VahidFarahmandian/Jinget

What it measures: How tangled the control flow is — methods with many branches are hard to test and change.

Method: Cyclomatic complexity per method (1 + decision points), computed exhaustively across production source; test projects separated by convention. Deterministic.

Maturity: Documented → Verified → Prevented · effective 8.8 / 10 · rule-coverage 100% · ceiling Prevented

7 method(s) exceeded the cyclomatic complexity threshold of 15; the worst was Where.Recurse at 29. A further 2 method(s) were over the threshold but excluded as flat dispatchers (a long switch/match over independent cases: many branches, almost no nesting), the largest being Where.NodeTypeToString at 20 — they are counted neither in the figure above nor in this dimension's score.

+ 2 more group(s) — more in Appendix A; the complete list is findings.md.

What to do

1. Resolve the 1 Where.Recurse (cyclomatic 29) finding(s) in Cyclomatic Complexity — start with Where.cs. — One of this dimension's main actionable groups (1 warning-level).
2. Resolve the 1 INamedTypeSymbolExtensions.IsSimpleType (cyclomatic 22) finding(s) in Cyclomatic Complexity — start with INamedTypeSymbolExtensions.cs. — One of this dimension's main actionable groups (1 warning-level).
3. Resolve the 1 ExpressionUtility.TryParseExpression (cyclomatic 20) finding(s) in Cyclomatic Complexity — start with ExpressionUtility.cs. — One of this dimension's main actionable groups (1 warning-level).
4. Enforce Cyclomatic Complexity in CI to reach Verified (currently Documented). — Hardens enforcement from Documented toward Prevented — provenance only; does not change the score.

Detailed fixes: d1_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: How hard the code is for a person to follow, beyond raw branching.

Method: Cognitive complexity per method (Sonar-style nesting-penalized score), computed exhaustively over production code, excluding test projects. Deterministic.

Maturity: Documented → Verified → Prevented · effective 7.1 / 10 · rule-coverage 100% · ceiling Prevented

18 method(s) exceeded the cognitive complexity threshold of 15; the worst was ObjectExtensions.ToType at 58.

+ 13 more group(s) — more in Appendix A; the complete list is findings.md.

What to do

1. Resolve the 1 ObjectExtensions.ToType (cognitive 58) finding(s) in Cognitive Complexity — start with ObjectExtensions.cs. — One of this dimension's main actionable groups (1 warning-level).
2. Resolve the 1 Where.Recurse (cognitive 56) finding(s) in Cognitive Complexity — start with Where.cs. — One of this dimension's main actionable groups (1 warning-level).
3. Resolve the 1 IPUtility.IsIPInRange (cognitive 40) finding(s) in Cognitive Complexity — start with IPUtility.cs. — One of this dimension's main actionable groups (1 warning-level).
4. Enforce Cognitive Complexity in CI to reach Verified (currently Documented). — Hardens enforcement from Documented toward Prevented — provenance only; does not change the score.

Detailed fixes: d2_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: Over-large classes that try to do too much ("god classes").

Method: God-class detection by line and method-count thresholds per logical type (partial classes unified), filtered for generated code and registration/contract false positives. Deterministic.

Maturity: Documented → Verified → Prevented · effective 9.3 / 10 · rule-coverage 100% · ceiling Prevented

2 god class(es) detected.

✓ On the Gold path — maintain.

Detailed fixes: d3_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: Copy-pasted code that should be shared instead.

Method: Code duplication via token-stream sliding windows with type-aware normalization (locals masked, type names preserved), density-scored per KLoC of production code. Deterministic.

Maturity: Documented → Verified → Prevented · effective 9.9 / 10 · rule-coverage 100% · ceiling Verified

3 duplicated block group(s) detected.

✓ On the Gold path — maintain.

Detailed fixes: d4_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: Whether volatile projects sit underneath others that depend on them (so their churn ripples upward), and whether project dependencies form cycles. A widely-depended-on but stable shared/kernel project is healthy, not penalised.

Method: Dependency cycles via elementary-DFS over real .csproj references, plus Martin instability (afferent/efferent) per project. Exhaustive over the reference graph, deterministic.

Coverage: Exhaustive · type-level: afferent/efferent coupling + cycles computed over every production type — the population is all types, not a name convention.

Maturity: Documented → Verified → Prevented · effective 9.3 / 10 · rule-coverage 100% · ceiling Prevented

12 projects, 0 dependency cycle(s), 0 unstable depended-on project(s).

✓ On the Gold path — maintain.

Detailed fixes: d5_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: Whether a class's methods are focused on a single responsibility.

Method: LCOM4 cohesion per production class with at least two methods: connected components of methods sharing state or calls, computed syntactically. Deterministic, not a proxy.

Coverage: Exhaustive · type-level: LCOM4 cohesion computed over every production class — the population is all types, not a name convention.

Maturity: Documented → Verified → Prevented · effective 10.0 / 10 · rule-coverage 100% · ceiling Verified

0 of 21 classes have LCOM4 above 3.

✓ On the Gold path — maintain.

Detailed fixes: d6_recommendation.md.

What it measures: How much of the code is actually exercised by tests.

Method: Coverage from coverlet runs or committed reports (Cobertura/OpenCover/lcov), computed per-file with structured exclusions for generated, trivial, and glue code. When the suite can't be built/run in-image AND no report is committed, coverage is reported NOT-MEASURED (excluded from the score) with the precondition to make it measurable — never a LoC-ratio proxy folded in as if measured. Deterministic.

Maturity: Documented → Verified → Prevented · effective 2.6 / 10 · rule-coverage 100% · ceiling Verified

Line coverage 3.5% — 67 file(s) below 50% · 73 method(s) over the CRAP-30 risk line.

+ 1 more group(s) — more in Appendix A; the complete list is findings.md.

What to do

1. Resolve the 67 Low coverage finding(s) in Code Coverage — start with JingetServiceHandler.cs, JingetServiceHandlerBase.cs, BindingBuilder.cs. — One of this dimension's main actionable groups (67 warning-level).
2. Resolve the 2 CRAP 420 finding(s) in Code Coverage — start with Where.cs, ExpressionUtility.cs. — One of this dimension's main actionable groups (2 warning-level).
3. Resolve the 2 CRAP 306 finding(s) in Code Coverage — start with ObjectExtensions.cs, ExpressionUtility.cs. — One of this dimension's main actionable groups (2 warning-level).
4. Enforce Code Coverage in CI to reach Verified (currently Documented). — Hardens enforcement from Documented toward Verified — provenance only; does not change the score.

Detailed fixes: d8_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: Whether the test suite has a healthy mix of unit / integration / end-to-end tests.

Method: Test projects classified (Unit/Integration/BDD/E2E) from compiled metadata; test methods counted exhaustively across projects with placement-agnostic disk fallback. Deterministic.

Maturity: Documented → Verified → Prevented · effective 10.0 / 10 · rule-coverage 100% · ceiling Documented

427 test methods: 427 unit, 0 integration, 0 BDD, 0 e2e.

✓ On the Gold path — maintain.

Detailed fixes: d9_recommendation.md.

What it measures: Whether the tests truly assert behaviour rather than just running the code.

Method: Per-test assertions, skips, and mock references analyzed via Roslyn; structured skip-reason tags (BUG:/ENV:) separate documented deferrals from debt. Deterministic.

Maturity: Documented → Verified → Prevented · effective 10.0 / 10 · rule-coverage 100% · ceiling Prevented

0 skipped, 0 zero-assertion, 2 mock references across 427 tests.

✓ On the Gold path — maintain.

Detailed fixes: d10_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: Whether the tests pass reliably, with no flakiness.

Method: Suite re-run N times within tiered wall-clock budgets (unit to e2e); tests failing non-deterministically across runs flagged; guarded tests retried when #if guards detected.

Maturity: Documented → Verified → Prevented · effective 10.0 / 10 · rule-coverage 100% · ceiling Verified

0 flaky across 1 measured tier(s). unit: measured (0 flaky).

✓ On the Gold path — maintain.

Detailed fixes: d11_recommendation.md.

What it measures: Whether dependencies are current, secure, and not bloated.

Method: Manifest scan via dotnet list package across all projects; worst-signal-per-package deduction (saturating for vulnerabilities, capped-linear for deprecation/outdated) per KLoC. Exhaustive, deterministic.

Maturity: Documented → Verified → Prevented · effective 7.1 / 10 · rule-coverage 100% · ceiling Verified

21 outdated, 0 vulnerable, 4 deprecated packages.

What to do

1. Resolve the 4 Deprecated finding(s) in Dependency Hygiene. — One of this dimension's main actionable groups (4 warning-level).
2. Enforce Dependency Hygiene in CI to reach Verified (currently Documented). — Hardens enforcement from Documented toward Verified — provenance only; does not change the score.

Detailed fixes: d12_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: Whether any secrets (keys, tokens, passwords) have leaked into the code.

Method: In-process native secret scanner (entropy plus signature patterns) across all tracked files; no external tool. A clean result is a measured 10, not no-data zero. Deterministic.

Maturity: Documented → Verified → Prevented · effective 10.0 / 10 · rule-coverage 100% · ceiling Prevented

Secret scan ran and found no leaked secrets.

✓ On the Gold path — maintain.

Detailed fixes: d13_recommendation.md.

What it measures: Whether the licenses of third-party packages are compatible with your policy.

Method: Third-party package licenses resolved from declared package metadata and checked against the configured policy (allow/deny/copyleft). Deterministic; clean = no incompatible license found at metadata depth.

Maturity: Documented → Verified → Prevented · effective 10.0 / 10 · rule-coverage 100% · ceiling Verified

0 of 25 packages use a banned license.

✓ On the Gold path — maintain.

Detailed fixes: d14_recommendation.md.

What it measures: Files that change often and are also complex — the riskiest hotspots.

Method: Per production file churn times cyclomatic complexity over a rolling window, computed from git and Roslyn/JS/Razor analysis. Exhaustive, deterministic per commit date.

Maturity: Documented → Verified → Prevented · effective 10.0 / 10 · rule-coverage 100% · ceiling Documented

No churn × complexity hotspots in the window.

✓ On the Gold path — maintain.

Detailed fixes: d15_recommendation.md.

What it measures: Whether knowledge is concentrated in too few people (the "bus factor").

Method: Living knowledge per author via time-decayed commit attribution (6-month half-life, focus weighting) across largest source files. Deterministic, avoids blame's mechanical-refactor false positives.

Maturity: Documented → Verified → Prevented · effective 7.7 / 10 · rule-coverage 100% · ceiling Documented

17 source file(s) have their living knowledge concentrated in one author (≥90% of recent, decayed contribution). The largest is 01-Core/Jinget.Core/Utilities/BindingBuilder.cs.

What to do

1. Resolve the 1 Off-boarding risk finding(s) in Bus Factor. — One of this dimension's main actionable groups (1 recommendation-level).

Detailed fixes: d16_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: Acknowledged debt left in the code — TODOs, dead code, suppressed warnings.

Method: Roslyn syntactic debt markers (suppressions/TODO/FIXME/HACK/empty-catch/commented-code/Obsolete) plus SymbolFinder dead-code analysis; weighted-debt-per-KLoC density deducted 2.0x per unit. Deterministic, exhaustive.

Maturity: Documented → Verified → Prevented · effective 5.2 / 10 · rule-coverage 100% · ceiling Prevented

52 deducted debt markers + 2 dead symbols across 12924 LoC (2.4/KLoC) → score 5.2.

+ 2 more group(s) — more in Appendix A; the complete list is findings.md.

What to do

1. Resolve the 21 NoWarnInCsproj finding(s) in Explicit Debt — start with Jinget.Logger.csproj (3), Jinget.ExceptionHandler.csproj (3), Jinget.Handlers.ExternalServiceHandlers.csproj (3). — One of this dimension's main actionable groups (21 issue-level).
2. Resolve the 3 EmptyCatchBlock finding(s) in Explicit Debt — start with BooleanExpressionExtensions.cs, SyntaxNodeExtensions.cs, ReadModelGenerator.cs. — One of this dimension's main actionable groups (3 issue-level).
3. Resolve the 13 BarePragmaDisable finding(s) in Explicit Debt — start with TypeSourceSelector.cs, Where.cs, AssemblyExtensions.cs. — One of this dimension's main actionable groups (13 warning-level).
4. Enforce Explicit Debt in CI to reach Verified (currently Documented). — Hardens enforcement from Documented toward Prevented — provenance only; does not change the score.

Detailed fixes: d17_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: Whether the solution is laid out in a sensible, conventional structure.

Method: Solution structure: project count, decomposition, shell-project detection, build success (confirmed failures cap the score); traced to actual .sln files and binaries. Deterministic.

Maturity: Documented → Verified → Prevented · effective 10.0 / 10 · rule-coverage 100% · ceiling Documented

12 projects, 333 source files, 19703 hand-written lines of code (12924 production / 6779 test), 15 inter-project edges.

✓ On the Gold path — maintain.

Detailed fixes: d18_recommendation.md.

What it measures: Whether names — types, methods, variables — are clear and consistent.

Method: Judged by language model at low temperature (0.0-0.1) on a deterministic random symbol sample (fixed size, not exhaustive), with disclosed confidence band. Advisory, sampled.

Maturity: Documented → Verified → Prevented · effective Strong / 10 · rule-coverage 100% · ceiling Verified

3 naming inconsistencies across 200 sampled symbols.

What to do

1. Resolve the 1 The class `PascalCaseNamingPolicy` implements a method `ConvertName`.… finding(s) in Naming Consistency. — One of this dimension's main actionable groups (1 recommendation-level).
2. Resolve the 1 Inconsistent naming for reflection helpers finding(s) in Naming Consistency. — One of this dimension's main actionable groups (1 recommendation-level).
3. Resolve the 1 Test method names use 'ReturnsTrue' and 'ReturnsFalse' which is… finding(s) in Naming Consistency. — One of this dimension's main actionable groups (1 recommendation-level).

Detailed fixes: d21_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: Whether comments are worth it — explaining WHY (valuable) rather than WHAT (redundant).

Method: Judged by language model at low temperature (0.0-0.1) on deterministically sampled inline comments with surrounding code; findings verified back to sampled comments by substring match. Advisory, sampled.

Maturity: Documented → Verified → Prevented · effective Exemplary / 10 · rule-coverage 100% · ceiling Documented

42 valuable / 1 redundant across 200 sampled comments; 1 shown with locations.

✓ On the Gold path — maintain.

Detailed fixes: d24_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: Whether each project is a focused, coherent unit rather than an oversized grab-bag.

Method: Project size overshoot penalties (LoC / public-type count / namespace count, 2-of-3 flag) weighted by log magnitude. Exhaustive across projects, deterministic, LLM-independent.

Maturity: Documented → Verified → Prevented · effective 8.3 / 10 · rule-coverage 100% · ceiling Documented

1 of 12 projects flagged as possibly oversized/incoherent.

What to do

1. Resolve the 1 Split Jinget.Core finding(s) in Project Cohesion. — One of this dimension's main actionable groups (1 recommendation-level).

Detailed fixes: d26_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: How far you must trace to follow a call — low indirection and co-located slices read easier.

Method: Call indirection (interface hops, cross-namespace calls, slice-locality scaled) over a sampled set of method invocations, size-aware baseline. Sampled; confidence discounted by symbol-resolution gaps.

Coverage: Slice locality from the first namespace segments, SAMPLED (≤400 methods) — not exhaustive.

Maturity: Documented → Verified → Prevented · effective 9.8 / 10 · rule-coverage 100% · ceiling Documented

99 % of calls cross a namespace and 2 % go through an interface, but 100 % of collaborators are co-located — so a call's collaborators sit together and tracing stays easy. Baseline: medium — clean/modular boundaries expected.

✓ On the Gold path — maintain.

Detailed fixes: d27_recommendation.md.

What it measures: Whether any secrets were ever committed — scanned across the full git history, not just now.

Method: Git-history secret scan via gitleaks detect over full history in an isolated checkout; each match flagged High. Exhaustive; degrades cleanly when tool absent.

Maturity: Documented → Verified → Prevented · effective 10.0 / 10 · rule-coverage 100% · ceiling Documented

gitleaks scanned the full history AND the current working tree and found no secrets.

✓ On the Gold path — maintain.

Detailed fixes: d28_recommendation.md.

What it measures: Real static-analysis (SAST) findings — likely security bugs in the code, any language.

Method: Polyglot static analysis via semgrep across the repo using the pinned, image-baked p/security-audit + p/owasp-top-ten rulesets (no scan-time registry fetch); severity rules (ERROR/WARNING/INFO) map to a full-band severity-weighted score. Exhaustive, deterministic; degrades on parse failure.

Coverage: semgrep pattern rules over all files — exhaustive for the rule set, blind to classes of bug without a rule (clean = no rule matched).

Maturity: Documented → Verified → Prevented · effective 3.5 / 10 · rule-coverage 100% · ceiling Documented

6 finding(s): 0 critical, 6 high, 0 medium, 0 low.

What to do

1. Resolve the 6 High finding(s) in Static Analysis (SAST) — start with build-ci.yml (2), release-ci.yml (2), release-preview-ci.yml (2). — One of this dimension's main actionable groups (6 issue-level).

Detailed fixes: d29_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: Whether any dependencies have known published vulnerabilities (CVEs), direct or transitive.

Method: NuGet CVE scan via dotnet list package --vulnerable including transitive; severity tally (Critical/High/Medium/Low) to 0-10 tight normalizer. Exhaustive, deterministic; degrades when absent.

Maturity: Documented → Verified → Prevented · effective 8.8 / 10 · rule-coverage 100% · ceiling Documented

2 vulnerable package(s): 0 critical, 2 high, 0 medium, 0 low.

What to do

1. Resolve the 2 High CVE finding(s) in Dependency Vulnerabilities. — One of this dimension's main actionable groups (2 issue-level).

Detailed fixes: d30_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: Whether anyone still has living knowledge of each file, or it has been orphaned — last understood long ago by someone now gone quiet. The sibling of the bus factor: D16 asks who owns it, D34 asks whether anyone still knows it.

Method: File orphaning as total living-knowledge decay below one focused-commit's worth within a year, computed per-file from the D16 decay model. Exhaustive, deterministic over fixed history.

Maturity: Documented → Verified → Prevented · effective 5.7 / 10 · rule-coverage 100% · ceiling Documented

31 of 72 significant source file(s) are orphaned — their living knowledge has decayed to nothing, so no one currently understands them. The largest is 01-Core/Jinget.Core.DiScanner/ServiceCollectionExtensions.Decoration.cs.

What to do

1. Resolve the 1 Further orphaned files (smaller) finding(s) in Knowledge Freshness. — One of this dimension's main actionable groups (1 recommendation-level).

Detailed fixes: d34_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: Whether files that change together actually belong together — pairs that repeatedly co-change in git history despite having no explicit code dependency, surfacing the hidden/logical coupling (and boundaries in the wrong place) a static scan can't see.

Method: Pairwise co-occurrence over the per-commit file sets in git history (production source only — tests and generated dropped): Degree-of-Coupling = shared ÷ min individual revisions, reported above noise floors (each file ≥10 revisions, ≥5 shared commits, ≥50% strength); sweeping commits excluded. Deterministic over fixed history.

Coverage: Population: PRODUCTION source files only — test and generated files are dropped before pairing, so a class co-changing with its own test (trivially ~100%) can't drown the real production↔production coupling. Pairs ranked by Degree-of-Coupling; coupling through a build step, config, or non-source file isn't seen.

Maturity: Documented → Verified → Prevented · effective 9.9 / 10 · rule-coverage 100% · ceiling Documented

Strongest change-coupling: IHostBuilderExtensions.cs↔BatchingLoggerProvider.cs 50%

✓ On the Gold path — maintain.

Detailed fixes: d35_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: Whether the build pipeline provides supply-chain integrity — generated provenance/attestation, signed artifacts (cosign/sigstore), an SBOM, and pinned build actions. Presence of the configuration, not a runtime guarantee.

Method: Supply-chain provenance/signing read deterministically from CI/build config (.github/workflows, .gitlab-ci.yml, azure-pipelines, Jenkinsfile, .circleci) + the release surface: four signals — generated provenance/attestation (SLSA/in-toto/actions-attest), artifact signing (cosign/sigstore/gitsign), an SBOM (syft/sbom-action/*.spdx.json/*.cdx.json), and SHA-pinned build actions — scored 10·present/denom. NotApplicable without a build pipeline. Detects configuration presence, not runtime enforcement.

Maturity: Documented → Verified → Prevented · effective 0.0 / 10 · rule-coverage 100% · ceiling Documented

0/4 supply-chain integrity signals present (provenance, signing, SBOM, pinned actions).

+ 1 more group(s) — more in Appendix A; the complete list is findings.md.

What to do

1. Resolve the 1 Unpinned build actions finding(s) in Supply-chain Provenance & Signing. — One of this dimension's main actionable groups (1 warning-level).
2. Resolve the 1 Workflow token permissions not restricted finding(s) in Supply-chain Provenance & Signing. — One of this dimension's main actionable groups (1 warning-level).
3. Resolve the 1 Secret passed as a command-line argument finding(s) in Supply-chain Provenance & Signing. — One of this dimension's main actionable groups (1 warning-level).

Detailed fixes: d36_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: Whether the repository publishes a coordinated-vulnerability-disclosure policy (SECURITY.md or security.txt) with a reporting contact, so finders know how to report a vulnerability. Presence of a policy file with a contact, not whether the policy is adequate or honoured.

Method: Vulnerability-disclosure policy read deterministically from the repo: a SECURITY.md (root/.github/docs) or .well-known/security.txt / security.txt, regex-checked for a reporting contact (email / URL / mailto). Present + contact → 10; present without a contact → 4; NotApplicable when no policy file exists (it may live off-repo). Detects the policy file's presence + contact, not its adequacy.

Maturity: Documented → Verified → Prevented · effective 10.0 / 10 · rule-coverage 100% · ceiling Documented

A vulnerability-disclosure policy (SECURITY.md) is published with a reporting contact.

✓ On the Gold path — maintain.

Detailed fixes: d37_recommendation.md.

Method: IL instruction count per method, read from the BUILT first-party assemblies via Mono.Cecil (the target is compiled on a deep run); scored on the fraction of methods whose emitted IL body exceeds the size threshold. Sees compiler-generated bloat source can't; not-applicable when the target fails to build. Deterministic.

Maturity: Documented → Verified → Prevented · effective 9.9 / 10 · rule-coverage 100% · ceiling Verified

4 of 866 first-party methods have an oversized IL body.

✓ On the Gold path — maintain.

Detailed fixes: d39_recommendation.md · top locations in Appendix A, every location in findings.md.

Other · Architecture — Whether any singleton service captures a scoped/transient dependency — a silent lifetime/threading bug.

Method: Roslyn scan: DI registrations parsed from AddSingleton/Scoped/Transient; each singleton checked for captured shorter-lifetime dependencies. Exhaustive, deterministic.

Other · Architecture — How the codebase splits by code ROLE — domain, application, infrastructure, test, generated. The significance map behind the knowledge/coupling weighting, and a DDD signal in its own right: a thin domain core under fat infrastructure is the anemic-domain smell, quantified.

Method: Roslyn line-count by code ROLE: every source file classified Domain/Application/Infrastructure/Test/Generated by namespace + path convention (the shared CodeRoleClassifier), then significant lines summed per role. Deterministic; the advisory score is the business-logic (domain+application) share of production code.

Coverage: Population: ALL source files, each bucketed into ONE of five roles (Domain/Application/Infrastructure/Test/Generated) by namespace + path convention — a file whose layer isn't named in the convention falls to Application (the neutral default), and the split is line-count, not semantic depth or business value.

What to do

• The domain core is a small share of production code — check that business logic isn't leaking into the application/infrastructure layers (a thin domain is the anemic-domain smell).

Other · Architecture — Whether singleton services avoid mutable shared instance state that concurrent callers would race on.

Method: Roslyn scan: singleton field mutations unguarded by lock or Interlocked, per type; syntax-based guard detection. Deterministic, traceable per field.

Other · Architecture — Whether the project-reference graph is acyclic (cycles block independent build/deploy and signal eroding boundaries).

Method: Project reference cycles via elementary-DFS over real .csproj references, using the engine shared with D5/D7; cyclic versus acyclic. Exhaustive, deterministic.

Other · Architecture — Whether the codebase has a recognisable, scale-appropriate structure (a named architectural style, or modular enough for its size) rather than being an ad-hoc ball of mud.

Method: Roslyn plus csproj analysis: architecture style detection (DDD, clean, vertical-slice, CQRS) and structure fitness for repo size. Deterministic.

Other · Architecture — Whether interfaces stay focused rather than fat — the Interface-Segregation principle (SOLID 'I').

Method: Roslyn scan: public interface member counts; fat-interface threshold (over 15 members) flagged per type. Deterministic, type-level.

• `IImplementationTypeFilter` declares 22 members. A wide interface forces every implementer and caller to depend on methods they don't use (the Interface-Segregation 'I' in SOLID). Split it into focused role-interfaces. — IImplementationTypeFilter.cs:3

What to do

• Split fat interfaces into focused role-interfaces so clients depend only on what they use.

Other · Architecture — Whether production projects stay free of references to test projects — tests may depend on production, never the reverse.

Method: Csproj graph: each production project checked for references to test projects (identified by test-framework presence, not name). Zero violations is clean. Deterministic.

Other · Security — Whether access is authorized by default — a framework authorization attribute/decorator or policy, or imperative guard methods (throw-on-violation) called from handlers.

Method: Roslyn scan: [Authorize] usage and authorization policies, plus imperative throw-on-violation guard methods detected via syntax. Deterministic.

• Authorization IS enforced here (via [Authorize]/guards) — this is NOT a claim that endpoints are unprotected. What's missing is NAMED policies (AddAuthorization/AddPolicy, RequireRole/RequireClaim, RequireAuthorization): the access rules are implicit rather than named and testable. Recommendation, not a defect — name the rules so they're reviewable.

What to do

• Add policy-based authorization — name the access rules (AddAuthorization(o => o.AddPolicy(…))) and apply them via [Authorize(Policy = …)] or RequireAuthorization.

Other · Code Health — Unreviewed-generation residue: shipped members still throwing NotImplementedException, and placeholder string literals left in non-test, non-generated code. Scored as a quality signature, never as a claim about authorship.

Method: Roslyn syntax scan: NotImplementedException throws and placeholder string literals in non-test, non-generated shipped code. Deterministic, code-shape signature.

• A shipped member still throws NotImplementedException — generated scaffolding that was never completed. Implement it or remove the dead surface. — Select.cs:85

What to do

• Finish or delete NotImplementedException stubs and replace placeholder literals before shipping.

Other · Code Health — Unfinished work detected by code SHAPE, not keywords: members that only throw a "not implemented" exception, methods that take inputs and return a constant, async methods that never await, dead `if (false)` / `#if false` branches, and skeleton types most of whose members are holes. A real, objective slice of technical debt.

Method: Roslyn syntax scan: incompleteness by code shape (constant-returning methods, async-never-await, #if false branches, skeleton types), not keyword-gated. Deterministic, code-shape heuristic.

• A line of code has been commented out rather than removed — dead weight that rots and confuses. Delete it (version control remembers). (×13) — SyntaxNodeExtensions.cs:41, ReadModelGenerator.cs:174, ReadModelGenerator.cs:305, …

What to do

• Clear the softer debt: remove commented-out code and dead branches, re-enable or delete skipped tests, and replace blanket warning suppressions with targeted ones.

Maturity · Maturity — Whether the repo and its projects have a README, and whether it's substantive and current.

Method: Filesystem scan: README presence, word count, and headings for depth; git history for staleness. Exhaustive across root and project dirs, deterministic.

What to do

• Add a 'Testing' section to the root README — how to run the test suite.
• Add an 'Architecture' / 'How it works' section to the root README — the high-level shape.
• Add a README to the 6 of 12 project(s) that lack one — worth up to 1 pts.

Maturity · Maturity — Whether key decisions (ADRs) and the high-level shape (C4/diagrams) are written down.

Method: Filesystem scan: ADR folder/naming conventions or content, plus Mermaid/PlantUML/C4/architecture.md discovery. Exhaustive, deterministic.

• No Architecture Decision Records found — decisions aren't captured for future maintainers.
• No C4/PlantUML/Mermaid diagram or architecture.md — the high-level shape isn't documented.

What to do

• Start an ADR log (docs/adr/) recording significant decisions and their rationale.
• Add a C4 context/container diagram (Structurizr, PlantUML or Mermaid) or an architecture.md overview.

Maturity · Maturity — Whether the repo is organised deliberately — src/test separation and consistent project naming.

Method: Filesystem scan: src/test folder separation and namespace-prefix consistency (majority RootNamespace agreement). Exhaustive across projects, deterministic.

• Production code isn't grouped under a src/ folder — it's spread across several top-level directories, so there's no one place that says 'this is the product'.

What to do

• Group production code under src/ (or split deliberately, e.g. backend/ + frontend/) so production and tooling code aren't mixed at the root.

Maturity · Maturity — Whether the README actually describes the code that exists (LLM-judged, advisory).

Method: Judged by language model at low temperature: README accuracy versus actual projects, within a disclosed tolerance. Advisory, not a measured number.

Readiness · Readiness — Whether an automated pipeline builds and tests every change.

Method: Filesystem scan: CI workflow files (.github/workflows, .gitlab-ci.yml, etc.) for build and test stages. Exhaustive, deterministic.

Readiness · Readiness — Whether the code is diagnosable in production — structured logging, tracing/metrics, health checks.

Method: Filesystem/Roslyn scan: structured-logging frameworks (Serilog, NLog), OpenTelemetry, and health-check endpoint patterns. Exhaustive, deterministic.

• Only 2/6 service-like projects use logging (pure contract/DTO projects are excluded — they have nothing to log).

What to do

• Extend structured logging to the remaining service-like projects so the whole executable surface is diagnosable in production.
• Consider OpenTelemetry tracing/metrics and a health-check endpoint for operability.

Readiness · Readiness — Whether SAST, secret/dependency scanning and performance benchmarking are wired in (presence, not runtime).

Method: Filesystem scan: SAST configuration, dependency-update automation, secret scanning, and a benchmark harness or benchmark step — in this repository's own ecosystem. Exhaustive, deterministic.

• No static application security testing detected. For this repository's stack, add CodeQL's csharp pack (it analyses VB.NET too), or a security analyzer package (or `semgrep --config=auto`, which runs on any language) as a CI step.

What to do

• Add a SAST step to CI running what this repository's stack ships: CodeQL's csharp pack (it analyses VB.NET too), or a security analyzer package — or `semgrep --config=auto`, which runs on any language — so a security regression fails the build instead of landing.
• Enable Dependabot/Renovate or a dependency-review gate.
• Add gitleaks/trufflehog in CI to block PRs that introduce committed secrets.

Readiness · Readiness — Whether outbound HTTP calls are wrapped in resilience (retry/timeout/circuit-breaker) so a failing dependency doesn't cascade.

Method: Roslyn scan: Polly resilience markers (Retry, CircuitBreaker, Timeout) on outbound HTTP invocations. Computed per type, deterministic.

• The app makes outbound HTTP calls but no resilience handler was detected (Polly / AddStandardResilienceHandler / circuit-breaker). A slow or failing dependency will cascade — add timeouts, retries with back-off, and a circuit breaker.

What to do

• Add `AddStandardResilienceHandler()` (or Polly policies) to your HttpClient registrations so a flaky dependency can't take the app down.

Other · Security — Transport security, security headers, secure cookies, input validation, middleware order and crypto hygiene (presence, not runtime).

Method: Roslyn plus filesystem scan: HSTS/security headers, secure cookies, input validation, middleware order, weak crypto (MD5/SHA1/DES); HTTPS-metadata context-aware. Deterministic.

• No Content-Security-Policy / X-Frame-Options / X-Content-Type-Options configuration found — defense in depth, even when a reverse proxy could set them. (−2.0 on this card.)
• No UseHttpsRedirection/UseHsts and no reverse-proxy signal — transport security is unverified at the app layer. (−2.0 on this card.)

What to do

• Add security response headers (Content-Security-Policy, X-Frame-Options, X-Content-Type-Options) — defense in depth, even when a reverse proxy could set them.
• Enforce HTTPS at the app layer (UseHttpsRedirection / UseHsts) — only skip this if a reverse proxy demonstrably terminates TLS.

Other · Code Health — Whether the code avoids sync-over-async (deadlock-prone blocking on tasks) and async void.

Method: Roslyn syntax scan: async methods scanned for .Wait()/.GetAwaiter().GetResult() and async-void outside event handlers. Deterministic, hard fact per invocation.

Other · Code Health — Whether async methods accept a CancellationToken so work can be cancelled (adoption curve).

Method: Roslyn scan: every async method (excluding framework-fixed overrides/Blazor handlers) checked for CancellationToken parameter presence. Deterministic, adoption percentage.

• Only 27/52 async methods accept a CancellationToken, so in-flight work can't be stopped early when the caller gives up — whatever ends it in your host (shutdown signal, timeout, abandoned request, user cancel). Thread a token through the call chain and honour it at each await and loop; where a method genuinely cannot be interrupted, omitting it is a deliberate choice — judge against your hosting model.
• No CancellationToken parameter — this work can't be stopped early once started. (×22) — DbConnectionExtensions.cs:13, DbConnectionExtensions.cs:77, DbConnectionExtensions.cs:108, …
• No CancellationToken parameter — the body observes an ambient token instead (a field or a context object), so the work does stop on cancellation, but a caller cannot cancel this call independently of the owner that created that token. (×3) — ZipUtility.cs:14, ZipUtility.cs:148, BatchingLoggerProvider.cs:69

What to do

• Thread a CancellationToken through async methods so work stops promptly on cancellation.

Other · Code Health — Whether exceptions are handled rather than silently swallowed or rethrown with lost stack traces.

Method: Roslyn syntax scan: every catch clause counted; empty catches and bare rethrows flagged. Population is all catch clauses, not estimated. Deterministic, hard fact.

• An empty catch block silently discards the error — failures vanish with no log and no rethrow. Log it, handle it, or don't catch it. (×3) — BooleanExpressionExtensions.cs:267, ReadModelGenerator.cs:400, SyntaxNodeExtensions.cs:211

What to do

• Swallowed exception (empty catch)

Other · Code Health — Whether log calls use message templates (queryable) rather than interpolated strings.

Method: Roslyn syntax scan: every log call-site counted; interpolated-string first-argument violations flagged. Population is all log calls, not estimated. Deterministic.

Other · Code Health — Whether nullable reference types are enabled and not undermined by heavy `!` suppression.

Method: Roslyn compiler-options scan: NullableContextOptions per project; null-forgiving (!) suppression density per 1k syntax nodes. Deterministic, adoption plus suppression penalty.

• ~0.3 `!` suppressions per 1k syntax nodes — each one tells the compiler to trust you about null, suppressing the very safety NRTs provide.

What to do

• Enable <Nullable>enable</Nullable> across all projects and resolve warnings rather than suppressing with `!`.