SinaSys/flutter_Go_Rest_App

Each chip is a dimension scored from real signals across architecture, testing, dependencies, security & compliance, documentation, git-history and code quality — in one coherent pass. A surface report typically covers a handful.

These checks had nothing to measure here (no tests, no git history, the codebase is small, or the architecture style doesn't apply), so they're omitted above rather than scored low.

• AC1 Text alternatives — No image/media element found in the parsed markup — AC1 not applicable here.
• AC2 Forms & labels — No form control/button found in the parsed markup — AC2 not applicable here.
• AC3 Page structure — No structural check found in the parsed markup — AC3 not applicable here.
• AC4 Keyboard semantics — No interactive element found in the parsed markup — AC4 not applicable here.
• AC5 ARIA correctness — No ARIA usage found in the parsed markup — AC5 not applicable here.
• AC6 Visual & motion safety — No styled element found in the parsed markup — AC6 not applicable here.
• AX1 Captive dependencies — no DI registrations detected
• AX10 Code composition — not assessed — code composition is computed by ROLE over a document set that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
• AX2 Stateful singletons — no singleton implementations detected
• AX3 Project dependency cycles — not assessed — project cycles and dependency direction are computed over a project-reference graph that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
• AX4 Dependency direction — not applicable to a vertical-slice architecture (the inward-dependency rule is for layered/clean styles)
• AX6 Interface segregation — not assessed — interface segregation is computed over a type surface that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
• AX7 Slice cohesion — vertical-slice architecture detected, but individual slices could not be resolved from namespaces or project layout
• AX8 Test isolation — not assessed — test isolation is computed from a project graph (which projects are test projects, and what they reference) that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
• AXB2 Runtime readiness — Advisory — this card reports evidence and never carries a score, so there is nothing missing here.
• C1 Data Protection — Not assessed: these personal data controls are read from a source model (declarative annotations, request middleware, entity/column names, guard methods) that was not loaded for this repository — because the repository is written in a language this check does not yet model, or because its projects failed to load. Absence of an idiom this check recognises is NOT evidence that this repository lacks personal data controls: it may implement them entirely in its own ecosystem. This is a gap in the analyzer's language coverage, not a finding about this repository.
• C2 Access Controls — Not assessed: these authorization controls are read from a source model (declarative annotations, request middleware, entity/column names, guard methods) that was not loaded for this repository — because the repository is written in a language this check does not yet model, or because its projects failed to load. Absence of an idiom this check recognises is NOT evidence that this repository lacks authorization controls: it may implement them entirely in its own ecosystem. This is a gap in the analyzer's language coverage, not a finding about this repository.
• C3 Audit Trail — Not assessed: these audit controls are read from a source model (declarative annotations, request middleware, entity/column names, guard methods) that was not loaded for this repository — because the repository is written in a language this check does not yet model, or because its projects failed to load. Absence of an idiom this check recognises is NOT evidence that this repository lacks audit controls: it may implement them entirely in its own ecosystem. This is a gap in the analyzer's language coverage, not a finding about this repository.
• C4 Data Retention — Not assessed: these retention controls are read from a source model (declarative annotations, request middleware, entity/column names, guard methods) that was not loaded for this repository — because the repository is written in a language this check does not yet model, or because its projects failed to load. Absence of an idiom this check recognises is NOT evidence that this repository lacks retention controls: it may implement them entirely in its own ecosystem. This is a gap in the analyzer's language coverage, not a finding about this repository.
• C5 Data-Subject Rights — Not assessed: these data-subject rights controls are read from a source model (declarative annotations, request middleware, entity/column names, guard methods) that was not loaded for this repository — because the repository is written in a language this check does not yet model, or because its projects failed to load. Absence of an idiom this check recognises is NOT evidence that this repository lacks data-subject rights controls: it may implement them entirely in its own ecosystem. This is a gap in the analyzer's language coverage, not a finding about this repository.
• D1 Cyclomatic Complexity — Most of this repository's production source (.dart, .kt, .swift) had no cyclomatic complexity computed for it, so cyclomatic complexity was not measured — whatever else this pass did read is not this repository's complexity. Not scored: no method bodies were exposed for those file kinds by any language model this pass could load. This is a gap in the analysis run, not a finding about this repository.
• D10 Test Quality — ~2957 lines of test source are present (.dart) but the test-quality collector reads C# only, so skipped/assertion-free tests couldn't be counted. Not scored — this is a gap in the analyzer, not a finding about this repository.
• D11 Test Reliability — Test reliability not included
• D12 Dependency Hygiene — Dependency hygiene not measured — dependency manifest found but not parsed for hygiene
• D14 License Compliance — Not scored — this repository's package manifest is not parsed for licence data yet. A gap in the analyzer's language coverage, NOT a finding that the repository's licenses are compliant (a Gradle version catalogue and a Dart pubspec.yaml), which this pass does not parse yet — so this dimension asserts nothing about this repository's licensing in either direction.
• D15 Churn × Complexity Hotspots — complexity unreadable for .dart, .kt, .swift — churn × complexity hotspots could not be measured
• D16 Bus Factor — single-maintainer — knowledge-concentration (bus factor) risk
• D17 Explicit Debt — explicit-debt markers are read through a C# workspace today, so they were not read for this repository's language — this asserts nothing about how many markers the code carries. Not scored — this is a gap in the analyzer, not a finding about this repository
• D18 Solution Shape — D18 scores the shape of a .NET solution; this repository has no .NET solution or project files, so the dimension does not apply.
• D2 Cognitive Complexity — Most of this repository's production source (.dart, .kt, .swift) had no cognitive complexity computed for it, so cognitive complexity was not measured — whatever else this pass did read is not this repository's complexity. Not scored: no method bodies were exposed for those file kinds by any language model this pass could load. This is a gap in the analysis run, not a finding about this repository.
• D20 ADR Quality — N/A — ADRs are expected on deployable products with a user-facing host, not consumed libraries; no ADR log is required here.
• D22 Internal API Consistency — No exposed public API
• D23 Boundary Type-Coupling — Production source is present (.dart, .kt, .swift) but bounded contexts are resolved over the C#/VB project set, which exposed none, so context scope could not be assessed. Not scored — this is a gap in the analyzer, not a verdict about this repository. Declaring the codebase's bounded contexts (≥2) would let cross-boundary type coupling be assessed — see the recommendation on this dimension for where. Declare them in `.codehealth/config.yaml` at the repository root (create it if absent), mapping each context name to the module-path or namespace prefixes that belong to it — e.g. `architecture:` → `contexts:` → `Billing: ["src/billing", "Acme.Billing"]`, `Catalog: ["src/catalog", "Acme.Catalog"]`.
• D24 Comment Value — No inline comments to assess — comment value is not applicable here.
• D25 ADR Conformance — no ADRs to check
• D26 Project Cohesion — Project cohesion is assessed over the .NET project set; this target exposed no projects, so project size and spread could not be assessed. Not scored — this is a gap in the analyzer's reach, not a verdict about this repository.
• D27 Navigability — No calls could be sampled, so navigability was not assessed — tracing effort is measured over resolved call sites and this target exposed none. Not scored — this is a gap in the analyzer's reach, not a verdict about this repository.
• D3 God Classes — Most of this repository's production source (.dart, .kt, .swift) was not read by god-class detection, so class size was not assessed for the languages that are the product — whatever else this pass did read is not this repository's class size. Not scored — this is a gap in the analyzer, not a verdict about this repository.
• D30 Dependency Vulnerabilities — Not scored — no dependency manifest in a supported ecosystem was read for this repository. A gap in the analyzer's language coverage, NOT a finding that the repository is free of vulnerable dependencies (a Gradle version catalogue and a Dart pubspec.yaml — not scanned yet) — where an OSV-supported manifest exists, dependency vulnerabilities for this repository are reported under D38 instead.
• D31 IaC & Container Security — No Infrastructure-as-Code or container manifests found (Dockerfile, Terraform, Kubernetes/Helm, CloudFormation); nothing to scan.
• D32 Data Compliance (PII/GDPR) — No PII/GDPR-handling patterns detected (p/gdpr ruleset) — no data-compliance surface to assess.
• D33 JS/npm Dependency Vulnerabilities — No JS/npm manifest or lockfile found outside build output (package.json, package-lock.json, yarn.lock, pnpm-lock.yaml, bun.lockb); no JS dependencies to scan.
• D36 Supply-chain Provenance & Signing — No CI/build pipeline found (.github/.forgejo/.gitea workflows, .gitlab-ci.yml, azure-pipelines*.yml, .pipelines/, .vsts-ci/, Jenkinsfile, .circleci); there is no build to attest provenance for.
• D37 Vulnerability-disclosure Policy — No vulnerability-disclosure policy file found (SECURITY.md/.markdown/.rst/.txt at root or under .github/.forgejo/.gitea/docs, .well-known/security.txt). A coordinated-disclosure policy may live off-repo, so this is not evidenced rather than failed.
• D39 IL Efficiency — D39 measures the IL emitted by a .NET build; this repository has no .NET solution or project files, so the dimension does not apply.
• D40 Network Egress Confinement — No Kubernetes/orchestration workloads found in the repository manifests; network egress policy is a cluster-native control that may live at the platform/firewall layer, so there is nothing to assess here.
• D41 Kernel & Syscall Confinement — No Kubernetes/orchestration workloads found in the repository manifests; seccomp/AppArmor/SELinux confinement is a workload-level control, so there is nothing to assess here.
• D42 Runtime Threat Enforcement — No Kubernetes/orchestration workloads found in the repository manifests; runtime threat-detection and admission-control policy are cluster-level controls, so there is nothing to assess here.
• D5 Coupling — Inter-project coupling could not be assessed — no analyzable project graph was found for this repository. Not scored: a gap in the analyzer's reach, not a verdict about this repository. (Coupling here is Martin afferent/efferent/instability plus reference cycles across a project-reference graph, read today from .NET project files; other ecosystems' module graphs are not read yet.)
• D6 Cohesion (LCOM4) — Cohesion (LCOM4) is measured over a C#/VB class graph, and this repository's production source is .dart, .kt, .swift, which this pass does not read — so no class could be assessed. Not scored — this is a gap in the analyzer, not a finding about this repository.
• D7 Architectural Integrity — no checkable ADRs, and no project-reference graph for the cycle pass to read — so this dimension makes no claim about dependency cycles in either direction (where this repository's language has an import-cycle lens, cycles are reported there). Architectural integrity not assessed
• D9 Test Distribution — Test source is present (.dart) but the test-pyramid classifier reads C# only, so its unit/integration/BDD/E2E split couldn't be counted. Not scored — this is a gap in the analyzer, not a finding about this repository.
• DM1 Aggregate boundaries — not scored for Dart: aggregate-vs-value-object classification cannot be told apart in source (every class-holding-class reads alike), and a child COLLECTION (legitimate membership) vs a single embedded aggregate is indistinguishable — reported as guidance rather than measured
• DM2 Strongly-typed ids — no in-repo typed-id idiom — primitive-obsession recorded as advisory DM8, DM2 not gated
• DM3 Integration-event coupling — not scored for Dart: a cross-package domain leak cannot be told apart in source from a legitimate shared-kernel package, and most repositories ship a single package — reported as guidance rather than measured
• DM7 Repository granularity — not scored for Dart: 'a repository per CHILD entity' needs the aggregate-root structure, which is not source-resolvable — reported as guidance rather than measured
• ED2 Event/command shape — not scored — deciding whether a command has more than one competing handler requires resolving the call graph, and this analysis resolves a call's owner only where the receiver's type is written down in the source. Reported as guidance rather than measured
• ED2 Event/command shape — not scored — deciding whether a command has more than one competing handler requires resolving the call graph, which this analysis does not build from source alone for this language. Reported as guidance rather than measured
• ED5 Idempotency — no mutating command handlers or message consumers detected — idempotency check not applicable
• ES1 Event Sourcing — not scored — this repository shows none of the 3 signals this check looks for
• GD1 Unfinished & placeholder code — no source files
• IC1 Incompleteness & stubs — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
• P12 CI test-gate honesty — no CI workflow found
• P2 Observability — Observability was not assessed: this check reads a source model that does not carry this repository's product — because the repository is written in a language this check does not yet model, or because its projects failed to load. Absence of a logging idiom this check recognises is NOT evidence that this repo lacks structured logging (it may log through its own ecosystem's logger). This is a gap in the analyzer, not a finding about this repository.
• P4 Deployment & Rollback — not evidenced — no deploy/rollback/approval signal in the repo; absence of evidence is not evidence of a manual release
• P5 DR & Backup — not evidenced — repo shows no backup/RTO/RPO controls; absence of evidence is not evidence of a working control
• P6 Release Hygiene — not evidenced — no changelog, version stamp or semver release tag in the repo
• P7 Outbound HTTP resilience — not measured — the application kind could not be determined for this repo
• P8 Schema migrations — not assessed — schema-migration practice is read from a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
• P9 Domain vs controller coverage — no coverage report found on disk — produce a coverage report in a standard format (lcov — `flutter test --coverage` (or `dart test --coverage=coverage` then `dart run coverage:format_coverage --lcov`)) into the repo working tree before the scan — a CI step is the usual place, since the artefact is commonly gitignored, or wire coverage collection into CI, to enable this cross-layer check
• PF1 Benchmark discipline — Performance was not assessed: this lens reads a source model that was not loaded for this repository, because the repository is written in a language this lens does not yet model or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository — in particular it is NOT a statement that this repo is unpackaged or performance-careless.
• PF2 Allocation hygiene — Performance was not assessed: this lens reads a source model that was not loaded for this repository, because the repository is written in a language this lens does not yet model or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository — in particular it is NOT a statement that this repo is unpackaged or performance-careless.
• PF3 Async & latency hygiene — Performance was not assessed: this lens reads a source model that was not loaded for this repository, because the repository is written in a language this lens does not yet model or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository — in particular it is NOT a statement that this repo is unpackaged or performance-careless.
• S1 Web-Security Posture — Not assessed: these web-security controls are read from a source model (declarative annotations, request middleware, entity/column names, guard methods) that was not loaded for this repository — because the repository is written in a language this check does not yet model, or because its projects failed to load. Absence of an idiom this check recognises is NOT evidence that this repository lacks web-security controls: it may implement them entirely in its own ecosystem. This is a gap in the analyzer's language coverage, not a finding about this repository.
• X1 Async correctness — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
• X2 Cancellation propagation — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
• X3 Exception handling — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
• X4 Structured logging — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
• X5 Nullable reference types — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository