aofdev/fiber-versioning-boilerplate

Executive summary

aofdev/fiber-versioning-boilerplate scores 56 out of 100, but it is rated At risk while a critical security finding is open; the score itself is unchanged. Watchdog judged it as a template, sample or demo, meant to be read or copied, so the dimensions about building, releasing and running a product don't apply, and its lenses are rated against a lower bar. The score itself is worked out as for any repository.

The weakest lens counts most in the score, and here that is Production Readiness, which scores 42 and is rated Adequate. Its Test Distribution dimension scores 0 out of 10, and until that reaches 4, Production Readiness can't be rated higher than Adequate. The first actions are to resolve the 1 No tests found finding(s) in Test Distribution and to resolve the 2 Leaked secret finding(s) in REDACTED Scanning, and if Production Readiness rose to 70, the score would rise from 56 to about 67.

15 findings are critical: seven in Dependency Vulnerabilities, four in Static Analysis (SAST), two in REDACTED Scanning, one in IaC & Container Security and one in Secrets (history).

Watchdog couldn't measure 28 dimensions in this code, among them Dependency Hygiene, Internal API Consistency and Navigability, so they are left out of the score. The product code is 633 lines.

A lens is capped at Adequate while one of its dimensions scores below 4 out of 10, however well the rest of the lens does. That way a serious problem in one place always shows in the lens's rating.

Top priorities

The three actions that raise the score most for the work they take. The full ranked list is in the Roadmap.

Diagnosis: what the measurements show together

Each conclusion below combines several dimensions into one point that no single dimension shows, and lists the measurements it rests on.

Architecture: which parts of the code depend on which

The code is divided into modules, groups of code that each handle one part of the product, and a module depends on another when it uses code from it. The table lists the modules both down the side and across the top, in an order where each module should only use modules listed above it. A number in a cell means the module on that row uses the module in that column, and it counts the pairs of building blocks (types) that connect them. The one thing to look for is a mark above the diagonal line. It means two or more modules use each other in a loop (a dependency cycle), so none of them can be changed, tested or released on its own.

At a glance — Code Health · 98% · Exemplary ·

At a glance — Architecture · 69% · Strong ·

At a glance — Maturity · 59% · Adequate · gated by M2 ·

At a glance — Readiness · 42% · Adequate · gated by D9, D13 ·

At a glance — Security · 86% · Adequate · gated by D30 ·

Security & Compliance — OWASP Top-10 mapping

Findings mapped to OWASP categories; the specific CVEs/secrets are in the Security dimension cards below and findings.md (redacted only on the public version of this report).

Roadmap

Begin by resolving the single missing test in Test Distribution and the two leaked secrets in REDACTED and REDACTED. Next, enable dependency scanning tools like Dependabot or Renovate to automate security updates. Finally, document significant design decisions in a dedicated folder and complete the truncated README to ensure full project clarity.

Ranked by impact ÷ effort. "Helps" is the estimated gain on the 0–100 health score.

File quality

Per-file score 0–10 — a quality signature. Of 11 files carrying findings, judged against the Template bar: 9% slop · 36% mixed · 55% near-clean.

How the grades work

Every finding carries one of four grades. Three say how serious it is. The fourth says this survey could not settle it — and it is a grade, not a gap.

Methodology & how to trust this report

Watchdog is a deep, periodic assessment — run each sprint, monthly, or quarterly, taking the time to go wider and deeper than a quick check and surfacing in one coherent report what you'd otherwise piece together from a dozen separate tools. It scores deterministically: the same commit yields the same score, every run. 34 of 37 evaluated dimensions are computed purely by tools and static analysis (confidence 1.0); 3 documentation/naming judgement(s) are LLM-assisted and labelled advisory. Overall confidence is 0.8 — the weighted average across measured dimensions; it falls as more of the score leans on LLM-assisted judgement and rises when it's fully tool-backed.

Every figure here is one of three kinds, and we label which: ✓ Measured — a deterministic fact (LoC, complexity, coverage); ~ Modeled — an estimate from a stated model (cost, effort, value-at-risk), always a range with its assumptions, never a precise fact; ◐ Advisory — an LLM prose judgement. We never present a modelled estimate as if it were measured. Perfect or absent scores carry their provenance too (ADR-0011): ✓ Tool-verified means the property itself was measured across the surface; ○ Nothing flagged means the probes came back clean — a claim bounded by what a repository can show; ⊘ Not evidenced means a working control (a tested restore, an automated rollback) showed no positive evidence — absence of evidence is not evidence of a control, so it's excluded from the score rather than awarded a spurious 10; ◐ Sampled · advisory marks an LLM verdict over a bounded sample — advisory, never a deterministic measurement.

Tools & methods

The actual versions used this run (captured at analysis time) — re-run on the same commit for the identical score.

Every finding is locatable in findings.md. Run 01a16059-7d6b-7d08-837d-7af94408a3fd.

The exact command behind every deep-scan dimension — tool, version, invocation and retained raw output — is in Appendix B — Reproduction & audit trail.

Run transparency — what happened this run

What ran differently this time — a tool absent, degraded, or that fell back to an estimate. Named openly, not folded silently into the scores. A degraded run also records its exact cause in diagnostics.md.

• D12 Dependency Hygiene — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. Not scored — 0 direct Go requirement(s) out of 62 in 1 REDACTED were read for PINNING discipline and checksum coverage (0 defect(s) reported), but the outdated/deprecated signal needs the Go module proxy, which had no direct requirement to be asked about, so this dimension's own question is only partly answered. NOT a finding that these dependencies are current or healthy.
• D15 Churn × Complexity Hotspots — measured, with a gap in what it reached — This is a true statement about the repository that carries nothing for its owner to act on, so it is reported here rather than as a defect in their code. Git history depth insufficient — this repository has 13 commit(s), too few for a reliable trend signal. The clone is complete, so there is no deeper history to fetch: the signal returns as the project accumulates history.
• D16 Bus Factor — not measured this run — This is a true statement about the repository that carries nothing for its owner to act on, so it is reported here rather than as a defect in their code. Single-contributor repository — bus factor is not applicable (1 contributor(s) across 13 commit(s) sampled, automation and bot accounts excluded). Concentration needs a team to concentrate: with one contributor there is nobody to spread the knowledge to, so there is nothing here for the owner to act on.
• D22 Internal API Consistency — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. D22 identifies the intentionally-exposed surface from `IsPackable` and `.Contracts` project names, MSBuild conventions read off the loaded project set. This target exposed no such projects, so the probe never ran; this says nothing about whether the repository has a public API. This repository commits no C#/VB source at all, so there was never an MSBuild project set to read these conventions off. That is OUR side and it is a COLLECTOR gap, not an environment fault: it declares a published package (REDACTED), but no published-package marker D22 reads admitted any project here, so this ecosystem's public API has no collector, and the remedy is to write one — no change to the scan image can close it.
• D27 Navigability — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. Navigability is taken over call sites whose callee resolved. For C# that population includes calls into referenced assemblies; for this language only calls declared inside the repository count, so the abstention threshold reads the repository's use of its standard library as a resolution failure. That is a limit of this analyzer, not a build problem in this repository.
• D34 Knowledge Freshness — not measured this run — This is a true statement about the repository that carries nothing for its owner to act on, so it is reported here rather than as a defect in their code. Too few commits to judge knowledge freshness (13 commit(s) sampled).
• D35 Change Coupling — measured, with a gap in what it reached — This is a true statement about the repository that carries nothing for its owner to act on, so it is reported here rather than as a defect in their code. Git history depth insufficient — this repository has 13 commit(s), too few for a reliable change-coupling signal. The clone is complete, so there is no deeper history to fetch: the signal returns as the project accumulates history.
• AX6 Interface segregation — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check is computed over the public interfaces this run's compilations declare, and none was loaded, so it had nothing to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
• AXR1 Runtime accessibility — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. Render strategy: boot via DockerCompose (REDACTED). compose up failed (exit 18 — an image could not be pulled) — mongo Pulling mongo Error Get "https://registry-1.docker.io/v2/": Forbidden Error response from daemon: Get "https://registry-1.docker.io/v2/": Forbidden; the earlier `compose pull` step reported: fvb_server Skipped - No image to be pulled mongo Pulling mongo Error Get "https://registry-1.docker.io/v2/": Forbidden Error response from daemon: Get "https://registry-1.docker.io/v2/": Forbidden; the runtime sandbox reaches registries only through the in-fence pull-through mirror, so an image the mirror does not carry cannot be fetched — this is a limit of our sandbox, not of your stack; runtime evidence skipped.
• C1 Data Protection — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. These personal data controls are read from declarative annotations, request middleware, entity/column names and guard methods in a C# source model, and none was loaded on this run, so there was nothing to gather. That is a gap in this analyzer's language reach — not a finding that the repository lacks personal data controls.
• C2 Access Controls — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. These authorization controls are read from declarative annotations, request middleware, entity/column names and guard methods in a C# source model, and none was loaded on this run, so there was nothing to gather. That is a gap in this analyzer's language reach — not a finding that the repository lacks authorization controls.
• C3 Audit Trail — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. These audit controls are read from declarative annotations, request middleware, entity/column names and guard methods in a C# source model, and none was loaded on this run, so there was nothing to gather. That is a gap in this analyzer's language reach — not a finding that the repository lacks audit controls.
• C4 Data Retention — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. These retention controls are read from declarative annotations, request middleware, entity/column names and guard methods in a C# source model, and none was loaded on this run, so there was nothing to gather. That is a gap in this analyzer's language reach — not a finding that the repository lacks retention controls.
• C5 Data-Subject Rights — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. These data-subject rights controls are read from declarative annotations, request middleware, entity/column names and guard methods in a C# source model, and none was loaded on this run, so there was nothing to gather. That is a gap in this analyzer's language reach — not a finding that the repository lacks data-subject rights controls.
• GD1 Unfinished & placeholder code — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, F#, JavaScript/TypeScript, Dart, Ruby and Scala source only, and no C#, F#, JavaScript/TypeScript, Dart, Ruby or Scala was found, and this repository's Go is not read yet, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
• IC1 Incompleteness & stubs — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, JavaScript/TypeScript, Java, Dart, Ruby and Scala source only, and no C#, JavaScript/TypeScript, Java, Dart, Ruby or Scala was found, and this repository's Go is not read yet, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
• S1 Web-Security Posture — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. These web-security controls are read from declarative annotations, request middleware, entity/column names and guard methods in a C# source model, and none was loaded on this run, so there was nothing to gather. That is a gap in this analyzer's language reach — not a finding that the repository lacks web-security controls.
• X1 Async correctness — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript, Python, Dart, Ruby, Scala, Rust and Kotlin source only, and no C# was loaded and no JavaScript/TypeScript, Python, Dart, Ruby, Scala, Rust or Kotlin was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
• X12 Unreachable branch — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript, Python, Dart, Ruby, Scala and Kotlin source only, and no C# was loaded and no JavaScript/TypeScript, Python, Dart, Ruby, Scala or Kotlin was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
• X13 Undrained process stream — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript, Python, Dart, Ruby, Scala and Kotlin source only, and no C# was loaded and no JavaScript/TypeScript, Python, Dart, Ruby, Scala or Kotlin was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
• X16 Unfloored truncation loop — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript, Java, PHP, Dart, Ruby, Scala and Kotlin source only, and no C# was loaded and no JavaScript/TypeScript, Java, PHP, Dart, Ruby, Scala or Kotlin was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
• X17 Uncapped recursion over a caller-supplied document — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript, Python, Dart, Ruby, Scala and Kotlin source only, and no C# was loaded and no JavaScript/TypeScript, Python, Dart, Ruby, Scala or Kotlin was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
• X18 Disposal-pattern correctness — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript, Java, Kotlin, Dart, Ruby, Scala and PHP source only, and no C# was loaded and no JavaScript/TypeScript, Java, Kotlin, Dart, Ruby, Scala or PHP was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
• X19 Unrestored process-global state — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript, Java, Kotlin, Python, Dart, Ruby, Scala and PHP source only, and no C# was loaded and no JavaScript/TypeScript, Java, Kotlin, Python, Dart, Ruby, Scala or PHP was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
• X2 Cancellation propagation — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript, Go, PHP, Dart, Kotlin, Ruby, Scala, Java, Python and Rust source only, and no C# was loaded, and no named async function in this repository's JavaScript/TypeScript, nor any Go, PHP or Dart function or Kotlin suspend function, makes a request that can be cancelled (fetch, axios, ky, ofetch; net/http, net.Dial; amphp; Dio; Ktor, OkHttp), so there is nothing to judge, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
• X22 Contradicted release guard — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and Java, TypeScript/JavaScript, Python, Dart, Ruby, Scala, Kotlin and PHP source only, and no C# was loaded, and this repository's Go is not read yet, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
• X23 Unguarded diagnostic materialisation — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript, Java, F#, Python, Dart, Ruby, Scala, Kotlin and PHP source only, and no C# was loaded and no JavaScript/TypeScript, Java, F#, Python, Dart, Ruby, Scala, Kotlin or PHP was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
• X24 Document value interpolated into markup unescaped — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript, Java, Scala, Ruby and Python source only, and no C# was loaded and no JavaScript/TypeScript, Java, Scala, Ruby or Python was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
• X25 Inert configuration knob — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript, Java, Kotlin, Scala, PHP, Erlang, Python, Dart and Ruby source only, and no C# was loaded and no JavaScript/TypeScript, Java, Kotlin, Scala, PHP, Erlang, Python, Dart or Ruby was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
• X27 Collection changed while being enumerated — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and Java, Rust, Erlang, F#, Python, Dart, Ruby, Scala and Kotlin source only, and no C# was loaded, no Java, Rust, Erlang, F#, Python, Dart, Ruby, Scala or Kotlin was found, and this repository's Go is not read yet, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
• X29 Per-element action decided by a fixed element — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript, Java, Rust, Dart, Ruby, Scala and Kotlin source only, and no C# was loaded and no JavaScript/TypeScript, Java, Rust, Dart, Ruby, Scala or Kotlin was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
• X4 Structured logging — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript, Java, Kotlin, Python, PHP, Dart, Ruby, Scala and Rust source only, and no C# was loaded and no JavaScript/TypeScript, Java, Kotlin, Python, PHP, Dart, Ruby, Scala or Rust was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.

Repo exclusion declarations (.gitattributes linguist-generated/vendored, .editorconfig generated_code): none declared — every source file was scored.

Limitations & what we did not check

Watchdog assesses the repository exactly as committed, and only the repository. By design it does not reach outside the source tree: the live cloud account, the running CI/CD pipeline, the host's branch-protection and approval rules, the production configuration, or a restore actually exercised against a backup are all out of scope. That boundary is a feature, not a gap — a repo-relative, deterministic scan re-runs identically on any commit and every finding opens at a real file and line, where a live audit can neither be reproduced nor traced. The visible consequence is that controls which leave no in-repo evidence are reported as "not evidenced" and excluded from the score rather than awarded a number a static scan cannot justify.

Per-dimension blind spots

For each dimension that was measured, what a static, repo-only scan structurally cannot see — the honest edge of the measurement, not a failure of it.

• D1 Cyclomatic Complexity: Cyclomatic complexity counts branches statically — it cannot tell an essential decision tree from accidental tangle, nor see complexity that lives in data or configuration (large switch-case token tables, DSL lexers/parsers, data-as-code rule tables) rather than control flow: a tokenizer's many single-character cases read as high complexity though each branch is trivial.
• D2 Cognitive Complexity: Cognitive-complexity heuristics approximate how hard code is to follow; genuine domain difficulty and well-named intent that eases reading are not captured.
• D3 God Classes: "God class" is sized by members and responsibilities visible in the type — a deliberately broad facade over a coherent subsystem can read the same as an accidental grab-bag. For front-end JS the file-length check is cohesion-aware (a single-responsibility module — one class/IIFE — earns a 3× threshold), but cohesion is approximated from top-level declarations, not true dependency structure.
• D4 Code Duplication: Duplication is token-similarity — an in-process token-stream comparison over sliding windows, with type-aware normalization — so it finds copy-paste, not semantic duplication expressed differently. Committed machine-written code (scaffolded migrations, designer/codegen output, protobuf/OpenAPI stubs, model snapshots) is EXCLUDED — its repetition is the tool's, not the team's — so the score reflects hand-written duplication only.
• D6 Cohesion (LCOM4): LCOM4 cohesion is syntactic — it infers connectivity from which methods touch which fields/methods by name, not from real runtime behaviour or intent.
• D9 Test Distribution: The test-pyramid shape is inferred from project/folder naming and references, with a single test host bucketed per-file by its path tier and content signals — a suite that names tiers unconventionally and gives no per-file signal can still be mis-bucketed.
• D13 REDACTED Scanning: REDACTED detection is signature- and entropy-based on the current tree — a secret that does not match a known pattern, or one already rotated, will not be flagged (a clean scan is "nothing matched", not "no secrets exist").
• D14 License Compliance: License compatibility is checked against declared package metadata and a policy — mislabelled or missing license metadata, and obligations that depend on how you distribute, are not resolved here.
• D15 Churn × Complexity Hotspots: Churn hotspots come from git history — a freshly imported or squashed repository has no churn signal, and recent rewrites can mask a historically risky file.
• D17 Explicit Debt: Acknowledged-debt signals (TODO/FIXME, suppressions, dead code) are textual — undocumented debt that nobody marked, and debt that lives in design rather than annotations, is invisible. Committed machine-written code (scaffolded migrations, designer/codegen output, generated stubs) is excluded — it is never the team's dead code to delete.
• D19 Documentation Quality: Documentation quality is judged by an LLM over a bounded sample of docs — it reads what is written, not whether the docs match the running system, and it is advisory, not a measurement. Its critique rows are drawn from a closed category vocabulary and each row means the same thing in every run, so two scans can be compared row by row; the SET that fires is still a sample, and does not repeat exactly. Measured on one frozen input, six scans at one engine SHA: 2-5 critique rows per scan, 8 distinct rows across the six, 3 of those 8 seen in only one scan. So a D19 row is evidence about the documentation, but a COUNT of D19 rows is not a quantity — never read a change in it as an improvement or a regression.
• D21 Naming Consistency: Naming quality is an LLM judgement over a bounded sample — it assesses clarity/consistency of the names it sees, not domain-correctness, and is advisory.
• D26 Project Cohesion: Project focus is sized from members/namespaces per project — a project that is broad by deliberate design reads the same as one that has sprawled.
• D28 Secrets (history): Secret-history scanning sweeps the git log for known patterns — a secret that predates the available history, or never matched a signature, is not found (clean means "nothing matched in the history we can see").
• D29 Static Analysis (SAST): SAST findings are pattern-based (semgrep) — it finds classes of bug it has rules for; logic flaws, auth/authorization gaps and issues needing runtime context are out of reach (and clean means "no rule matched").
• D30 Dependency Vulnerabilities: CVE matching depends on accurate package/version metadata and on the advisory databases — a vulnerability with no published advisory, or in code not declared as a dependency, is not seen. Coverage needs a RESOLVED graph: an unpinned requirements.txt, or a pom without a resolved build, yields partial coverage rather than a clean verdict. An ecosystem the analyzer cannot scan is reported as unmeasured, never as clean.
• D31 IaC & Container Security: IaC scanning checks Dockerfiles/Terraform/Kubernetes against best-practice rules — it cannot see the live cloud account, runtime configuration, or drift between the committed config and what is actually deployed.
• D35 Change Coupling: Change coupling is co-change in COMMITS — files split across separate commits, or coupled only through a shared config/build step, read as uncoupled, and a sweeping commit (rename/format) is excluded so it doesn't couple everything. It shows that files change together, not WHY: a high coupling can be a healthy cohesive pair as readily as a hidden leak.
• D43 Malicious Dependencies: Only packages some vulnerability database has already NAMED as malicious are seen — a compromise published in the last hours, or never reported at all, is invisible here, and this dimension reading 10 is not evidence that a dependency is trustworthy. There is no typosquat or dependency-confusion analysis: a package nobody has reported is simply absent from the feeds. Coverage is the dependency scan's: an ecosystem that could not be scanned is disclosed as unmeasured, never as clean.
• D44 Platform End-of-Life: The support table is FROZEN, so it goes out of date by losing RECALL: a release that ended support after the table was written is missed until the table is refreshed, and this dimension reading 10 is not evidence that a platform is current. Only platforms the repository DECLARES in a place this pass reads are seen — a runtime named only in a REDACTED (D31's subject), in a CI workflow (D29's), or in a file this pass does not parse (REDACTED, a Gemfile ruby directive) is invisible here, which is why a repository declaring none of them abstains rather than scoring. Only frameworks with a PUBLISHED support policy are tracked: React, Flask and Express publish none, so their age cannot be judged and their absence from a report is not a statement that they are supported.
• AX10 Code composition: Role is inferred from namespace/folder convention, not semantics — a domain concept living in a folder named "Services" reads as application, and the split is lines-of-code, not business value. The business-logic-share score is a SOFT, FLOORED signal: it contributes to the Architecture lens but is floored at the Critical gate, so an infrastructure-heavy design (a gateway, an ETL, a driver) is legitimately low without being nuked to zero.
• M4 Documentation accuracy: Onboarding quality is an LLM read of the docs/setup present — it cannot run the onboarding or measure how long a real new joiner takes; the verdict is sampled and advisory.
• P4 Deployment & Rollback: Approval/branch-protection rules live in repository settings the scan cannot see — only their in-repo evidence (config files, workflows) is checked, so a control enforced purely in the host's settings reads as "not evidenced".

The LLM boundary

LLM-set scores this run (3): D19, D21, M4 (model: Local LLM). For these, a model reads a bounded sample and sets the numeric score; each names its own sample and method on its card. They are sampled and advisory by design: they vary at the margins between runs and are never a deterministic measurement. Every other score in this report is tool-computed at confidence 1.0.

Dimensions

Frontend & cross-cutting dimensions

R = React/JS · M = Maturity · P = Readiness.

Reference — by lens

The score is the rank-weighted fold of these lenses (worst-heaviest), each including its meta-dimensions; a lens with a Critical contributor is capped at Fair (its band reads "gated by …") and is never the strongest area however high its average.

Appendix A — Findings (grouped)

The findings behind the scores, grouped by severity, then by dimension and kind. The high-severity issues are enumerated in full below; items per group are capped at 25 with any overflow stated explicitly per group, never silently truncated. The complete machine-readable list of every finding (all severities) is the companion findings.md in this report's bundle.

Appendix B — Reproduction & audit trail

Every external tool invocation behind a deep-scan dimension — the tool, its captured version, the exact command, how many findings it yielded, and a link to the retained raw output. To reproduce any finding: check out the same commit and run the command shown (repo-relative — never an absolute scratch path). The complete raw scanner output is retained verbatim under artifacts/raw/ (indexed in artifacts/raw/index.json); per-invocation exit codes and wall-clock durations are in sidecar.json — kept out of this table so the rendered report stays byte-identical across runs of the same commit.

Run 01a16059-7d6b-7d08-837d-7af94408a3fd · every finding is also locatable in findings.md, and the complete scoring record (with exit codes + durations) in sidecar.json.

Issues: 15 · Warnings: 17 · Recommendations: 6 — Appendix A · all findings · full markdown report.
Generated by Watchdog — deterministic code-health analysis. 21-10-2026 @ 21:23 UTC.