.query.FakeViewCurrentNameQuery, so a change to specs.bus.query.FakeViewCurrentNameQuery can break specs.bus.query.FakeViewCurrentNameQueryHandler, while a change to specs.bus.query.FakeViewCurrentNameQueryHandler can't break specs.bus.query.FakeViewCurrentNameQuery.
- Position
- Below the diagonal: specs.bus.query.FakeViewCurrentNameQueryHandler uses a module listed above it, which is the healthy direction.
34→26 specs.entity.FakeUserData uses src.valueObject.uuid.UUID✕
- Connections
- 1 pair of types, where a type in specs.entity.FakeUserData uses a type in src.valueObject.uuid.UUID.
- The types involved
specs.entity.FakeUserData.FakeUserData→src.valueObject.uuid.UUID.UUID
- Direction
- specs.entity.FakeUserData uses src.valueObject.uuid.UUID, so a change to src.valueObject.uuid.UUID can break specs.entity.FakeUserData, while a change to specs.entity.FakeUserData can't break src.valueObject.uuid.UUID.
- Position
- Below the diagonal: specs.entity.FakeUserData uses a module listed above it, which is the healthy direction.
35→7 src.eventBus.EventBusPort uses src.domainEvent.DomainEvent✕
- Connections
- 1 pair of types, where a type in src.eventBus.EventBusPort uses a type in src.domainEvent.DomainEvent.
- The types involved
src.eventBus.EventBusPort.EventBusPort→src.domainEvent.DomainEvent.DomainEvent
- Direction
- src.eventBus.EventBusPort uses src.domainEvent.DomainEvent, so a change to src.domainEvent.DomainEvent can break src.eventBus.EventBusPort, while a change to src.eventBus.EventBusPort can't break src.domainEvent.DomainEvent.
- Position
- Below the diagonal: src.eventBus.EventBusPort uses a module listed above it, which is the healthy direction.
35→25 src.eventBus.EventBusPort uses src.eventBus.IEventMiddleware✕
- Connections
- 1 pair of types, where a type in src.eventBus.EventBusPort uses a type in src.eventBus.IEventMiddleware.
- The types involved
src.eventBus.EventBusPort.EventBusPort→src.eventBus.IEventMiddleware.IEventMiddleware
- Direction
- src.eventBus.EventBusPort uses src.eventBus.IEventMiddleware, so a change to src.eventBus.IEventMiddleware can break src.eventBus.EventBusPort, while a change to src.eventBus.EventBusPort can't break src.eventBus.IEventMiddleware.
- Position
- Below the diagonal: src.eventBus.EventBusPort uses a module listed above it, which is the healthy direction.
36→7 src.eventBus.EventLoggingMiddleware uses src.domainEvent.DomainEvent✕
- Connections
- 1 pair of types, where a type in src.eventBus.EventLoggingMiddleware uses a type in src.domainEvent.DomainEvent.
- The types involved
src.eventBus.EventLoggingMiddleware.EventLoggingMiddleware→src.domainEvent.DomainEvent.DomainEvent
- Direction
- src.eventBus.EventLoggingMiddleware uses src.domainEvent.DomainEvent, so a change to src.domainEvent.DomainEvent can break src.eventBus.EventLoggingMiddleware, while a change to src.eventBus.EventLoggingMiddleware can't break src.domainEvent.DomainEvent.
- Position
- Below the diagonal: src.eventBus.EventLoggingMiddleware uses a module listed above it, which is the healthy direction.
36→10 src.eventBus.EventLoggingMiddleware uses src.logger.Logger✕
- Connections
- 1 pair of types, where a type in src.eventBus.EventLoggingMiddleware uses a type in src.logger.Logger.
- The types involved
src.eventBus.EventLoggingMiddleware.EventLoggingMiddleware→src.logger.Logger.Logger
- Direction
- src.eventBus.EventLoggingMiddleware uses src.logger.Logger, so a change to src.logger.Logger can break src.eventBus.EventLoggingMiddleware, while a change to src.eventBus.EventLoggingMiddleware can't break src.logger.Logger.
- Position
- Below the diagonal: src.eventBus.EventLoggingMiddleware uses a module listed above it, which is the healthy direction.
36→25 src.eventBus.EventLoggingMiddleware uses src.eventBus.IEventMiddleware✕
- Connections
- 1 pair of types, where a type in src.eventBus.EventLoggingMiddleware uses a type in src.eventBus.IEventMiddleware.
- The types involved
src.eventBus.EventLoggingMiddleware.EventLoggingMiddleware→src.eventBus.IEventMiddleware.IEventMiddleware
- Direction
- src.eventBus.EventLoggingMiddleware uses src.eventBus.IEventMiddleware, so a change to src.eventBus.IEventMiddleware can break src.eventBus.EventLoggingMiddleware, while a change to src.eventBus.EventLoggingMiddleware can't break src.eventBus.IEventMiddleware.
- Position
- Below the diagonal: src.eventBus.EventLoggingMiddleware uses a module listed above it, which is the healthy direction.
37→8 specs.entity.FakeUserEntity uses src.entity.Entity✕
- Connections
- 1 pair of types, where a type in specs.entity.FakeUserEntity uses a type in src.entity.Entity.
- The types involved
specs.entity.FakeUserEntity.FakeUserEntity→src.entity.Entity.Entity
- Direction
- specs.entity.FakeUserEntity uses src.entity.Entity, so a change to src.entity.Entity can break specs.entity.FakeUserEntity, while a change to specs.entity.FakeUserEntity can't break src.entity.Entity.
- Position
- Below the diagonal: specs.entity.FakeUserEntity uses a module listed above it, which is the healthy direction.
37→34 specs.entity.FakeUserEntity uses specs.entity.FakeUserData✕
- Connections
- 1 pair of types, where a type in specs.entity.FakeUserEntity uses a type in specs.entity.FakeUserData.
- The types involved
specs.entity.FakeUserEntity.FakeUserEntity→specs.entity.FakeUserData.FakeUserData
- Direction
- specs.entity.FakeUserEntity uses specs.entity.FakeUserData, so a change to specs.entity.FakeUserData can break specs.entity.FakeUserEntity, while a change to specs.entity.FakeUserEntity can't break specs.entity.FakeUserData.
- Position
- Below the diagonal: specs.entity.FakeUserEntity uses a module listed above it, which is the healthy direction.
38→7 src.aggregate.Aggregate uses src.domainEvent.DomainEvent✕
- Connections
- 1 pair of types, where a type in src.aggregate.Aggregate uses a type in src.domainEvent.DomainEvent.
- The types involved
src.aggregate.Aggregate.Aggregate→src.domainEvent.DomainEvent.DomainEvent
- Direction
- src.aggregate.Aggregate uses src.domainEvent.DomainEvent, so a change to src.domainEvent.DomainEvent can break src.aggregate.Aggregate, while a change to src.aggregate.Aggregate can't break src.domainEvent.DomainEvent.
- Position
- Below the diagonal: src.aggregate.Aggregate uses a module listed above it, which is the healthy direction.
38→8 src.aggregate.Aggregate uses src.entity.Entity✕
- Connections
- 1 pair of types, where a type in src.aggregate.Aggregate uses a type in src.entity.Entity.
- The types involved
src.aggregate.Aggregate.Aggregate→src.entity.Entity.Entity
- Direction
- src.aggregate.Aggregate uses src.entity.Entity, so a change to src.entity.Entity can break src.aggregate.Aggregate, while a change to src.aggregate.Aggregate can't break src.entity.Entity.
- Position
- Below the diagonal: src.aggregate.Aggregate uses a module listed above it, which is the healthy direction.
38→35 src.aggregate.Aggregate uses src.eventBus.EventBusPort✕
- Connections
- 1 pair of types, where a type in src.aggregate.Aggregate uses a type in src.eventBus.EventBusPort.
- The types involved
src.aggregate.Aggregate.Aggregate→src.eventBus.EventBusPort.EventBusPort
- Direction
- src.aggregate.Aggregate uses src.eventBus.EventBusPort, so a change to src.eventBus.EventBusPort can break src.aggregate.Aggregate, while a change to src.aggregate.Aggregate can't break src.eventBus.EventBusPort.
- Position
- Below the diagonal: src.aggregate.Aggregate uses a module listed above it, which is the healthy direction.
39→7 src.eventBus.EventBus uses src.domainEvent.DomainEvent✕
- Connections
- 1 pair of types, where a type in src.eventBus.EventBus uses a type in src.domainEvent.DomainEvent.
- The types involved
src.eventBus.EventBus.EventBus→src.domainEvent.DomainEvent.DomainEvent
- Direction
- src.eventBus.EventBus uses src.domainEvent.DomainEvent, so a change to src.domainEvent.DomainEvent can break src.eventBus.EventBus, while a change to src.eventBus.EventBus can't break src.domainEvent.DomainEvent.
- Position
- Below the diagonal: src.eventBus.EventBus uses a module listed above it, which is the healthy direction.
39→25 src.eventBus.EventBus uses src.eventBus.IEventMiddleware✕
- Connections
- 1 pair of types, where a type in src.eventBus.EventBus uses a type in src.eventBus.IEventMiddleware.
- The types involved
src.eventBus.EventBus.EventBus→src.eventBus.IEventMiddleware.IEventMiddleware
- Direction
- src.eventBus.EventBus uses src.eventBus.IEventMiddleware, so a change to src.eventBus.IEventMiddleware can break src.eventBus.EventBus, while a change to src.eventBus.EventBus can't break src.eventBus.IEventMiddleware.
- Position
- Below the diagonal: src.eventBus.EventBus uses a module listed above it, which is the healthy direction.
39→35 src.eventBus.EventBus uses src.eventBus.EventBusPort✕
- Connections
- 1 pair of types, where a type in src.eventBus.EventBus uses a type in src.eventBus.EventBusPort.
- The types involved
src.eventBus.EventBus.EventBus→src.eventBus.EventBusPort.EventBusPort
- Direction
- src.eventBus.EventBus uses src.eventBus.EventBusPort, so a change to src.eventBus.EventBusPort can break src.eventBus.EventBus, while a change to src.eventBus.EventBus can't break src.eventBus.EventBusPort.
- Position
- Below the diagonal: src.eventBus.EventBus uses a module listed above it, which is the healthy direction.
40→34 specs.aggregate.FakeUserAggregate uses specs.entity.FakeUserData✕
- Connections
- 1 pair of types, where a type in specs.aggregate.FakeUserAggregate uses a type in specs.entity.FakeUserData.
- The types involved
specs.aggregate.FakeUserAggregate.FakeUserAggregate→specs.entity.FakeUserData.FakeUserData
- Direction
- specs.aggregate.FakeUserAggregate uses specs.entity.FakeUserData, so a change to specs.entity.FakeUserData can break specs.aggregate.FakeUserAggregate, while a change to specs.aggregate.FakeUserAggregate can't break specs.entity.FakeUserData.
- Position
- Below the diagonal: specs.aggregate.FakeUserAggregate uses a module listed above it, which is the healthy direction.
40→38 specs.aggregate.FakeUserAggregate uses src.aggregate.Aggregate✕
- Connections
- 1 pair of types, where a type in specs.aggregate.FakeUserAggregate uses a type in src.aggregate.Aggregate.
- The types involved
specs.aggregate.FakeUserAggregate.FakeUserAggregate→src.aggregate.Aggregate.Aggregate
- Direction
- specs.aggregate.FakeUserAggregate uses src.aggregate.Aggregate, so a change to src.aggregate.Aggregate can break specs.aggregate.FakeUserAggregate, while a change to specs.aggregate.FakeUserAggregate can't break src.aggregate.Aggregate.
- Position
- Below the diagonal: specs.aggregate.FakeUserAggregate uses a module listed above it, which is the healthy direction.
At a glance — Code Health
The Good
D1 · TypeScript
Cyclomatic Complexity
10.0
D2 · TypeScript
Cognitive Complexity
10.0
D3 · TypeScript
God Classes
10.0
D17 · TypeScript
Explicit Debt
10.0
GD1 · Repo
Unfinished & placeholder code
10.0
IC1 · Repo
Incompleteness & stubs
10.0
R1 · React / TS
Type Safety
10.0
R10 · React / TS
Code Duplication
9.1
R2 · React / TS
Cyclomatic Complexity
10.0
R3 · React / TS
Large Files
10.0
R7 · React / TS
Dead Code
10.0
X1 · Repo
Async correctness
10.0
X12 · Repo
Unreachable branch
10.0
X13 · Repo
Undrained process stream
10.0
X16 · Repo
Unfloored truncation loop
10.0
X18 · Repo
Disposal-pattern correctness
10.0
X19 · Repo
Unrestored process-global state
10.0
X21 · Repo
Side-effecting pattern guard
10.0
X22 · Repo
Contradicted release guard
10.0
X23 · Repo
Unguarded diagnostic materialisation
10.0
X25 · Repo
Inert configuration knob
10.0
X28 · Repo
Index access outside its own emptiness guard
10.0
X29 · Repo
Per-element action decided by a fixed element
10.0
X3 · Repo
Exception handling
10.0
X30 · Repo
Support guard that admits what it rejects
10.0
X5 · Repo
Nullable reference types
10.0
At a glance — Architecture
The Good
D6 · TypeScript
Cohesion (LCOM4)
10.0
D26 · TypeScript
Project Cohesion
10.0
D35 · TypeScript
Change Coupling
10.0
AX10 · Repo
Code composition
10.0
AX3 · Repo
Project dependency cycles
10.0
AX4 · Repo
Dependency direction
10.0
AX5 · Repo
Architecture & structure
10.0
AX6 · Repo
Interface segregation
10.0
R9 · React / TS
Circular Imports
10.0
At a glance — Maturity
The Good
At a glance — Readiness
The Good
D8 · TypeScript
Code Coverage
10.0
D9 · TypeScript
Test Distribution
10.0
D10 · TypeScript
Test Quality
10.0
D11 · TypeScript
Test Reliability
10.0
D13 · TypeScript
Secret Scanning
10.0
P1 · Repo
CI/CD gates
10.0
P10 · Repo
Library API & versioning
10.0
P6 · Repo
Release Hygiene
10.0
R4 · React / TS
Test Coverage
10.0
R5 · React / TS
Dependency Freshness
9.2
R6 · React / TS
Tooling
10.0
R8 · React / TS
Dependency Hygiene
10.0
At a glance — Security
The Good
D28 · TypeScript
Secrets (history)
10.0
D29 · TypeScript
Static Analysis (SAST)
8.0
D43 · TypeScript
Malicious Dependencies
10.0
X14 · Repo
Bypassable address classification
10.0
X15 · Repo
Unvalidated length from an untrusted reader
10.0
X17 · Repo
Uncapped recursion over a caller-supplied document
10.0
X24 · Repo
Document value interpolated into markup unescaped
10.0
At a glance — Domain Modelling
The Good
At a glance — Performance
Security & Compliance — OWASP Top-10 mapping
| OWASP category | Findings | Severity |
|---|---|---|
| A03:2025 — Software Supply Chain Failures | 18 | High / Critical |
| A05:2025 — Injection | 5 | High / Critical |
Roadmap
Begin by establishing a formal record of significant design decisions in a dedicated ADR folder to clarify architectural intent. Simultaneously, enhance the root README by adding a clear testing section and addressing the 13 high-severity dependency vulnerabilities to ensure a secure and verifiable codebase. Finally, integrate static security analysis into the CI pipeline to automatically block regressions and maintain ongoing code quality.
| Do this | Helps | Effort | Dimension |
|---|---|---|---|
| Record your significant design decisions. Write one short document per decision, giving its date, the situation, the decision and its consequences, and keep them together with your other design documents. A docs/adr folder with each file named by number and title is the easiest place to find them. | +7.8 pts | Medium | Architecture documentation |
| Improve Documentation Quality — currently 7.0/10. | +6.3 pts | Medium | Documentation Quality |
| Explain in the README how to run the tests. Add a section called Testing to the README in the repository's top folder, saying how to run the test suite. | +3.4 pts | Medium | Documentation (README) |
| Add a SAST step to CI running what this repository's stack ships: CodeQL's javascript-typescript pack, `semgrep --config=p/typescript`, or eslint-plugin-security — so a security regression fails the build instead of landing. | +2.0 pts | Medium | Security & performance tooling |
| Resolve the 13 High CVE finding(s) in Dependency Vulnerabilities — start with REDACTED (13). | +1.5 pts | Medium | Dependency Vulnerabilities |
| Resolve the 1 REDACTED finding(s) in Static Analysis (SAST) — start with REDACTED. | +0.5 pts | Low | Static Analysis (SAST) |
| Resolve the 2 Critical CVE finding(s) in Dependency Vulnerabilities — start with REDACTED, REDACTED. | +0.5 pts | Low | Dependency Vulnerabilities |
| Resolve the 2 Medium CVE finding(s) in Dependency Vulnerabilities — start with REDACTED (2). | +0.3 pts | Low | Dependency Vulnerabilities |
File quality
| File | Score | Band | Worst signal |
|---|---|---|---|
| REDACTED | 0.6 | Slop | Dependency Vulnerabilities: Critical CVE: REDACTED |
| REDACTED | 1.6 | Slop | Static Analysis (SAST): High: REDACTED |
| REDACTED | 7.2 | Near-clean | Dependency Vulnerabilities: Critical CVE: REDACTED |
How the grades work
Critical — 19
A definite problem that already costs you something and drags the score down: a missing authorisation check, a dependency with a known exploit, a build that does not reproduce. Failure here tends to cause failures elsewhere.
Serious — 9
Likely wrong, but not failing yet. It degrades the codebase over a longer horizon and can cause failures elsewhere — not urgent this week, not something to carry for two years either.
Minor — 6
Recorded, with no effect on how the codebase functions. Present so the survey is complete, not because it needs doing.
Could not be resolved — 9
Something this survey could not settle from the outside, and which could be critical or serious. Either a control was required and no positive evidence of it exists in the repository — a backup job that nothing shows was ever restored from proves nothing about restores — or our own analysis could not run over that part of the tree. This is not a clean result. These are excluded from the score rather than awarded a pass, so the number on the cover neither rewards nor penalises them: if you act on this survey without resolving them, you carry that risk yourself. Each one is named under Limitations.
Methodology & how to trust this report
Watchdog is a deep, periodic assessment — run each sprint, monthly, or quarterly, taking the time to go wider and deeper than a quick check and surfacing in one coherent report what you'd otherwise piece together from a dozen separate tools. It scores deterministically: the same commit yields the same score, every run. 66 of 69 evaluated dimensions are computed purely by tools and static analysis (confidence 1.0); 3 documentation/naming judgement(s) are LLM-assisted and labelled advisory. Overall confidence is 0.8 — the weighted average across measured dimensions; it falls as more of the score leans on LLM-assisted judgement and rises when it's fully tool-backed.
What we checked — 69 dimensions across the health lenses
D1D2D3D6D8D9D10D11D13D15D17D19D21D26D28D29D30D35D43AX10AX3AX4AX5AX6DM1DM11DM5DM6DM9GD1IC1M1M2M3M4P1P10P3P6PF3R1R10R2R3R4R5R6R7R8R9X1X12X13X14X15X16X17X18X19X21X22X23X24X25X28X29X3X30X5
How to trust any code-health report — three questions
- Can you open the finding? Real findings cite a repo-relative file and line you can open at the cited line — never an absolute scratch path. Here, 26 of 34 do; the remainder are repo-wide signals — a dimension-level measurement, not a single line.
- Is there a tool behind the number? Every score below names the method that produced it — Roslyn, git, a scanner, or (for a handful of documentation/naming dimensions) an LLM labelled sampled · advisory — not a narrative.
- Does re-running give the same result? Run it again on the same commit and the score — and this report, byte for byte — is identical. A report whose numbers move between runs is describing the run, not the code.
Tools & methods
| Method | Backs | Version | Evaluator |
|---|---|---|---|
| Roslyn static analysis | Complexity, cohesion, coupling, dead code, API surface, layering | 5.3.0 | ✓ deterministic |
| Native secret scanner | Hardcoded secrets / credentials | 1.0.0 | ✓ deterministic |
| Watchdog duplication detector (in-process) | Code duplication | 1.0.0 | ✓ deterministic |
| Coverage (coverlet / dotnet-coverage) | Line & branch coverage | 10.0.400 | ✓ deterministic |
| NuGet / dotnet | Outdated, vulnerable & deprecated dependencies | 10.0.400 | ✓ deterministic |
| git / LibGit2Sharp | Churn hotspots, knowledge concentration, history | 2.43.0 · 0.31.0 | ✓ deterministic |
| gitleaks · semgrep · trivy | Secrets in history, SAST, CVEs, IaC & container, PII / GDPR | 1.86.0 · 0.69.3 | ✓ deterministic |
| LLM (sampled · advisory) | Documentation quality, ADR conformance, naming — sampled over a bounded sample; advisory, never a deterministic measurement | Local LLM | ◐ LLM · sampled · advisory |
Run transparency — what happened this run
- D12 Dependency Hygiene — not measured this run — This is a true statement about the repository that carries nothing for its owner to act on, so it is reported here rather than as a defect in their code. This repository's 1 REDACTED manifest(s) and its 1 committed lockfile(s) WERE read; what went unanswered is the currency half, because it grades the production `dependencies` a lockfile resolves and these manifests declare none — only 9 devDependencies, which D12 does not grade. So registry.npmjs.org was never asked, and there was nothing here for it to grade. This is a true statement about the repository and NOT a gap on our side: the lockfile was resolved, and no reader we could write would find a production dependency in it.
- D14 License Compliance — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This repository declares no npm dependency a consumer installs, but 3 path(s) its REDACTED says it ships are not in the checkout (`dist`, `dist/index.js`, `dist/index.mjs`) — they are built at publish time, and a bundler can inline `devDependencies` into them. What a package ships is not only what it declares: a devDependency bundled into build output ships under its own licence, and this pass has no reader for build output. So whether there is a licence to grade here was not established — a missing collector, not a statement about this repository.
- D22 Internal API Consistency — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. D22 identifies the intentionally-exposed surface from `IsPackable` and `.Contracts` project names, MSBuild conventions read off the loaded project set. This target exposed no such projects, so the probe never ran; this says nothing about whether the repository has a public API. This repository commits no C#/VB source at all, so there was never an MSBuild project set to read these conventions off. That is OUR side and it is an ADMISSION gap, not an environment fault: it declares a published package (REDACTED), but no published-package marker D22 reads admitted any project here. D22 DOES collect the public API of every language in this tree, and admits a project only when its manifest makes that ecosystem's publication act in a form the marker recognises — so what is missing is not a collector but an admission rule for the publication act this repository makes, if it makes one. The remedy is a better discriminator for that marker — not a collector, and no change to the scan image can close it. The marker's rules are measured to refuse applications, so one refused repository is the rule working as calibrated; several are the evidence that it is too strict. For npm the surface is what a published REDACTED's entry points (exports, main, module, types) export, followed through the source; an entry that names build output the tree does not commit (dist/, build/) is not followed back to source, because only a tsconfig outDir/rootDir pair states that mapping and a bundler's input lives in executable configuration this engine does not evaluate.
- D27 Navigability — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. Navigability is taken over call sites whose callee resolved. For C# that population includes calls into referenced assemblies; for this language only calls declared inside the repository count, so the abstention threshold reads the repository's use of its standard library as a resolution failure. That is a limit of this analyzer, not a build problem in this repository.
- D34 Knowledge Freshness — not measured this run — This is a true statement about the repository that carries nothing for its owner to act on, so it is reported here rather than as a defect in their code. All 34 production source file(s) in this repository were read, and every one is under the ~2,400-byte (~100-line) size floor this dimension measures over (or declares itself generated), so there is no significant file to judge and knowledge freshness is not applicable. This is the size of the repository's files, not a file the engine failed to read.
- D44 Platform End-of-Life — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This dimension reads a project's own statement about the platform it runs on: a TargetFramework in a .NET project file, a .nvmrc or .python-version, a capped requires-python, a Rust toolchain file or Cargo.toml rust-version, a .go-version, .java-version, .ruby-version, .tool-versions or .sdkmanrc, a go.mod go directive, a Maven or Gradle Java level or toolchain, a Gemfile's ruby directive, a mix.exs elixir requirement, a rebar.config minimum_otp_vsn, a pubspec.yaml SDK constraint, a build.sbt scalaVersion, or a framework major pinned by a dependency constraint. This repository carries none of them, so nothing about its platform was established. That is a gap in this analyzer's coverage, NOT a finding that the platform is supported — a language whose runtime is declared elsewhere (Package.swift, a Dockerfile) is simply not read here yet.
- DM9 Scattered domain decisions — measured, with a gap in what it reached — Watchdog measured this, but not all of it. What it did not reach is a gap on our side — a collector, parser or image we have not built yet — so the numbers on that dimension cover less than the repository, and the part left out is not evidence that it would have passed. Arm two tells a construction that PRODUCES a measurement from one that merely passes it along, and this repository's frontend does not compute that fact. A measurement built independently in two places would not appear above.
- P5 DR & Backup — not measured this run — This is a true statement about the repository that carries nothing for its owner to act on, so it is reported here rather than as a defect in their code. No backup/snapshot/replication config, RTO/RPO or restore-procedure documentation was found — and none applies: this repository publishes a library and deploys nothing (no container, IaC or deployment manifest), so it holds no runtime state of its own. Any data-access dependency it declares is the store it is a CLIENT for, not one it operates. The DR control belongs to whoever runs that data.
- S1 Web-Security Posture — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. 33 JavaScript/TypeScript file(s) were read for weak hashes and ciphers, key material fixed in the source, disabled certificate validation and obsolete TLS versions, and none was found. The server controls this dimension also scores were not assessed, so no score is given.
- X2 Cancellation propagation — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript, Go, PHP, Dart, Kotlin, Ruby, Scala, Java, Python and Rust source only, and no C# was loaded, and no named async function in this repository's JavaScript/TypeScript, nor any Go, PHP or Dart function or Kotlin suspend function, makes a request that can be cancelled (fetch, axios, ky, ofetch; net/http, net.Dial; amphp; Dio; Ktor, OkHttp), so there is nothing to judge, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- X4 Structured logging — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript, Java, Kotlin, Python, PHP, Dart, Ruby, Scala and Rust source only, and no C# was loaded, and this repository's JavaScript/TypeScript, Python and PHP log through no library that carries a message's values as fields (pino, winston, bunyan, tslog, LogTape, roarr; Python's logging, structlog; PHP's PSR-3 loggers), so its log calls cannot be judged, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
Limitations & what we did not check
Watchdog assesses the repository exactly as committed, and only the repository. By design it does not reach outside the source tree: the live cloud account, the running CI/CD pipeline, the host's branch-protection and approval rules, the production configuration, or a restore actually exercised against a backup are all out of scope. That boundary is a feature, not a gap — a repo-relative, deterministic scan re-runs identically on any commit and every finding opens at a real file and line, where a live audit can neither be reproduced nor traced. The visible consequence is that controls which leave no in-repo evidence are reported as "not evidenced" and excluded from the score rather than awarded a number a static scan cannot justify.
Per-dimension blind spots
- D1 Cyclomatic Complexity: Cyclomatic complexity counts branches statically — it cannot tell an essential decision tree from accidental tangle, nor see complexity that lives in data or configuration (large switch-case token tables, DSL lexers/parsers, data-as-code rule tables) rather than control flow: a tokenizer's many single-character cases read as high complexity though each branch is trivial.
- D2 Cognitive Complexity: Cognitive-complexity heuristics approximate how hard code is to follow; genuine domain difficulty and well-named intent that eases reading are not captured.
- D3 God Classes: "God class" is sized by members and responsibilities visible in the type — a deliberately broad facade over a coherent subsystem can read the same as an accidental grab-bag. For front-end JS the file-length check is cohesion-aware (a single-responsibility module — one class/IIFE — earns a 3× threshold), but cohesion is approximated from top-level declarations, not true dependency structure.
- D6 Cohesion (LCOM4): LCOM4 cohesion is syntactic — it infers connectivity from which methods touch which fields/methods by name, not from real runtime behaviour or intent.
- D8 Code Coverage: Coverage is measured by building and running the test suite inside Watchdog's isolated image — the target repo is never modified, and nothing on your systems runs. So coverage exists only when the suite builds and runs within the inline time budget; one that needs external services, can't build, or exceeds the budget yields no coverage (D8 then degrades to not-measured, not a low score). Line coverage also says nothing about assertion quality.
- D9 Test Distribution: The test-pyramid shape is inferred from project/folder naming and references, with a single test host bucketed per-file by its path tier and content signals — a suite that names tiers unconventionally and gives no per-file signal can still be mis-bucketed.
- D10 Test Quality: Assertion density is structural — it cannot tell a meaningful behavioural assertion from a trivial one, only that an assertion is present.
- D11 Test Reliability: Flakiness is inferred from history/markers — Watchdog runs the suite once (for coverage), not the repeated runs under varied conditions that reveal nondeterminism, so a flaky test never recorded as failing is invisible here.
- D13 Secret Scanning: Secret detection is signature- and entropy-based on the current tree — a secret that does not match a known pattern, or one already rotated, will not be flagged (a clean scan is "nothing matched", not "no secrets exist").
- D15 Churn × Complexity Hotspots: Churn hotspots come from git history — a freshly imported or squashed repository has no churn signal, and recent rewrites can mask a historically risky file.
- D17 Explicit Debt: Acknowledged-debt signals (TODO/FIXME, suppressions, dead code) are textual — undocumented debt that nobody marked, and debt that lives in design rather than annotations, is invisible. Committed machine-written code (scaffolded migrations, designer/codegen output, generated stubs) is excluded — it is never the team's dead code to delete.
- D19 Documentation Quality: Documentation quality is judged by an LLM over a bounded sample of docs — it reads what is written, not whether the docs match the running system, and it is advisory, not a measurement. Its critique rows are drawn from a closed category vocabulary and each row means the same thing in every run, so two scans can be compared row by row; the SET that fires is still a sample, and does not repeat exactly. Measured on one frozen input, six scans at one engine SHA: 2-5 critique rows per scan, 8 distinct rows across the six, 3 of those 8 seen in only one scan. So a D19 row is evidence about the documentation, but a COUNT of D19 rows is not a quantity — never read a change in it as an improvement or a regression.
- D21 Naming Consistency: Naming quality is an LLM judgement over a bounded sample — it assesses clarity/consistency of the names it sees, not domain-correctness, and is advisory.
- D26 Project Cohesion: Project focus is sized from members/namespaces per project — a project that is broad by deliberate design reads the same as one that has sprawled.
- D28 Secrets (history): Secret-history scanning sweeps the git log for known patterns — a secret that predates the available history, or never matched a signature, is not found (clean means "nothing matched in the history we can see").
- D29 Static Analysis (SAST): SAST findings are pattern-based (semgrep) — it finds classes of bug it has rules for; logic flaws, auth/authorization gaps and issues needing runtime context are out of reach (and clean means "no rule matched").
- D30 Dependency Vulnerabilities: CVE matching depends on accurate package/version metadata and on the advisory databases — a vulnerability with no published advisory, or in code not declared as a dependency, is not seen. Coverage needs a RESOLVED graph: an unpinned requirements.txt, or a pom without a resolved build, yields partial coverage rather than a clean verdict. An ecosystem the analyzer cannot scan is reported as unmeasured, never as clean.
- D35 Change Coupling: Change coupling is co-change in COMMITS — files split across separate commits, or coupled only through a shared config/build step, read as uncoupled, and a sweeping commit (rename/format) is excluded so it doesn't couple everything. It shows that files change together, not WHY: a high coupling can be a healthy cohesive pair as readily as a hidden leak.
- D43 Malicious Dependencies: Only packages some vulnerability database has already NAMED as malicious are seen — a compromise published in the last hours, or never reported at all, is invisible here, and this dimension reading 10 is not evidence that a dependency is trustworthy. There is no typosquat or dependency-confusion analysis: a package nobody has reported is simply absent from the feeds. Coverage is the dependency scan's: an ecosystem that could not be scanned is disclosed as unmeasured, never as clean.
- AX10 Code composition: Role is inferred from namespace/folder convention, not semantics — a domain concept living in a folder named "Services" reads as application, and the split is lines-of-code, not business value. The business-logic-share score is a SOFT, FLOORED signal: it contributes to the Architecture lens but is floored at the Critical gate, so an infrastructure-heavy design (a gateway, an ETL, a driver) is legitimately low without being nuked to zero.
- DM6 Domain ↔ infrastructure boundary: Infrastructure reached through a hand-rolled wrapper, a domain-named facade, reflection, or a string-keyed service locator resolves to a non-infra type and isn't seen; the body scan is symbol resolution over syntax, not full dataflow. A clean result means "no resolved infra reference in a domain body", not a proof of purity.
- M4 Documentation accuracy: Onboarding quality is an LLM read of the docs/setup present — it cannot run the onboarding or measure how long a real new joiner takes; the verdict is sampled and advisory.
- P6 Release Hygiene: Rollback/observability controls are inferred from repo artefacts (pipelines, dashboards-as-code) — controls configured in external tooling, with no in-repo trace, cannot be credited.
The LLM boundary
Dimensions
D1 · Cyclomatic Complexity
0 method(s) exceeded the cyclomatic complexity threshold of 15.
Do you agree with this assessment?
D2 · Cognitive Complexity
0 method(s) exceeded the cognitive complexity threshold of 15.
Do you agree with this assessment?
D3 · God Classes
0 god class(es) detected.
Do you agree with this assessment?
D6 · Cohesion (LCOM4)
0 of 5 classes have LCOM4 above 3.
Do you agree with this assessment?
D8 · Code Coverage
Line coverage 100.0%. Measured from the JavaScript/TypeScript suite (vitest + @vitest/coverage-v8 via `npm ci --ignore-scripts` in the repository root).
Do you agree with this assessment?
D9 · Test Distribution
58 test methods: 58 unit, 0 integration, 0 BDD, 0 e2e. The JavaScript/TypeScript suite contributes 58 `it`/`test` case(s) across 12 test file(s) declaring at least one; its tier split is read from package names and paths only.
Do you agree with this assessment?
D10 · Test Quality
0 skipped, 0 zero-assertion, no mocking-framework packages referenced (hand-written doubles or no mocking) across 58 tests.
Do you agree with this assessment?
D11 · Test Reliability
0 flaky across 1 measured tier(s). JavaScript/TypeScript (vitest via `npm ci --ignore-scripts` in the repository root (58 tests)): measured (0 flaky).
Do you agree with this assessment?
D13 · Secret Scanning
Secret scan ran and found no leaked secrets.
Do you agree with this assessment?
D15 · Churn × Complexity Hotspots
No churn × complexity hotspots in the window.
Do you agree with this assessment?
D17 · Explicit Debt
0 deducted task-comment markers across 431 LoC (0.0/KLoC) → score 10.0. Task comments only: this repository's language is read without a compiler, so D17's suppression, dead-code and commented-out-code arms did not run and this score counts fewer marker kinds than a .NET repository's would.
Do you agree with this assessment?
D19 · Documentation Quality
The repository's root README is clear and complete: it states what the toolkit is (a DDD domain-driven design toolkit with a command bus and result pattern), gives an installation line, lists features as checklists, and documents the project's status as under development. It also links to architecture/design docs in the changeset/README.md directory, which are not shown here but must exist by the outline. The .changeset/README is a separate deploy tier documenting that directory, so it does not conflict with the root README.
What to do
- Improve Documentation Quality — currently 7.0/10. — The repository's root README is clear and complete: it states what the toolkit is (a DDD domain-driven design toolkit with a command bus and result pattern), gives an installation line, lists features as checklists, and documents the project's status as under development. It also links to architecture/design docs in the changeset/README.md directory, which are not shown here but must exist by the outline. The .changeset/README is a separate deploy tier documenting that directory, so it does not conflict with the root README.
Do you agree with this assessment?
D21 · Naming Consistency
0 naming inconsistencies across 0 sampled symbols.
Do you agree with this assessment?
D26 · Project Cohesion
0 of 1 build units (npm) flagged as possibly oversized/incoherent.
Do you agree with this assessment?
D28 · Secrets (history)
gitleaks scanned the full history AND the current working tree and found no secrets.
Do you agree with this assessment?
D29 · Static Analysis (SAST)
5 finding(s): 0 critical, 4 high, 1 medium, 0 low. 3 unpinned-GitHub-Actions row(s) are reported here but scored by D36 (supply-chain provenance), which measures that posture as `pinned_actions` — one pinning decision is charged once, not once per lens.
REDACTED
REDACTED
REDACTED
What to do
- Resolve the 1 REDACTED finding(s) in Static Analysis (SAST) — start with REDACTED. — One of this dimension's main actionable groups (1 issue-level).
- Resolve the 1 REDACTED finding(s) in Static Analysis (SAST) — start with REDACTED. — One of this dimension's main actionable groups (1 warning-level).
- No action in Static Analysis (SAST) — all 3 REDACTED finding(s) are reported here at file:line but scored by D36 (supply-chain provenance), so none is charged to this dimension. — One of this dimension's main actionable groups (3 issue-level, 0 of them charged here).
Do you agree with this assessment?
D30 · Dependency Vulnerabilities
18 finding(s): 2 critical, 13 high, 2 medium, 1 low.
REDACTED
REDACTED
REDACTED
REDACTED
What to do
- Resolve the 13 High CVE finding(s) in Dependency Vulnerabilities — start with REDACTED (13). — One of this dimension's main actionable groups (13 issue-level).
- Resolve the 2 Critical CVE finding(s) in Dependency Vulnerabilities — start with REDACTED, REDACTED. — One of this dimension's main actionable groups (2 issue-level).
- Resolve the 2 Medium CVE finding(s) in Dependency Vulnerabilities — start with REDACTED (2). — One of this dimension's main actionable groups (2 warning-level).
Do you agree with this assessment?
D35 · Change Coupling
No strong hidden change-coupling between production files.
Do you agree with this assessment?
D43 · Malicious Dependencies
No dependency in any ecosystem this repository declares is published as malicious.
Do you agree with this assessment?
Frontend & cross-cutting dimensions
AX10 · Code composition
What to do
- The domain core is a small share of production code, but most of the rest matched no layer vocabulary at all — so this is not yet an anemic-domain finding. The namespace/path convention could not place that code, which makes the composition above a statement about the naming, not about the design. Name the layers (or check that the repository's conventions differ from the ones this check knows) before reading a thin domain into it.
Do you agree with this assessment?
AX3 · Project dependency cycles
Do you agree with this assessment?
AX4 · Dependency direction
Do you agree with this assessment?
AX5 · Architecture & structure
Do you agree with this assessment?
AX6 · Interface segregation
Do you agree with this assessment?
DM1 · Aggregate boundaries
Do you agree with this assessment?
DM11 · Constructible invalid state
Do you agree with this assessment?
DM5 · Encapsulated state
Do you agree with this assessment?
DM6 · Domain ↔ infrastructure boundary
Do you agree with this assessment?
DM9 · Scattered domain decisions
Do you agree with this assessment?
GD1 · Unfinished & placeholder code
Do you agree with this assessment?
IC1 · Incompleteness & stubs
Do you agree with this assessment?
M1 · Documentation (README)
What to do
- Explain in the README how to run the tests. Add a section called Testing to the README in the repository's top folder, saying how to run the test suite.
Do you agree with this assessment?
M2 · Architecture documentation
- No Architecture Decision Records found — no conventional ADR directory, no numbered `NNNN-title` documents in any markup this check reads, and nothing ADR-shaped by content. Design rationale recorded elsewhere (a design-notes tree, a mailing list, pull-request discussion) is not visible to this check and is not re-findable per decision, so a future maintainer cannot ask why one choice was made and get an answer.
- No C4/Structurizr/PlantUML/Mermaid/Graphviz/D2 diagram, no drawn diagram named for the architecture, no file named `architecture` or `design` in any markup this check reads, and nothing in the README, docs or contributor guides that announces the shape — no `## Architecture` heading, no "architecture overview"/"high-level design" phrasing, no "the architecture is …" introduction, no guided code tour. A shape laid out in prose that never names itself as the architecture is not visible to this check, and neither is one kept outside the repository, so this row reports the absence of a re-findable shape document — not evidence that nobody wrote the shape down.
What to do
- Record your significant design decisions. Write one short document per decision, giving its date, the situation, the decision and its consequences, and keep them together with your other design documents. A docs/adr folder with each file named by number and title is the easiest place to find them.
- Add a C4 context/container diagram (Structurizr, PlantUML or Mermaid) or an architecture.md overview.
Do you agree with this assessment?
M3 · Folder & project structure
Do you agree with this assessment?
M4 · Documentation accuracy
Do you agree with this assessment?
P1 · CI/CD gates
Do you agree with this assessment?
P10 · Library API & versioning
Do you agree with this assessment?
P3 · Security & performance tooling
- No static application security testing detected. For this repository's stack, add CodeQL's javascript-typescript pack, `semgrep --config=p/typescript`, or eslint-plugin-security as a CI step. What was searched, so you can tell an absence from a miss: the 597 CI workflow file(s) in this repository, and the scanner and linter configuration checked in beside them. A scan that runs outside CI, one configured in your forge's web UI rather than in a committed file, or a tool whose name is none of those this check carries, is not seen — if that is your case the row is wrong, and saying so is more useful than adding a second scanner.
What to do
- Add a SAST step to CI running what this repository's stack ships: CodeQL's javascript-typescript pack, `semgrep --config=p/typescript`, or eslint-plugin-security — so a security regression fails the build instead of landing.
- Enable Dependabot/Renovate or a dependency-review gate.
- Add gitleaks/trufflehog in CI to block PRs that introduce committed secrets.
Do you agree with this assessment?
P6 · Release Hygiene
Do you agree with this assessment?
PF3 · Async & latency hygiene
Do you agree with this assessment?
R1 · Type Safety
Do you agree with this assessment?
R10 · Code Duplication
- src/bus/middleware/CommandLoggerMiddleware.ts:11 · src/bus/middleware/QueryLoggerMiddleware.ts:11 — the 2 copies sit in sibling files in one directory, so check first whether one of them (or an existing module there) already owns this behaviour and the others should call it; otherwise extract it into one module in that directory and have each site call it. — src/bus/middleware/CommandLoggerMiddleware.ts:11
What to do
- Act on each finding's own remediation rather than one rule: the move depends on what recurs. Where the copies are executable blocks, give the shared part one home and call it from each site; where they are declarations, a listing, a specialisation already delegating to its base, or one shape repeated per entity, there is no call site and the move is a shared type, a generated set or a factory — sometimes there is nothing to extract.
Do you agree with this assessment?
R2 · Cyclomatic Complexity
Do you agree with this assessment?
R3 · Large Files
Do you agree with this assessment?
R4 · Test Coverage
Do you agree with this assessment?
R5 · Dependency Freshness
What to do
- Bump outdated dependencies to current versions to limit upgrade debt.
Do you agree with this assessment?
R6 · Tooling
Do you agree with this assessment?
R7 · Dead Code
- Unreachable from the 1 application, 1 tooling and 44 test entry point(s) detected in this repo. Gate removals on `npm run build` — an undetected custom entry would make these reachable.
- no import path from any entry point (1 application, 1 tooling, 44 test roots considered), and no other file in the scanned tree imports it — nothing in-repo names this module at all, which is the strongest form of this claim the import graph can make — src/bus/query/IResponse.ts
Do you agree with this assessment?
R8 · Dependency Hygiene
Do you agree with this assessment?
R9 · Circular Imports
Do you agree with this assessment?
X1 · Async correctness
Do you agree with this assessment?
X12 · Unreachable branch
Do you agree with this assessment?
X13 · Undrained process stream
Do you agree with this assessment?
X14 · Bypassable address classification
Do you agree with this assessment?
X15 · Unvalidated length from an untrusted reader
Do you agree with this assessment?
X16 · Unfloored truncation loop
Do you agree with this assessment?
X17 · Uncapped recursion over a caller-supplied document
Do you agree with this assessment?
X18 · Disposal-pattern correctness
Do you agree with this assessment?
X19 · Unrestored process-global state
Do you agree with this assessment?
X21 · Side-effecting pattern guard
Do you agree with this assessment?
X22 · Contradicted release guard
Do you agree with this assessment?
X23 · Unguarded diagnostic materialisation
Do you agree with this assessment?
X24 · Document value interpolated into markup unescaped
Do you agree with this assessment?
X25 · Inert configuration knob
Do you agree with this assessment?
X28 · Index access outside its own emptiness guard
Do you agree with this assessment?
X29 · Per-element action decided by a fixed element
Do you agree with this assessment?
X3 · Exception handling
Do you agree with this assessment?
X30 · Support guard that admits what it rejects
Do you agree with this assessment?
X5 · Nullable reference types
Do you agree with this assessment?
Reference — by lens
| Lens | Score | Rating | Impact |
|---|---|---|---|
| Code Health | 98% | Exemplary | Solid. |
| Architecture | 69% | Strong | Solid. |
| Maturity | 56% | Adequate — gated by M2 | Capped at Fair by a Critical contributor — resolve it before relying on this lens. |
| Readiness | 72% | Adequate — gated by P3 | Capped at Fair by a Critical contributor — resolve it before relying on this lens. |
| Security | 70% | Adequate — gated by D30 | Capped at Fair by a Critical contributor — resolve it before relying on this lens. |
| Domain Modelling | 100% | Exemplary | Strongest area. |
| Performance | 100% | Exemplary | Solid. |
Unscored — 2 check(s) recorded observations but carry no score
- D36 Supply-chain Provenance & Signing — 1 observation(s) recorded · The CI pipeline builds and tests but publishes no released artifact — no package publish, container push, GitHub release or deployment step. Supply-chain provenance, signing and SBOM attest RELEASED artifacts, so there is nothing to attest here. Add them to the release pipeline when this repo starts shipping artifacts (a published package, a container image, a deployed service or a tagged release). Build integrity and workflow-token hygiene are reported below: they describe what the CI runs and the token it runs with, neither of which is affected by whether the pipeline ships an artifact.
- P12 CI test-gate honesty — 2 observation(s) recorded · Reported, not scored — this card publishes what the CI gate does with the test inventory rather than grading it. The findings above are its output.
Not evidenced — 2 control(s) we could not find positive evidence for
- P4 Deployment & Rollback — not evidenced — no deploy/rollback/approval signal in the repo; absence of evidence is not evidence of a manual release
- P5 DR & Backup — not evidenced — repo shows no backup/RTO/RPO controls; absence of evidence is not evidence of a working control
Not included — 68 check(s) not relevant to this codebase
- AC1 Text alternatives — No web markup found — accessibility is not applicable to this repository.
- AC2 Forms & labels — No web markup found — accessibility is not applicable to this repository.
- AC3 Page structure — No web markup found — accessibility is not applicable to this repository.
- AC4 Keyboard semantics — No web markup found — accessibility is not applicable to this repository.
- AC5 ARIA correctness — No web markup found — accessibility is not applicable to this repository.
- AC6 Visual & motion safety — No web markup found — accessibility is not applicable to this repository.
- AC7 A11y enforcement — No web markup found — accessibility is not applicable to this repository.
- AX1 Captive dependencies — Not applicable: this repository's TypeScript imports no dependency-injection container and defines no container of its own — nothing that both registers and resolves bindings, and nothing that names two lifetimes — so nothing holds one lifetime's instance while handing out another's.
- AX2 Stateful singletons — Not applicable: TypeScript/JavaScript runs each process's requests on one event loop, so no two requests write a shared object at the same instant (interleaving across an await is a different defect).
- AX7 Slice cohesion — not applicable — not a vertical-slice architecture
- AX8 Test isolation — no test/production split to check
- AX9 CQS / query purity — no CQRS query handlers detected — query purity is not applicable to this codebase
- AXB1 Runtime evidence locked — no reproducible boot — This repository has nothing the runtime tiers could boot or serve — no markup, no UI framework or web-server dependency, no UI component source, no native UI project and no API definition — nothing here is a surface to boot — so runtime a11y/egress/header evidence has no subject here. Not applicable: this is neither a gap in the scan nor a finding about your code.
- AXB2 Runtime readiness — Advisory — this card reports evidence and never carries a score, so there is nothing missing here.
- C1 Data Protection — No personal data detected in a persisted data model — no PII-named field (email, firstName, dateOfBirth, phoneNumber, …) or stored credential on a TypeORM/MikroORM/sequelize-typescript/NestJS-Mongoose entity, a Mongoose schema, a Sequelize or Drizzle table, a Knex migration or a Prisma model — and no database or data-store client in the source either, so this repository keeps no data at rest for these controls to protect. If it does persist personal data (through a hosted backend configured outside this repository, for instance), the controls belong to wherever that data is stored.
- C2 Access Controls — No access-control surface detected in the analyzed source — this repository stands up no server (no Express, Fastify, Koa, Hono, NestJS or similar app, no Next.js/SvelteKit/Nuxt server route, no edge function), creates no Supabase tables and talks to no hosted backend. Access control is therefore N/A here — a browser application or library is authorized by the server it calls, not by itself; a client-side route guard hides a page and authorizes nothing. If this codebase grows request handlers, the dimension reactivates and a default-deny posture is expected then.
- C3 Audit Trail — No personal data detected in a persisted data model — no PII-named field (email, firstName, dateOfBirth, phoneNumber, …) or stored credential on a TypeORM/MikroORM/sequelize-typescript/NestJS-Mongoose entity, a Mongoose schema, a Sequelize or Drizzle table, a Knex migration or a Prisma model — and no database or data-store client in the source either, so this repository keeps no sensitive data whose changes an audit trail would record. If it does (through a hosted backend configured outside this repository, for instance), the trail belongs to wherever that data is stored.
- C4 Data Retention — No personal data detected in a persisted data model — no PII-named field (email, firstName, dateOfBirth, phoneNumber, …) or stored credential on a TypeORM/MikroORM/sequelize-typescript/NestJS-Mongoose entity, a Mongoose schema, a Sequelize or Drizzle table, a Knex migration or a Prisma model — and no database or data-store client in the source either, so this repository keeps no personal data whose lifetime a retention limit would bound. If it does (through a hosted backend configured outside this repository, for instance), the limit belongs wherever that data is stored.
- C5 Data-Subject Rights — No personal data detected in a persisted data model — no PII-named field (email, firstName, dateOfBirth, phoneNumber, …) or stored credential on a TypeORM/MikroORM/sequelize-typescript/NestJS-Mongoose entity, a Mongoose schema, a Sequelize or Drizzle table, a Knex migration or a Prisma model — and no database or data-store client in the source either, so this repository keeps no personal data for a data subject to erase, export or consent over. If it does (through a hosted backend configured outside this repository, for instance), the rights are served wherever that data is stored.
- D12 Dependency Hygiene — Dependency currency not established — this repository declares no production dependency to grade
- D14 License Compliance — Shipped build output's licences not graded — D14 does not read what a bundler inlines
- D16 Bus Factor — bus factor 1 — one contributor carries this repository
- D18 Solution Shape — D18 scores the shape of a .NET solution; this repository has no .NET solution or project files, so the dimension does not apply.
- D20 ADR Quality — N/A — ADRs are expected on deployable products with a user-facing host, not consumed libraries; no ADR log is required here.
- D22 Internal API Consistency — The exposed public-API surface could not be collected — no C#/VB projects loaded.
- D23 Boundary Type-Coupling — No bounded-context organisation was detected either — neither a context-shaped layout, nor 2+ sibling source directories each declaring an aggregate root, nor 2+ projects each declaring an entity of their own. Declaring this codebase's bounded contexts (≥2) would let cross-boundary type coupling be assessed. Declare them in `.codehealth/config.yaml` at the repository root (create it if absent), mapping each context name to the module-path or namespace prefixes that belong to it — e.g. `architecture:` → `contexts:` → `Billing: ["src/billing", "Acme.Billing"]`, `Catalog: ["src/catalog", "Acme.Catalog"]`.
- D24 Comment Value — No inline comments to assess — comment value is not applicable here.
- D25 ADR Conformance — no ADRs to check
- D27 Navigability — D27 counts a call into the standard library or a dependency as unresolved for this repository's language (.ts), so too few call sites counted as resolved to assess navigability. Not scored: this is a gap in the analyzer, not a verdict about this repository.
- D31 IaC & Container Security — No Infrastructure-as-Code or container manifests found (Dockerfile, Docker Compose, Terraform, Kubernetes/Helm, CloudFormation, ARM, Bicep, Ansible); nothing to scan.
- D32 Data Compliance (PII/GDPR) — No personal data was found crossing a boundary the PII/GDPR ruleset checks — nothing written to a log or console sink, placed in a URL or query string, or persisted to browser storage. That is a clean result for the LEAK surface only: this ruleset detects personal data escaping, it does not inventory the personal data a repository holds, so it is not evidence that this repository has no personal-data surface. The personal-data map (Appendix C) and the C1-C5 compliance cards are what speak to that.
- D34 Knowledge Freshness — every production source file is under the ~100-line size floor — too little code for knowledge freshness to be judged
- D37 Vulnerability-disclosure Policy — No vulnerability-disclosure policy file found (SECURITY.md/.markdown/.rst/.txt at root or under .github/.forgejo/.gitea/docs, .well-known/security.txt). A coordinated-disclosure policy may live off-repo, so this is not evidenced rather than failed.
- D39 IL Efficiency — D39 measures the IL emitted by a .NET build; this repository has no .NET solution or project files, so the dimension does not apply.
- D4 Code Duplication — This repository's production source (.ts) is not read by D4's token comparison, which compares .NET source: duplication in it is measured by R10 Code Duplication, the frontend lens's card running the same clone algorithm over the JS/TS token stream. Not scored here — read the R10 card for this repository's duplication.
- D40 Network Egress Confinement — No Kubernetes/orchestration workloads found in the repository manifests; network egress policy is a cluster-native control that may live at the platform/firewall layer, so there is nothing to assess here.
- D41 Kernel & Syscall Confinement — No Kubernetes/orchestration workloads found in the repository manifests; seccomp/AppArmor/SELinux confinement is a workload-level control, so there is nothing to assess here.
- D42 Runtime Threat Enforcement — No Kubernetes/orchestration workloads found in the repository manifests; runtime threat-detection and admission-control policy are cluster-level controls, so there is nothing to assess here.
- D44 Platform End-of-Life — Platform end-of-life not assessed — this repository declares no platform this pass reads
- D5 Coupling — Not applicable — this npm build ships 1 production module(s), so there is no coupling BETWEEN modules to measure. (Its test and non-production modules are not part of the shipped graph.)
- D7 Architectural Integrity — no checkable ADRs, and no project-reference graph for the cycle pass to read — so this dimension makes no claim about dependency cycles in either direction (where this repository's language has an import-cycle lens, cycles are reported there). Architectural integrity not assessed
- DM10 One transaction, one aggregate — no repository writes detected — no operation to judge against the one-aggregate rule
- DM2 Strongly-typed ids — no id-bearing domain types detected — strongly-typed-id adoption not assessable
- DM3 Integration-event coupling — no integration events detected — coupling check not applicable
- DM4 Rich vs anemic model — no data-bearing entities detected — rich-vs-anemic model not assessable
- DM7 Repository granularity — no repository abstraction detected (e.g. uses a document session)
- ED1 Event-Driven — not scored — this repository shows only 1 of the 3 signals this lens looks for (2 CQRS handler(s))
- ED5 Idempotency — 2 mutating command handler(s)/consumer(s) detected and 2 handler method(s) walked, but no persistent write was recognised in any of them — idempotency not assessed
- ES1 Event Sourcing — not scored — this repository shows none of the 3 signals this lens looks for
- P2 Observability — This repository's JavaScript/TypeScript source (1 module(s), 33 file(s) read) declares no entry point and bootstraps no server, and nothing here deploys a service — it is a library, run inside whatever hosts it, so production observability (structured logging, tracing/metrics, health checks) is N/A. If it grows a binary or a service, the dimension reactivates.
- P7 Outbound HTTP resilience — not applicable — no HTTP server, API framework or worker entry point was found in the JavaScript/TypeScript source, so there is no service whose uptime a failing dependency could take down
- P8 Schema migrations — no ORM, schema-migration tool or schema auto-create was found in this repository's dependency manifests or source, so there is no database schema for this check to judge
- P9 Domain vs controller coverage — coverage data present for 19 file(s), but no domain-layer files were identified: no covered file's path contains any of the markers this check keys on (/domain/, /aggregates/, /valueobjects/, /domainmodel/, .domain/, /entities/), which are matched case-insensitively anywhere in the path. With no domain partition there is nothing to compare the web/controller layer against — if this repository keeps its business rules under a folder named none of those, that naming is what the check cannot see, not the domain logic.
- PF1 Benchmark discipline — Not applicable: no benchmark suite was found. This check searched for tinybench, mitata, benchmark.js, benny or vitest `bench(...)` calls in files that import them (or `*.bench.*` files), or one of those in a REDACTED, and for a `*benchmark*` script that this repository's CI runs. Benchmarks are credited as a bonus, so their absence is neither scored nor deducted.
- PF2 Allocation hygiene — Not applicable: TypeScript/JavaScript runs on a garbage-collected runtime that gives a program no allocation-control idiom to choose on a hot path — no pools, stack allocation or value types — so allocation awareness is not something this code can be rated on.
- R11 Import Boundaries — No recognizable feature-sliced/layered src layout — boundary rules not applicable.
- S1 Web-Security Posture — Not assessed: 33 JavaScript/TypeScript file(s) were read for weak hashes and ciphers, key material fixed in the source, disabled TLS certificate validation and obsolete TLS versions, and none was found. That half of the dimension is clean, but it is not scored on its own: a C# repository with the same clean reading is scored on its server controls as well, or is N/A for having no web surface, and neither can be decided here. The server controls — HTTPS enforcement, HSTS, cookie flags, input validation — are NOT assessed for JavaScript/TypeScript: each is scored as an absence, an absence is only reportable over the production HTTP server, and in this ecosystem the file that opens the port is build output or a framework launcher rather than a file in the source tree. Their absence here is not a finding about this repository.
- SC1 Supply-chain hygiene — Advisory — this card reports evidence and never carries a score, so there is nothing missing here.
- X10 Duplicated predicate — Advisory — this card reports evidence and never carries a score, so there is nothing missing here.
- X2 Cancellation propagation — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X20 Mistyped argument guard — This check asks whether an argument guard reports an EMPTY value as a NULL one, which needs a language that throws a null-specific argument exception — .NET's ArgumentNullException, the JVM's NullPointerException, Dart's ArgumentError.notNull. This repository contains none of those languages: the ones it is written in have a single exception for a bad argument, so there is no pair of exceptions to confuse and nothing here for it to assess. Not a gap in the analyzer and not a finding about your code.
- X26 Unsynchronised callback handoff — Not applicable: this check looks for a collection written by a callback on one thread while the body waiting on it touches it on another, and in this repository's languages no collection is reachable from two threads at once. TypeScript/JavaScript runs every callback on the one thread that owns its objects: a callback runs only when the body waiting on it has yielded, never alongside it, and a worker thread receives a COPY of what it is sent. A SharedArrayBuffer carries raw bytes, never an Array, Map or Set, so no collection is reachable from two threads at once. Not a gap in the analyzer and not a finding about your code.
- X27 Collection changed while being enumerated — Not applicable: this check looks for a loop whose body adds to or removes from the very collection the loop is walking, invalidating the enumerator it holds, and in this repository's languages that cannot happen. JavaScript and TypeScript have no iterator that a change can invalidate: an `Array` is walked by index against its live length, and a `Map` or `Set` by the ECMAScript specification's live entry list, so a body that adds to, removes from or empties what it walks raises nothing — every loop form (`for…of`, `for…in`, `forEach`, `map`, `filter`, `reduce`, `entries()`) on every built-in collection (`Array`, `Map`, `Set`, plain objects, `URLSearchParams`, `Headers`, `FormData`) runs to completion. Such a loop can still skip an element or never end, which is a different defect and not the one this check asks about. Not a gap in the analyzer and not a finding about your code.
- X32 Type resolved by simple name across every loaded assembly — This check is about how a .NET program searches the assemblies loaded into its process for a type, and this repository contains no .NET source, so there is nothing here for it to assess. Not a gap in the analyzer and not a finding about your code.
- X4 Structured logging — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X6 Hand-rolled structured-format parsing — Advisory — this card reports evidence and never carries a score, so there is nothing missing here.
- X7 Silent fallback defaults — Advisory — this card reports evidence and never carries a score, so there is nothing missing here.
- X9 Subsumed condition operand — Advisory — this card reports evidence and never carries a score, so there is nothing missing here.
Appendix A — Findings (grouped)
Critical — 19 finding(s)
D30 · Dependency Vulnerabilities
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
D29 · Static Analysis (SAST)
- REDACTED
- REDACTED
- REDACTED
D30 · Dependency Vulnerabilities
- REDACTED
- REDACTED
D29 · Static Analysis (SAST)
- REDACTED
Serious — 9 finding(s)
D30 · Dependency Vulnerabilities
- REDACTED
- REDACTED
D16 · Bus Factor
- bus factor 1 — one contributor carries this repository
D29 · Static Analysis (SAST)
- REDACTED
D36 · Supply-chain Provenance & Signing
- REDACTED
P12 · CI test-gate honesty
- Coverage collected but not gated
P12 · CI test-gate honesty
- Test suite runs only after the merge
R10 · Code Duplication
- Duplicated block (6 lines × 2 locations) src/bus/middleware/CommandLoggerMiddleware.ts:11
R7 · Dead Code
- Dead file (~1 LoC) src/bus/query/IResponse.ts
Minor — 5 finding(s)
D30 · Dependency Vulnerabilities
- REDACTED
D36 · Supply-chain Provenance & Signing
- REDACTED
M2 · Architecture documentation
- No ADRs
M2 · Architecture documentation
- No architecture diagram/doc
P3 · Security & performance tooling
- No SAST
Minor — 1 finding(s)
D12 · Dependency Hygiene
- Dependency hygiene PARTLY measured — npm pinning read, dependency currency not (the committed lockfile resolved no direct production dependency)
Appendix B — Reproduction & audit trail
| Dimension | Tool | Version | Command | Findings | Raw output |
|---|---|---|---|---|---|
| D28 · Secrets (history) | gitleaks | — | gitleaks detect --no-banner --config /opt/gitleaks-rules/watchdog-gitleaks.toml --report-format json --report-path /tmp/watchdog-gitleaks-143ef600af414770a18e830cc705c514/history.json --exit-code 0 --source . | 0 | artifacts/raw/gitleaks-history.json |
| D28 · Secrets (history) | gitleaks | — | gitleaks detect --no-git --no-banner --config /opt/gitleaks-rules/watchdog-gitleaks.toml --report-format json --report-path /tmp/watchdog-gitleaks-143ef600af414770a18e830cc705c514/tree.json --exit-code 0 --source . | 0 | artifacts/raw/gitleaks-tree.json |
| D29 · Static Analysis (SAST) | semgrep | — | semgrep --config /opt/semgrep-rules/security-audit.yml --config /opt/semgrep-rules/owasp-top-ten.yml --config /opt/semgrep-rules/watchdog-sast.yml --json --quiet --timeout 10 --timeout-threshold 3 --metrics off . | 5 | artifacts/raw/semgrep.json |
| D30 · Dependency Vulnerabilities | trivy | — | trivy fs --scanners vuln --format json --quiet --severity CRITICAL,HIGH,MEDIUM,LOW --skip-dirs **/bin/** --skip-dirs **/obj/** . --skip-db-update | 18 | artifacts/raw/trivy-fs.json |
| D31 · IaC & Container Security | trivy | — | trivy: not applicable — No Infrastructure-as-Code or container manifests found (Dockerfile, Docker Compose, Terraform, Kubernetes/Helm, CloudFormation, ARM, Bicep, Ansible); nothing to scan. | 0 | — |
| D32 · Data Compliance (PII/GDPR) | semgrep | — | semgrep: not applicable — No personal data was found crossing a boundary the PII/GDPR ruleset checks — nothing written to a log or console sink, placed in a URL or query string, or persisted to browser storage. That is a clean result for the LEAK surface only: this ruleset detects personal data escaping, it does not inventory the personal data a repository holds, so it is not evidence that this repository has no personal-data surface. The personal-data map (Appendix C) and the C1-C5 compliance cards are what speak to that. | 0 | — |
| D37 · Vulnerability-disclosure Policy | disclosure | — | disclosure: not applicable — No vulnerability-disclosure policy file found (SECURITY.md/.markdown/.rst/.txt at root or under .github/.forgejo/.gitea/docs, .well-known/security.txt). A coordinated-disclosure policy may live off-repo, so this is not evidenced rather than failed. | 0 | — |
| D40 · Network Egress Confinement | runtime-hardening | — | runtime-hardening: not applicable — No Kubernetes/orchestration workloads found in the repository manifests; network egress policy is a cluster-native control that may live at the platform/firewall layer, so there is nothing to assess here. | 0 | — |
| D41 · Kernel & Syscall Confinement | runtime-hardening | — | runtime-hardening: not applicable — No Kubernetes/orchestration workloads found in the repository manifests; seccomp/AppArmor/SELinux confinement is a workload-level control, so there is nothing to assess here. | 0 | — |
| D42 · Runtime Threat Enforcement | runtime-hardening | — | runtime-hardening: not applicable — No Kubernetes/orchestration workloads found in the repository manifests; runtime threat-detection and admission-control policy are cluster-level controls, so there is nothing to assess here. | 0 | — |
| D43 · Malicious Dependencies | trivy | — | trivy fs --scanners vuln --format json --quiet --severity CRITICAL,HIGH,MEDIUM,LOW --skip-dirs **/bin/** --skip-dirs **/obj/** . --skip-db-update | 0 | artifacts/raw/trivy-fs.json |