Executive summary
deployphp/deployer scores 53 out of 100 and is rated Adequate, while three of its five lenses score higher still: Security and Compliance at 95, rated Exemplary, and Architecture at 84 and Code Health at 61, both rated Adequate.
The score is lower than those three because the weakest lens counts most, and here that is Production Readiness, which scores 44 and is rated Weak. Its Observability dimension scores 0 out of 10, and until that reaches 4, Production Readiness can't be rated higher than Adequate. The first actions are to resolve the 1 No ADRs found finding(s) in ADR Quality and to write a diagnostic trail the user can hand back with a bug report: a log file under the platform's per-user data directory, switchable with a `--verbose`/`--debug` flag, and if Production Readiness rose to 70, the score would rise from 53 to about 60.
Four findings are critical: three in Change Coupling and one in IaC & Container Security.
Watchdog couldn't measure 17 dimensions in this code, among them Code Coverage, Test Reliability and Dependency Hygiene, so they are left out of the score. The product code is 15,834 lines, which would take an estimated 0.1 person-years, around €20,000, to rebuild.
Code Health
61
Adequate, capped by Nullable reference types
Architecture
84
Adequate, capped by Project Cohesion
Maturity
50
Weak, capped by Architecture documentation
Production Readiness
44
Weak, capped by Observability
Security and Compliance
95 ★
Exemplary
How the score is built: what each lens counts for
The lenses don't count equally. The weakest lens counts most, the next weakest a little less, and so on, so a weak area pulls the score down instead of being averaged away. In the bar below, each part's width shows how much that lens counts and its colour shows its rating. Improving the widest part moves the score most, and as that lens improves, it counts for less, because another lens becomes the weakest.
Production Readiness 44 · counts for 47%Maturity 50 · counts for 26%Code Health 61 · counts for 14%Architecture 84 · counts for 8%Security and Compliance 95 · counts for 4%
If Production Readiness rose from 44 to 70, the lowest score rated Strong, the score would rise from 53 to about 60.
Code composition: what the lines of code are
Product code 77%Tests 23%
Rebuild cost: about €20,000 · Estimate
| Cost to rebuild | €6,700 to €33,000, for 111 to 352 hours of work, about 0.1 person-years for one engineer |
|---|---|
| Difficulty of the problem | Standard, judged from the kind of software and how it is built. Code that solves a harder problem, such as payments or medical bookings, costs more per line to write. |
| Quality factor | ×0.7 at a score of 53. Better code takes more work to write, so the factor is ×1.0 at a score of 70, lower below it and higher above it. |
| Size | Small: 15,834 lines of product code |
Top priorities
1
Resolve the 1 No ADRs found finding(s) in ADR Quality.
2
Write a diagnostic trail the user can hand back with a bug report: a log file under the platform's per-user data directory, switchable with a `--verbose`/`--debug` flag.
Start with the error paths that emit nothing — a discarded error is the failure the user cannot describe and you cannot reproduce.
3
Record your significant design decisions.
Write one short document per decision, giving its date, the situation, the decision and its consequences, and keep them together with your other design documents. A docs/adr folder with each file named by number and title is the easiest place to find them.
Diagnosis: what the measurements show together
Where the investment is most exposed
This code would cost about €20,000 to build again, about 0.1 person-years of work. Its weakest lens is Production Readiness, at 44 (Weak). Production Readiness is about whether the product is ready to run in production and to change without breaking. Because the weakest lens counts most in the score, work on Production Readiness also moves the score most.
If you do one thing first
Resolve the 1 No ADRs found finding(s) in ADR Quality. Of all the actions in this report, it raises the score most for the work it takes: about 6 points for low effort, because it clears the 1 ADR Quality findings. The next survey will show the change in the score.
Architecture: which parts of the code depend on which
| uses → | 1 Deployer.Collection | 2 Deployer.Component.Pimple | 3 Deployer.Component.Pimple.Exception | 4 Deployer.Documentation | 5 Deployer.Logger.Handler | 6 Deployer.Support | 7 contrib | 8 recipe | 9 src.Executor | 10 src.Support | 11 Deployer.Host | 12 src.Documentation | 13 Deployer | 14 Deployer.Exception | 15 Deployer.Selector | 16 Deployer.Command | 17 Deployer.Task | 18 Deployer.Import | 19 Deployer.Logger | 20 src | 21 Deployer.Executor | 22 Deployer.Ssh | 23 Deployer.Utility | 24 Deployer.ProcessRunner |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 Deployer.Collection | ||||||||||||||||||||||||
| 2 Deployer.Component.Pimple | ||||||||||||||||||||||||
| 3 Deployer.Component.Pimple.Exception | ||||||||||||||||||||||||
| 4 Deployer.Documentation | ||||||||||||||||||||||||
| 5 Deployer.Logger.Handler | ||||||||||||||||||||||||
| 6 Deployer.Support | ||||||||||||||||||||||||
| 7 contrib | ||||||||||||||||||||||||
| 8 recipe | ||||||||||||||||||||||||
| 9 src.Executor | ||||||||||||||||||||||||
| 10 src.Support | ||||||||||||||||||||||||
| 11 Deployer.Host | 1 | 1 | ||||||||||||||||||||||
| 12 src.Documentation | 1 | |||||||||||||||||||||||
| 13 Deployer | 1 | 1 | ||||||||||||||||||||||
| 14 Deployer.Exception | 1 | |||||||||||||||||||||||
| 15 Deployer.Selector | 2 | |||||||||||||||||||||||
| 16 Deployer.Command | 7 | |||||||||||||||||||||||
| 17 Deployer.Task | 1 | 1 | 1 | |||||||||||||||||||||
| 18 Deployer.Import | 1 | |||||||||||||||||||||||
| 19 Deployer.Logger | 1 | 1 | 1 | |||||||||||||||||||||
| 20 src | 1 | 1 | 1 | |||||||||||||||||||||
| 21 Deployer.Executor | 3 | 1 | 3 | 1 | ||||||||||||||||||||
| 22 Deployer.Ssh | 1 | 1 | ||||||||||||||||||||||
| 23 Deployer.Utility | 1 | 1 | ||||||||||||||||||||||
| 24 Deployer.ProcessRunner | 1 | 1 | 1 |
Uses a module listed above itPart of a loopThe module itself
11→1 Deployer.Host uses Deployer.Collection✕
- Connections
- 1 pair of types, where a type in Deployer.Host uses a type in Deployer.Collection.
- The types involved
Deployer.Host.HostCollection→Deployer.Collection.Collection
- Direction
- Deployer.Host uses Deployer.Collection, so a change to Deployer.Collection can break Deployer.Host, while a change to Deployer.Host can't break Deployer.Collection.
- Position
- Below the diagonal: Deployer.Host uses a module listed above it, which is the healthy direction.
11→13 Deployer.Host uses Deployer part of a loop✕
- Connections
- 1 pair of types, where a type in Deployer.Host uses a type in Deployer.
- The types involved
Deployer.Host.Host→Deployer.Configuration
- Direction
- Deployer.Host uses Deployer, so a change to Deployer can break Deployer.Host, while a change to Deployer.Host can't break Deployer.
- Position
- Above the diagonal, so it is part of a loop. Neither module can be changed, tested or released on its own until one of these dependencies is removed.
12→4 src.Documentation uses Deployer.Documentation✕
- Connections
- 1 pair of types, where a type in src.Documentation uses a type in Deployer.Documentation.
- The types involved
src.Documentation.DocGen→Deployer.Documentation.DocRecipe
- Direction
- src.Documentation uses Deployer.Documentation, so a change to Deployer.Documentation can break src.Documentation, while a change to src.Documentation can't break Deployer.Documentation.
- Position
- Below the diagonal: src.Documentation uses a module listed above it, which is the healthy direction.
13→2 Deployer uses Deployer.Component.Pimple✕
- Connections
- 1 pair of types, where a type in Deployer uses a type in Deployer.Component.Pimple.
- The types involved
Deployer.Deployer→Deployer.Component.Pimple.Container
- Direction
- Deployer uses Deployer.Component.Pimple, so a change to Deployer.Component.Pimple can break Deployer, while a change to Deployer can't break Deployer.Component.Pimple.
- Position
- Below the diagonal: Deployer uses a module listed above it, which is the healthy direction.
13→11 Deployer uses Deployer.Host✕
- Connections
- 1 pair of types, where a type in Deployer uses a type in Deployer.Host.
- The types involved
Deployer.Deployer→Deployer.Host.Host
- Direction
- Deployer uses Deployer.Host, so a change to Deployer.Host can break Deployer, while a change to Deployer can't break Deployer.Host.
- Position
- Below the diagonal: Deployer uses a module listed above it, which is the healthy direction.
14→11 Deployer.Exception uses Deployer.Host✕
- Connections
- 1 pair of types, where a type in Deployer.Exception uses a type in Deployer.Host.
- The types involved
Deployer.Exception.RunException→Deployer.Host.Host
- Direction
- Deployer.Exception uses Deployer.Host, so a change to Deployer.Host can break Deployer.Exception, while a change to Deployer.Exception can't break Deployer.Host.
- Position
- Below the diagonal: Deployer.Exception uses a module listed above it, which is the healthy direction.
15→11 Deployer.Selector uses Deployer.Host✕
- Connections
- 2 pairs of types, where a type in Deployer.Selector uses a type in Deployer.Host.
- The types involved
Deployer.Selector.Selector→Deployer.Host.HostDeployer.Selector.Selector→Deployer.Host.HostCollection
- Direction
- Deployer.Selector uses Deployer.Host, so a change to Deployer.Host can break Deployer.Selector, while a change to Deployer.Selector can't break Deployer.Host.
- Position
- Below the diagonal: Deployer.Selector uses a module listed above it, which is the healthy direction.
16→13 Deployer.Command uses Deployer✕
- Connections
- 7 pairs of types, where a type in Deployer.Command uses a type in Deployer.
- The types involved
Deployer.Command.ConfigCommand→Deployer.DeployerDeployer.Command.MainCommand→Deployer.DeployerDeployer.Command.RunCommand→Deployer.DeployerDeployer.Command.SelectCommand→Deployer.DeployerDeployer.Command.SshCommand→Deployer.DeployerDeployer.Command.TreeCommand→Deployer.DeployerDeployer.Command.WorkerCommand→Deployer.Deployer
- Direction
- Deployer.Command uses Deployer, so a change to Deployer can break Deployer.Command, while a change to Deployer.Command can't break Deployer.
- Position
- Below the diagonal: Deployer.Command uses a module listed above it, which is the healthy direction.
17→1 Deployer.Task uses Deployer.Collection✕
- Connections
- 1 pair of types, where a type in Deployer.Task uses a type in Deployer.Collection.
- The types involved
Deployer.Task.TaskCollection→Deployer.Collection.Collection
- Direction
- Deployer.Task uses Deployer.Collection, so a change to Deployer.Collection can break Deployer.Task, while a change to Deployer.Task can't break Deployer.Collection.
- Position
- Below the diagonal: Deployer.Task uses a module listed above it, which is the healthy direction.
17→11 Deployer.Task uses Deployer.Host✕
- Connections
- 1 pair of types, where a type in Deployer.Task uses a type in Deployer.Host.
- The types involved
Deployer.Task.Context→Deployer.Host.Host
- Direction
- Deployer.Task uses Deployer.Host, so a change to Deployer.Host can break Deployer.Task, while a change to Deployer.Task can't break Deployer.Host.
- Position
- Below the diagonal: Deployer.Task uses a module listed above it, which is the healthy direction.
17→13 Deployer.Task uses Deployer✕
- Connections
- 1 pair of types, where a type in Deployer.Task uses a type in Deployer.
- The types involved
Deployer.Task.Context→Deployer.Configuration
- Direction
- Deployer.Task uses Deployer, so a change to Deployer can break Deployer.Task, while a change to Deployer.Task can't break Deployer.
- Position
- Below the diagonal: Deployer.Task uses a module listed above it, which is the healthy direction.
18→17 Deployer.Import uses Deployer.Task✕
- Connections
- 1 pair of types, where a type in Deployer.Import uses a type in Deployer.Task.
- The types involved
Deployer.Import.MamlRecipe→Deployer.Task.Task
- Direction
- Deployer.Import uses Deployer.Task, so a change to Deployer.Task can break Deployer.Import, while a change to Deployer.Import can't break Deployer.Task.
- Position
- Below the diagonal: Deployer.Import uses a module listed above it, which is the healthy direction.
19→5 Deployer.Logger uses Deployer.Logger.Handler✕
- Connections
- 1 pair of types, where a type in Deployer.Logger uses a type in Deployer.Logger.Handler.
- The types involved
Deployer.Logger.Logger→Deployer.Logger.Handler.HandlerInterface
- Direction
- Deployer.Logger uses Deployer.Logger.Handler, so a change to Deployer.Logger.Handler can break Deployer.Logger, while a change to Deployer.Logger can't break Deployer.Logger.Handler.
- Position
- Below the diagonal: Deployer.Logger uses a module listed above it, which is the healthy direction.
19→11 Deployer.Logger uses Deployer.Host✕
- Connections
- 1 pair of types, where a type in Deployer.Logger uses a type in Deployer.Host.
- The types involved
Deployer.Logger.Logger→Deployer.Host.Host
- Direction
- Deployer.Logger uses Deployer.Host, so a change to Deployer.Host can break Deployer.Logger, while a change to Deployer.Logger can't break Deployer.Host.
- Position
- Below the diagonal: Deployer.Logger uses a module listed above it, which is the healthy direction.
19→17 Deployer.Logger uses Deployer.Task✕
- Connections
- 1 pair of types, where a type in Deployer.Logger uses a type in Deployer.Task.
- The types involved
Deployer.Logger.Logger→Deployer.Task.Task
- Direction
- Deployer.Logger uses Deployer.Task, so a change to Deployer.Task can break Deployer.Logger, while a change to Deployer.Logger can't break Deployer.Task.
- Position
- Below the diagonal: Deployer.Logger uses a module listed above it, which is the healthy direction.
20→11 src uses Deployer.Host✕
- Connections
- 1 pair of types, where a type in src uses a type in Deployer.Host.
- The types involved
src.functions→Deployer.Host.Host
- Direction
- src uses Deployer.Host, so a change to Deployer.Host can break src, while a change to src can't break Deployer.Host.
- Position
- Below the diagonal: src uses a module listed above it, which is the healthy direction.
20→14 src uses Deployer.Exception✕
- Connections
- 1 pair of types, where a type in src uses a type in Deployer.Exception.
- The types involved
src.functions→Deployer.Exception.Exception
- Direction
- src uses Deployer.Exception, so a change to Deployer.Exception can break src, while a change to src can't break Deployer.Exception.
- Position
- Below the diagonal: src uses a module listed above it, which is the healthy direction.
20→17 src uses Deployer.Task✕
- Connections
- 1 pair of types, where a type in src uses a type in Deployer.Task.
- The types involved
src.functions→Deployer.Task.Task
- Direction
- src uses Deployer.Task, so a change to Deployer.Task can break src, while a change to src can't break Deployer.Task.
- Position
- Below the diagonal: src uses a module listed above it, which is the healthy direction.
21→11 Deployer.Executor uses Deployer.Host✕
- Connections
- 3 pairs of types, where a type in Deployer.Executor uses a type in Deployer.Host.
- The types involved
Deployer.Executor.Master→Deployer.Host.HostDeployer.Executor.Master→Deployer.Host.HostCollectionDeployer.Executor.Worker→Deployer.Host.Host
- Direction
- Deployer.Executor uses Deployer.Host, so a change to Deployer.Host can break Deployer.Executor, while a change to Deployer.Executor can't break Deployer.Host.
- Position
- Below the diagonal: Deployer.Executor uses a module listed above it, which is the healthy direction.
21→13 Deployer.Executor uses Deployer✕
- Connections
- 1 pair of types, where a type in Deployer.Executor uses a type in Deployer.
- The types involved
Deployer.Executor.Worker→Deployer.Deployer
- Direction
- Deployer.Executor uses Deployer, so a change to Deployer can break Deployer.Executor, while a change to Deployer.Executor can't break Deployer.
- Position
- Below the diagonal: Deployer.Executor uses a module listed above it, which is the healthy direction.
21→17 Deployer.Executor uses Deployer.Task✕
- Connections
- 3 pairs of types, where a type in Deployer.Executor uses a type in Deployer.Task.
- The types involved
Deployer.Executor.Master→Deployer.Task.TaskDeployer.Executor.Planner→Deployer.Task.TaskDeployer.Executor.Worker→Deployer.Task.Task
- Direction
- Deployer.Executor uses Deployer.Task, so a change to Deployer.Task can break Deployer.Executor, while a change to Deployer.Executor can't break Deployer.Task.
- Position
- Below the diagonal: Deployer.Executor uses a module listed above it, which is the healthy direction.
21→19 Deployer.Executor uses Deployer.Logger✕
- Connections
- 1 pair of types, where a type in Deployer.Executor uses a type in Deployer.Logger.
- The types involved
Deployer.Executor.Master→Deployer.Logger.Logger
- Direction
- Deployer.Executor uses Deployer.Logger, so a change to Deployer.Logger can break Deployer.Executor, while a change to Deployer.Executor can't break Deployer.Logger.
- Position
- Below the diagonal: Deployer.Executor uses a module listed above it, which is the healthy direction.
22→11 Deployer.Ssh uses Deployer.Host✕
- Connections
- 1 pair of types, where a type in Deployer.Ssh uses a type in Deployer.Host.
- The types involved
Deployer.Ssh.SshClient→Deployer.Host.Host
- Direction
- Deployer.Ssh uses Deployer.Host, so a change to Deployer.Host can break Deployer.Ssh, while a change to Deployer.Ssh can't break Deployer.Host.
- Position
- Below the diagonal: Deployer.Ssh uses a module listed above it, which is the healthy direction.
22→19 Deployer.Ssh uses Deployer.Logger✕
- Connections
- 1 pair of types, where a type in Deployer.Ssh uses a type in Deployer.Logger.
- The types involved
Deployer.Ssh.SshClient→Deployer.Logger.Logger
- Direction
- Deployer.Ssh uses Deployer.Logger, so a change to Deployer.Logger can break Deployer.Ssh, while a change to Deployer.Ssh can't break Deployer.Logger.
- Position
- Below the diagonal: Deployer.Ssh uses a module listed above it, which is the healthy direction.
23→11 Deployer.Utility uses Deployer.Host✕
- Connections
- 1 pair of types, where a type in Deployer.Utility uses a type in Deployer.Host.
- The types involved
Deployer.Utility.Rsync→Deployer.Host.Host
- Direction
- Deployer.Utility uses Deployer.Host, so a change to Deployer.Host can break Deployer.Utility, while a change to Deployer.Utility can't break Deployer.Host.
- Position
- Below the diagonal: Deployer.Utility uses a module listed above it, which is the healthy direction.
23→19 Deployer.Utility uses Deployer.Logger✕
- Connections
- 1 pair of types, where a type in Deployer.Utility uses a type in Deployer.Logger.
- The types involved
Deployer.Utility.Rsync→Deployer.Logger.Logger
- Direction
- Deployer.Utility uses Deployer.Logger, so a change to Deployer.Logger can break Deployer.Utility, while a change to Deployer.Utility can't break Deployer.Logger.
- Position
- Below the diagonal: Deployer.Utility uses a module listed above it, which is the healthy direction.
24→11 Deployer.ProcessRunner uses Deployer.Host✕
- Connections
- 1 pair of types, where a type in Deployer.ProcessRunner uses a type in Deployer.Host.
- The types involved
Deployer.ProcessRunner.ProcessRunner→Deployer.Host.Host
- Direction
- Deployer.ProcessRunner uses Deployer.Host, so a change to Deployer.Host can break Deployer.ProcessRunner, while a change to Deployer.ProcessRunner can't break Deployer.Host.
- Position
- Below the diagonal: Deployer.ProcessRunner uses a module listed above it, which is the healthy direction.
24→19 Deployer.ProcessRunner uses Deployer.Logger✕
- Connections
- 1 pair of types, where a type in Deployer.ProcessRunner uses a type in Deployer.Logger.
- The types involved
Deployer.ProcessRunner.ProcessRunner→Deployer.Logger.Logger
- Direction
- Deployer.ProcessRunner uses Deployer.Logger, so a change to Deployer.Logger can break Deployer.ProcessRunner, while a change to Deployer.ProcessRunner can't break Deployer.Logger.
- Position
- Below the diagonal: Deployer.ProcessRunner uses a module listed above it, which is the healthy direction.
24→22 Deployer.ProcessRunner uses Deployer.Ssh✕
- Connections
- 1 pair of types, where a type in Deployer.ProcessRunner uses a type in Deployer.Ssh.
- The types involved
Deployer.ProcessRunner.ProcessRunner→Deployer.Ssh.RunParams
- Direction
- Deployer.ProcessRunner uses Deployer.Ssh, so a change to Deployer.Ssh can break Deployer.ProcessRunner, while a change to Deployer.ProcessRunner can't break Deployer.Ssh.
- Position
- Below the diagonal: Deployer.ProcessRunner uses a module listed above it, which is the healthy direction.
At a glance — Code Health
The Good
D1 · PHP
Cyclomatic Complexity
8.0
D3 · PHP
God Classes
8.6
D4 · PHP
Code Duplication
9.9
D17 · PHP
Explicit Debt
10.0
X1 · Repo
Async correctness
10.0
X12 · Repo
Unreachable branch
10.0
X13 · Repo
Undrained process stream
10.0
X16 · Repo
Unfloored truncation loop
10.0
X18 · Repo
Disposal-pattern correctness
10.0
X19 · Repo
Unrestored process-global state
10.0
X21 · Repo
Side-effecting pattern guard
10.0
X22 · Repo
Contradicted release guard
10.0
X23 · Repo
Unguarded diagnostic materialisation
10.0
X25 · Repo
Inert configuration knob
10.0
X28 · Repo
Index access outside its own emptiness guard
10.0
X29 · Repo
Per-element action decided by a fixed element
10.0
X30 · Repo
Support guard that admits what it rejects
10.0
The Bad
At a glance — Architecture
The Good
The Ugly
At a glance — Maturity
The Good
The Ugly
At a glance — Readiness
The Good
At a glance — Security
The Good
D28 · PHP
Secrets (history)
10.0
D29 · PHP
Static Analysis (SAST)
10.0
D31 · PHP
IaC & Container Security
9.6
D36 · PHP
Supply-chain Provenance & Signing
7.5
D37 · PHP
Vulnerability-disclosure Policy
10.0
D44 · PHP
Platform End-of-Life
10.0
X14 · Repo
Bypassable address classification
10.0
X15 · Repo
Unvalidated length from an untrusted reader
10.0
Security & Compliance — OWASP Top-10 mapping
| OWASP category | Findings | Severity |
|---|---|---|
| A03:2025 — Software Supply Chain Failures | 3 | Medium |
| A02:2025 — Security Misconfiguration | 2 | High / Critical |
Roadmap
First, establish a diagnostic trail by adding verbose logging to error paths so users can provide actionable bug reports. Next, document significant design decisions in a dedicated ADR folder and expand the README with getting-started and architecture guides to improve project clarity. Finally, enforce strict nullable reference types by raising static analysis levels and systematically resolving existing nullness errors to prevent future regressions.
| Do this | Helps | Effort | Dimension |
|---|---|---|---|
| Resolve the 1 No ADRs found finding(s) in ADR Quality. | +6.1 pts | Low | ADR Quality |
| Write a diagnostic trail the user can hand back with a bug report: a log file under the platform's per-user data directory, switchable with a `--verbose`/`--debug` flag. Start with the error paths that emit nothing — a discarded error is the failure the user cannot describe and you cannot reproduce. | +6.1 pts | Medium | Observability |
| Record your significant design decisions. Write one short document per decision, giving its date, the situation, the decision and its consequences, and keep them together with your other design documents. A docs/adr folder with each file named by number and title is the easiest place to find them. | +5.2 pts | Medium | Architecture documentation |
| Expand the README with getting-started, architecture overview and a project map. | +3.3 pts | Medium | Documentation (README) |
| Raise PHPStan to level 8 (`level: 8` in `phpstan.neon.dist`, or `max`) or Psalm to `errorLevel="3"` or stricter, so `?Type` is a type the checker holds you to; generate a baseline for what that surfaces only to pay it down, not to keep it. Then resolve the baselined nullness errors rather than adding to them: each is a call on a value the checker showed could be null — narrow it (`if ($x === null) { … }`, `?->`, an early return), make the property non-nullable and initialise it in the constructor, or change the return type so the null cannot arrive. | +3.1 pts | Medium | Nullable reference types |
| Nothing pauses a release for a human: publish as a draft release (or gate the release job on a protected tag/manual dispatch) so a bad build can be stopped before users can download it. | +2.8 pts | Medium | Deployment & Rollback |
| Keep a changelog (e.g. Keep-a-Changelog) recording what shipped in each release. | +2.8 pts | Medium | Release Hygiene |
| Resolve the 1 Projects may be oversized for their cohesion finding(s) in Project Cohesion. | +1.1 pts | Low | Project Cohesion |
File quality
| File | Score | Band | Worst signal |
|---|---|---|---|
| REDACTED | 5.1 | Mixed | IaC & Container Security: High IaC: REDACTED |
| recipe/provision/user.php | 6.9 | Mixed | Explicit Debt: TodoComment |
| src/Executor/Master.php | 7.2 | Mixed | Cyclomatic Complexity: Master.run (cyclomatic 26) |
| src/Import/MamlRecipe.php | 7.2 | Mixed | Cyclomatic Complexity: MamlRecipe.createTask (cyclomatic 19) |
| src/Documentation/DocGen.php | 7.4 | Mixed | Cyclomatic Complexity: DocGen.gen (cyclomatic 49) |
| src/Command/BlackjackCommand.php | 7.4 | Mixed | Cyclomatic Complexity: BlackjackCommand.execute (cyclomatic 30) |
| src/Documentation/DocRecipe.php | 7.4 | Mixed | Cyclomatic Complexity: DocRecipe.parse (cyclomatic 25) |
| src/Import/YamlRecipe.php | 7.4 | Mixed | Cyclomatic Complexity: YamlRecipe.tasks (cyclomatic 18) |
| src/functions.php | 7.4 | Mixed | God Classes: TooManyMethods: functions |
| src/Utility/Rsync.php | 7.8 | Mixed | Cyclomatic Complexity: Rsync.call (cyclomatic 22) |
| src/Command/MainCommand.php | 7.8 | Mixed | Cyclomatic Complexity: MainCommand.execute (cyclomatic 16) |
| src/Task/ScriptManager.php | 7.8 | Mixed | Cognitive Complexity: ScriptManager.getTasks (cognitive 17) |
| src/ProcessRunner/ProcessRunner.php | 8.0 | Near-clean | Change Coupling: Boundary-crossing change coupling: ProcessRunner.php ↔ SshClient.php |
| src/Command/WorkerCommand.php | 8.0 | Near-clean | Change Coupling: Boundary-crossing change coupling: WorkerCommand.php ↔ Master.php |
| contrib/rsync.php | 8.0 | Near-clean | Change Coupling: Boundary-crossing change coupling: rsync.php ↔ SshClient.php |
| recipe/magento2.php | 8.2 | Near-clean | Explicit Debt: TodoComment |
| src/Logger/Logger.php | 8.5 | Near-clean | Cognitive Complexity: Logger.renderException (cognitive 35) |
| src/Documentation/ApiGen.php | 8.5 | Near-clean | Cognitive Complexity: ApiGen.parse (cognitive 31) |
| src/Executor/Server.php | 8.5 | Near-clean | Cognitive Complexity: Server.handleClientRequests (cognitive 21) |
| src/Command/TreeCommand.php | 8.5 | Near-clean | Cognitive Complexity: TreeCommand.createTreeFromTaskName (cognitive 19) |
How the grades work
Critical — 4
A definite problem that already costs you something and drags the score down: a missing authorisation check, a dependency with a known exploit, a build that does not reproduce. Failure here tends to cause failures elsewhere.
Serious — 47
Likely wrong, but not failing yet. It degrades the codebase over a longer horizon and can cause failures elsewhere — not urgent this week, not something to carry for two years either.
Minor — 30
Recorded, with no effect on how the codebase functions. Present so the survey is complete, not because it needs doing.
Could not be resolved — 18
Something this survey could not settle from the outside, and which could be critical or serious. Either a control was required and no positive evidence of it exists in the repository — a backup job that nothing shows was ever restored from proves nothing about restores — or our own analysis could not run over that part of the tree. This is not a clean result. These are excluded from the score rather than awarded a pass, so the number on the cover neither rewards nor penalises them: if you act on this survey without resolving them, you carry that risk yourself. Each one is named under Limitations.
Methodology & how to trust this report
Watchdog is a deep, periodic assessment — run each sprint, monthly, or quarterly, taking the time to go wider and deeper than a quick check and surfacing in one coherent report what you'd otherwise piece together from a dozen separate tools. It scores deterministically: the same commit yields the same score, every run. 49 of 52 evaluated dimensions are computed purely by tools and static analysis (confidence 1.0); 3 documentation/naming judgement(s) are LLM-assisted and labelled advisory. Overall confidence is 0.9 — the weighted average across measured dimensions; it falls as more of the score leans on LLM-assisted judgement and rises when it's fully tool-backed.
What we checked — 52 dimensions across the health lenses
D1D2D3D4D6D9D10D13D15D16D17D19D20D21D26D28D29D31D34D35D36D37D44AX10AX3AX4M1M2M3M4P1P2P3P4P6X1X12X13X14X15X16X18X19X21X22X23X25X28X29X3X30X5
How to trust any code-health report — three questions
- Can you open the finding? Real findings cite a repo-relative file and line you can open at the cited line — never an absolute scratch path. Here, 65 of 81 do; the remainder are repo-wide signals — a dimension-level measurement, not a single line.
- Is there a tool behind the number? Every score below names the method that produced it — Roslyn, git, a scanner, or (for a handful of documentation/naming dimensions) an LLM labelled sampled · advisory — not a narrative.
- Does re-running give the same result? Run it again on the same commit and the score — and this report, byte for byte — is identical. A report whose numbers move between runs is describing the run, not the code.
Tools & methods
| Method | Backs | Version | Evaluator |
|---|---|---|---|
| Roslyn static analysis | Complexity, cohesion, coupling, dead code, API surface, layering | 5.3.0 | ✓ deterministic |
| Native secret scanner | Hardcoded secrets / credentials | 1.0.0 | ✓ deterministic |
| Watchdog duplication detector (in-process) | Code duplication | 1.0.0 | ✓ deterministic |
| Coverage (coverlet / dotnet-coverage) | Line & branch coverage | 10.0.400 | ✓ deterministic |
| NuGet / dotnet | Outdated, vulnerable & deprecated dependencies | 10.0.400 | ✓ deterministic |
| git / LibGit2Sharp | Churn hotspots, knowledge concentration, history | 2.43.0 · 0.31.0 | ✓ deterministic |
| gitleaks · semgrep · trivy · checkov | Secrets in history, SAST, CVEs, IaC & container, PII / GDPR | 1.86.0 · 0.69.3 · 3.2.533 | ✓ deterministic |
| LLM (sampled · advisory) | Documentation quality, ADR conformance, naming — sampled over a bounded sample; advisory, never a deterministic measurement | Local LLM | ◐ LLM · sampled · advisory |
Run transparency — what happened this run
- D8 Code Coverage — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. Coverage NOT READ here — but this repository measures it: a coverage step in CI (`phpunit --coverage-text --coverage`) shows that coverage is collected and tracked in your own CI. The built-in collector has no runner for this ecosystem (.php), so the analyzer could not read the number — a gap in the analyzer's language coverage, not an unmeasured repo. Not scored. To have the real number read, produce a coverage report in a standard format (Clover XML — with Xdebug (`XDEBUG_MODE=coverage`) or PCOV installed, `vendor/bin/phpunit --coverage-clover coverage.xml`) and commit it — a hosted scan measures a clone of the repository, so a report that exists only in a working tree, a CI runner's or your own, never reaches it; the artefact is commonly gitignored, so `git add -f` that one file (or un-ignore its path) and commit it alongside the code it measures. You can widen what we reach: optional: produce a coverage report in a standard format (Clover XML — with Xdebug (`XDEBUG_MODE=coverage`) or PCOV installed, `vendor/bin/phpunit --coverage-clover coverage.xml`) and commit it — a hosted scan measures a clone of the repository, so a report that exists only in a working tree, a CI runner's or your own, never reaches it; the artefact is commonly gitignored, so `git add -f` that one file (or un-ignore its path) and commit it alongside the code it measures — then the real number is read on the next scan.
- D11 Test Reliability — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. Test source is present (.php) but the built-in reliability runner does not support this repository's ecosystem, so flakiness couldn't be assessed. Not scored — this is a gap in the analyzer's language coverage, not a finding about this repository.
- D12 Dependency Hygiene — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. Not scored — 4 direct Composer requirement(s) were read, but the outdated signal needs Packagist, and no committed composer.lock resolves them to releases, so this dimension's own question is only partly answered. NOT a finding that these dependencies are current or healthy.
- D14 License Compliance — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. Not scored — this repository declares a composer.json but commits no composer.lock this pass can read, so the set of packages it installs is not on disk: its composer.json states version CONSTRAINTS, and Composer's guidance is that a library leaves the lock uncommitted. Producing the graph needs Composer's solver, which this pass does not run, and grading whichever release happens to be newest today would be a verdict about a dependency graph nobody resolved. NOT a finding that this repository's licences are compliant: this dimension asserts nothing about its licensing in either direction.
- D22 Internal API Consistency — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. D22 identifies the intentionally-exposed surface from `IsPackable` and `.Contracts` project names, MSBuild conventions read off the loaded project set. This target exposed no such projects, so the probe never ran; this says nothing about whether the repository has a public API. This repository commits no C#/VB source at all, so there was never an MSBuild project set to read these conventions off. That is OUR side and it is an ADMISSION gap, not an environment fault: no published-package marker D22 reads admitted any project here. D22 DOES collect the public API of every language in this tree, and admits a project only when its manifest makes that ecosystem's publication act in a form the marker recognises — so what is missing is not a collector but an admission rule for the publication act this repository makes, if it makes one. The remedy is a better discriminator for that marker — not a collector, and no change to the scan image can close it. The marker's rules are measured to refuse applications, so one refused repository is the rule working as calibrated; several are the evidence that it is too strict. For npm the surface is what a published package.json's entry points (exports, main, module, types) export, followed through the source; an entry that names build output the tree does not commit (dist/, build/) is not followed back to source, because only a tsconfig outDir/rootDir pair states that mapping and a bundler's input lives in executable configuration this engine does not evaluate.
- D27 Navigability — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. Navigability is taken over call sites whose callee resolved. For C# that population includes calls into referenced assemblies; for this language only calls declared inside the repository count, so the abstention threshold reads the repository's use of its standard library as a resolution failure. That is a limit of this analyzer, not a build problem in this repository.
- D32 Data Compliance (PII/GDPR) — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. `src/Ssh/RunParams.php` produced a parse error, so every rule in this engine's `gdpr.yml` was absent there. That absence is NOT a clean result: these rules detect personal data crossing a boundary into a log sink, a URL or browser storage, and a file that was never parsed cannot report any of the three. The rest of the tree analysed normally and its rows above stand; only these files are unaccounted for. You can widen what we reach: fix the syntax error (or exclude the file deliberately) and re-scan to cover it.
- AX1 Captive dependencies — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads Microsoft.Extensions.DependencyInjection registrations in C# and Spring beans in Java/Kotlin only, and this repository's container is a PSR-11 container (Psr\Container), whose lifetimes are not modelled yet, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- AX6 Interface segregation — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check is computed over the public interfaces this run's compilations declare, and none was loaded, so it had nothing to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- AXR1 Runtime accessibility — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. Render strategy: boot via REDACTED (REDACTED). docker build failed (exit 1) — DEPRECATED: The legacy builder is deprecated and will be removed in a future release. Install the buildx component to build images with BuildKit: https://docs.docker.com/go/bui…; runtime evidence skipped.
- GD1 Unfinished & placeholder code — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, F#, JavaScript/TypeScript, Dart, Ruby and Scala source only, and this repository's , PHP is most of its product and is not read yet, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- IC1 Incompleteness & stubs — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, JavaScript/TypeScript, Java, Dart, Ruby and Scala source only, and this repository's , PHP is most of its product and is not read yet, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- P5 DR & Backup — not measured this run — This is a true statement about the repository that carries nothing for its owner to act on, so it is reported here rather than as a defect in their code. No backup/snapshot/replication config, RTO/RPO or restore-procedure documentation was found — and no production persistence was detected either (no data-access packages, no data-store services, no database resources), so there is nothing in this repository whose loss a DR control would recover. If this system's data lives in a platform or ops repo we can't see, that's where the DR evidence belongs.
- P7 Outbound HTTP resilience — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check recognises outbound HTTP clients, their timeouts and resilience policies, and service entry points in .NET, Go, JVM, Python, JavaScript/TypeScript, Ruby, PHP, Rust, Elixir, Swift, Dart and Erlang. No service entry point was found in the JavaScript/TypeScript, PHP source it does read, and the rest of this repository's production source is , which it does not read yet — the service may well be there — a gap in this analyzer's language reach, not a finding about the code.
- S1 Web-Security Posture — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. These web-security controls are read from declarative annotations, request middleware, entity/column names and guard methods in a C# source model, and none was loaded on this run, so there was nothing to gather. That is a gap in this analyzer's language reach — not a finding that the repository lacks web-security controls.
- X17 Uncapped recursion over a caller-supplied document — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript, Python, Dart, Ruby, Scala and Kotlin source only, and no C# was loaded and no JavaScript/TypeScript, Python, Dart, Ruby, Scala or Kotlin was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- X24 Document value interpolated into markup unescaped — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript, Java, Scala, Ruby and Python source only, and no C# was loaded and no JavaScript/TypeScript, Java, Scala, Ruby or Python was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- X27 Collection changed while being enumerated — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and Java, Rust, Erlang, F#, Python, Dart, Ruby, Scala and Kotlin source only, and no C# was loaded, no Java, Rust, Erlang, F#, Python, Dart, Ruby, Scala or Kotlin was found, and this repository's PHP is not read yet, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- X4 Structured logging — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript, Java, Kotlin, Python, PHP, Dart, Ruby, Scala and Rust source only, and no C# was loaded, and this repository's JavaScript/TypeScript, Python and PHP make no call through a named logger, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
Limitations & what we did not check
Watchdog assesses the repository exactly as committed, and only the repository. By design it does not reach outside the source tree: the live cloud account, the running CI/CD pipeline, the host's branch-protection and approval rules, the production configuration, or a restore actually exercised against a backup are all out of scope. That boundary is a feature, not a gap — a repo-relative, deterministic scan re-runs identically on any commit and every finding opens at a real file and line, where a live audit can neither be reproduced nor traced. The visible consequence is that controls which leave no in-repo evidence are reported as "not evidenced" and excluded from the score rather than awarded a number a static scan cannot justify.
Per-dimension blind spots
- D1 Cyclomatic Complexity: Cyclomatic complexity counts branches statically — it cannot tell an essential decision tree from accidental tangle, nor see complexity that lives in data or configuration (large switch-case token tables, DSL lexers/parsers, data-as-code rule tables) rather than control flow: a tokenizer's many single-character cases read as high complexity though each branch is trivial.
- D2 Cognitive Complexity: Cognitive-complexity heuristics approximate how hard code is to follow; genuine domain difficulty and well-named intent that eases reading are not captured.
- D3 God Classes: "God class" is sized by members and responsibilities visible in the type — a deliberately broad facade over a coherent subsystem can read the same as an accidental grab-bag. For front-end JS the file-length check is cohesion-aware (a single-responsibility module — one class/IIFE — earns a 3× threshold), but cohesion is approximated from top-level declarations, not true dependency structure.
- D4 Code Duplication: Duplication is token-similarity — an in-process token-stream comparison over sliding windows, with type-aware normalization — so it finds copy-paste, not semantic duplication expressed differently. Committed machine-written code (scaffolded migrations, designer/codegen output, protobuf/OpenAPI stubs, model snapshots) is EXCLUDED — its repetition is the tool's, not the team's — so the score reflects hand-written duplication only.
- D6 Cohesion (LCOM4): LCOM4 cohesion is syntactic — it infers connectivity from which methods touch which fields/methods by name, not from real runtime behaviour or intent.
- D9 Test Distribution: The test-pyramid shape is inferred from project/folder naming and references, with a single test host bucketed per-file by its path tier and content signals — a suite that names tiers unconventionally and gives no per-file signal can still be mis-bucketed.
- D10 Test Quality: Assertion density is structural — it cannot tell a meaningful behavioural assertion from a trivial one, only that an assertion is present.
- D13 Secret Scanning: Secret detection is signature- and entropy-based on the current tree — a secret that does not match a known pattern, or one already rotated, will not be flagged (a clean scan is "nothing matched", not "no secrets exist").
- D15 Churn × Complexity Hotspots: Churn hotspots come from git history — a freshly imported or squashed repository has no churn signal, and recent rewrites can mask a historically risky file.
- D16 Bus Factor: Bus-factor is a time-decayed model of commit attribution (who has recently, repeatedly worked a file), not comprehension — pairing, review and reading-without-committing spread knowledge it can't see; bot commits and shared accounts still distort it.
- D17 Explicit Debt: Acknowledged-debt signals (TODO/FIXME, suppressions, dead code) are textual — undocumented debt that nobody marked, and debt that lives in design rather than annotations, is invisible. Committed machine-written code (scaffolded migrations, designer/codegen output, generated stubs) is excluded — it is never the team's dead code to delete.
- D19 Documentation Quality: Documentation quality is judged by an LLM over a bounded sample of docs — it reads what is written, not whether the docs match the running system, and it is advisory, not a measurement. Its critique rows are drawn from a closed category vocabulary and each row means the same thing in every run, so two scans can be compared row by row; the SET that fires is still a sample, and does not repeat exactly. Measured on one frozen input, six scans at one engine SHA: 2-5 critique rows per scan, 8 distinct rows across the six, 3 of those 8 seen in only one scan. So a D19 row is evidence about the documentation, but a COUNT of D19 rows is not a quantity — never read a change in it as an improvement or a regression.
- D20 ADR Quality: ADR quality is an LLM read of the decision records present — it cannot know about decisions made and never recorded, and its verdict is sampled and advisory.
- D21 Naming Consistency: Naming quality is an LLM judgement over a bounded sample — it assesses clarity/consistency of the names it sees, not domain-correctness, and is advisory.
- D26 Project Cohesion: Project focus is sized from members/namespaces per project — a project that is broad by deliberate design reads the same as one that has sprawled.
- D28 Secrets (history): Secret-history scanning sweeps the git log for known patterns — a secret that predates the available history, or never matched a signature, is not found (clean means "nothing matched in the history we can see").
- D29 Static Analysis (SAST): SAST findings are pattern-based (semgrep) — it finds classes of bug it has rules for; logic flaws, auth/authorization gaps and issues needing runtime context are out of reach (and clean means "no rule matched").
- D31 IaC & Container Security: IaC scanning checks Dockerfiles/Terraform/Kubernetes against best-practice rules — it cannot see the live cloud account, runtime configuration, or drift between the committed config and what is actually deployed.
- D34 Knowledge Freshness: Freshness is decayed commit RECENCY, not comprehension — code read often but rarely committed reads as orphaned, and stable code that genuinely needs no changes is penalised the same as forgotten code; bot/squash commits distort it like the bus factor.
- D35 Change Coupling: Change coupling is co-change in COMMITS — files split across separate commits, or coupled only through a shared config/build step, read as uncoupled, and a sweeping commit (rename/format) is excluded so it doesn't couple everything. It shows that files change together, not WHY: a high coupling can be a healthy cohesive pair as readily as a hidden leak.
- D44 Platform End-of-Life: The support table is FROZEN, so it goes out of date by losing RECALL: a release that ended support after the table was written is missed until the table is refreshed, and this dimension reading 10 is not evidence that a platform is current. Only platforms the repository DECLARES in a place this pass reads are seen — a runtime named only in a REDACTED (D31's subject), in a CI workflow (D29's), or in a file this pass does not parse (go.mod, a Gemfile ruby directive) is invisible here, which is why a repository declaring none of them abstains rather than scoring. Only frameworks with a PUBLISHED support policy are tracked: React, Flask and Express publish none, so their age cannot be judged and their absence from a report is not a statement that they are supported.
- AX10 Code composition: Role is inferred from namespace/folder convention, not semantics — a domain concept living in a folder named "Services" reads as application, and the split is lines-of-code, not business value. The business-logic-share score is a SOFT, FLOORED signal: it contributes to the Architecture lens but is floored at the Critical gate, so an infrastructure-heavy design (a gateway, an ETL, a driver) is legitimately low without being nuked to zero.
- M4 Documentation accuracy: Onboarding quality is an LLM read of the docs/setup present — it cannot run the onboarding or measure how long a real new joiner takes; the verdict is sampled and advisory.
- P4 Deployment & Rollback: Approval/branch-protection rules live in repository settings the scan cannot see — only their in-repo evidence (config files, workflows) is checked, so a control enforced purely in the host's settings reads as "not evidenced".
- P6 Release Hygiene: Rollback/observability controls are inferred from repo artefacts (pipelines, dashboards-as-code) — controls configured in external tooling, with no in-repo trace, cannot be credited.
The LLM boundary
Dimensions
D1 · Cyclomatic Complexity
9 method(s) exceeded the cyclomatic complexity threshold of 15; the worst was DocGen.gen at 49. A further 1 method(s) were over the threshold but excluded as flat dispatchers (a long switch/match over independent cases: many branches, almost no nesting), the largest being BlackjackCommand.handValue at 18 — they are counted neither in the figure above nor in this dimension's score.
DocGen.gen (cyclomatic 49)src/Documentation/DocGen.php:48
BlackjackCommand.execute (cyclomatic 30)src/Command/BlackjackCommand.php:41
Master.run (cyclomatic 26)src/Executor/Master.php:59
DocRecipe.parse (cyclomatic 25)src/Documentation/DocRecipe.php:49
Rsync.call (cyclomatic 22)src/Utility/Rsync.php:43
What to do
- Bring the 1 body over 30 down to 30 or less in Cyclomatic Complexity — start with DocGen.gen (cyclomatic 49). — Refactoring it lifts Cyclomatic Complexity from 8.0 to about 8.6/10.
- Enforce Cyclomatic Complexity in CI to reach Verified (currently Documented). — Hardens enforcement from Documented toward Prevented — provenance only; does not change the score.
Do you agree with this assessment?
D2 · Cognitive Complexity
19 method(s) exceeded the cognitive complexity threshold of 15; the worst was DocGen.gen at 137.
DocGen.gen (cognitive 137)src/Documentation/DocGen.php:48
Master.run (cognitive 77)src/Executor/Master.php:59
DocRecipe.parse (cognitive 67)src/Documentation/DocRecipe.php:49
YamlRecipe.tasks (cognitive 38)src/Import/YamlRecipe.php:79
Logger.renderException (cognitive 35)src/Logger/Logger.php:113
What to do
- Bring the 3 bodies over 60 down to 60 or less in Cognitive Complexity — start with DocGen.gen (cognitive 137), Master.run (cognitive 77), DocRecipe.parse (cognitive 67). — This score is capped by its worst body, so a finding fixed alone moves it by almost nothing — the next one down takes its place. Refactoring these 3 together lifts Cognitive Complexity from 4.2 to about 5.8/10, projected with the scoring formula itself and assuming each lands exactly at 60; a cleaner split scores higher.
- Enforce Cognitive Complexity in CI to reach Verified (currently Documented). — Hardens enforcement from Documented toward Prevented — provenance only; does not change the score.
Do you agree with this assessment?
D3 · God Classes
5 god class(es) detected.
MethodTooLong: DocGen.gen src/Documentation/DocGen.php:48
TooManyMethods: functions src/functions.php:1
What to do
- Resolve the 3 MethodTooLong finding(s) in God Classes — start with DocGen.php, BlackjackCommand.php, DocRecipe.php. — One of this dimension's main actionable groups (3 warning-level).
- Resolve the 2 TooManyMethods finding(s) in God Classes — start with functions.php, Host.php. — One of this dimension's main actionable groups (2 warning-level).
- Enforce God Classes in CI to reach Verified (currently Documented). — Hardens enforcement from Documented toward Prevented — provenance only; does not change the score.
Do you agree with this assessment?
D4 · Code Duplication
4 duplicated block group(s) detected.
Duplicated block (10 lines × 2) src/Import/MamlRecipe.php:416
Duplicated block (16 lines × 2)src/Import/YamlRecipe.php:106
Duplicated block (15 lines × 2)src/functions.php:913
What to do
- Resolve the 2 Duplicated block (10 lines × 2) finding(s) in Code Duplication — start with MamlRecipe.php, functions.php. — One of this dimension's main actionable groups (2 warning-level).
- Resolve the 1 Duplicated block (16 lines × 2) finding(s) in Code Duplication — start with YamlRecipe.php. — One of this dimension's main actionable groups (1 warning-level).
- Resolve the 1 Duplicated block (15 lines × 2) finding(s) in Code Duplication — start with functions.php. — One of this dimension's main actionable groups (1 warning-level).
- Enforce Code Duplication in CI to reach Verified (currently Documented). — Hardens enforcement from Documented toward Verified — provenance only; does not change the score.
Do you agree with this assessment?
D6 · Cohesion (LCOM4)
1 of 20 classes have LCOM4 above 3.
Low cohesion: Task (LCOM4 12)src/Task/Task.php:15
What to do
- Resolve the 1 Low cohesion finding(s) in Cohesion (LCOM4) — start with Task.php. — One of this dimension's main actionable groups (1 warning-level).
- Enforce Cohesion (LCOM4) in CI to reach Verified (currently Documented). — Hardens enforcement from Documented toward Verified — provenance only; does not change the score.
Do you agree with this assessment?
D9 · Test Distribution
289 test methods: 289 unit, 0 integration, 0 BDD, 0 e2e.
Do you agree with this assessment?
D10 · Test Quality
1 skipped (1 with a documented reason), 0 zero-assertion, no mocking-framework packages referenced (hand-written doubles or no mocking) across 289 tests.
Skipped (documented): testExtendDoesNotLeakWithFactoriestests/src/Component/Pimple/PimpleTest.php:232
Do you agree with this assessment?
D13 · Secret Scanning
Secret scan ran and found no leaked secrets.
Do you agree with this assessment?
D15 · Churn × Complexity Hotspots
No churn × complexity hotspots in the window.
Do you agree with this assessment?
D16 · Bus Factor
12 source file(s) have their living knowledge concentrated in one author (≥90% of recent, decayed contribution). The largest is src/Import/MamlRecipe.php. Counted over 70 of the 145 production source files in this repository: the rest are under the ~2,400-byte size floor this dimension measures over.
Off-boarding risk: anonymized user #1
Further sole-owners (lower concentration)
What to do
- Resolve the 1 Off-boarding risk finding(s) in Bus Factor. — One of this dimension's main actionable groups (1 recommendation-level).
- Resolve the 1 Further sole-owners (lower concentration) finding(s) in Bus Factor. — One of this dimension's main actionable groups (1 recommendation-level).
Do you agree with this assessment?
D17 · Explicit Debt
4 deducted task-comment markers across 15834 LoC (0.0/KLoC) → score 10.0. Task comments only: this repository's language is read without a compiler, so D17's suppression, dead-code and commented-out-code arms did not run and this score counts fewer marker kinds than a .NET repository's would.
TodoComment recipe/magento2.php:175
What to do
- Resolve the 4 TodoComment finding(s) in Explicit Debt — start with user.php (3), magento2.php. — One of this dimension's main actionable groups (4 warning-level).
- Enforce Explicit Debt in CI to reach Verified (currently Documented). — Hardens enforcement from Documented toward Prevented — provenance only; does not change the score.
Do you agree with this assessment?
D19 · Documentation Quality
The repository's documentation is comprehensive: the READMEs install, use, and contribute sections are all present (installation, project/installation, global/project installation, download Phar), plus a detailed architecture/design doc set (13 markdown docs covering MAML recipes, selectors, task config, YAML vs. MAML, validation). The outline lists every visible section for each document; the unshown sections do not carry penalty. All four categories are present and addressed: missing-overview is absent but the READMEs describe what they contain; missing-installation is fully covered by installation.md; missing-usage is covered by the shell commands in install/project/installation; missing-contributing is present (contribution guidance) and cited in the docs. (12 of 17 sampled documents could not be assessed: 1 of 2 evaluation groups failed.)
Do you agree with this assessment?
D20 · ADR Quality
No architecture decision records were found.
No ADRs found
What to do
- Resolve the 1 No ADRs found finding(s) in ADR Quality. — One of this dimension's main actionable groups (1 recommendation-level).
Do you agree with this assessment?
D21 · Naming Consistency
0 naming inconsistencies across 0 sampled symbols.
Do you agree with this assessment?
D26 · Project Cohesion
1 of 1 build units (Composer) flagged as possibly oversized/incoherent.
Projects may be oversized for their cohesion
What to do
- Resolve the 1 Projects may be oversized for their cohesion finding(s) in Project Cohesion. — One of this dimension's main actionable groups (1 recommendation-level).
Do you agree with this assessment?
D28 · Secrets (history)
gitleaks scanned the full history AND the current working tree and found no secrets.
Do you agree with this assessment?
D29 · Static Analysis (SAST)
semgrep found no security issues. semgrep hit a parse error in 2 file(s) — `src/Command/BlackjackCommand.php`, `src/Ssh/RunParams.php` (line 12, line 13, line 14, …) — so no absence of findings in the named regions is evidence of anything; rows reported elsewhere in those files are real. Fix the syntax error (or exclude the file deliberately) and re-scan to cover them.
Do you agree with this assessment?
D31 · IaC & Container Security
2 finding(s): 0 critical, 1 high, 1 medium, 0 low.
REDACTED
REDACTED
What to do
- Resolve the 1 High IaC finding(s) in IaC & Container Security — start with REDACTED. — One of this dimension's main actionable groups (1 issue-level).
- Resolve the 1 Medium IaC finding(s) in IaC & Container Security — start with REDACTED. — One of this dimension's main actionable groups (1 warning-level).
Do you agree with this assessment?
D34 · Knowledge Freshness
9 of 70 significant source file(s) are orphaned — their living knowledge has decayed to nothing, so no one currently understands them. The largest is recipe/codeigniter4.php. Counted over 70 of the 145 production source files in this repository: the rest are under the ~2,400-byte size floor this dimension measures over.
Orphaned file recipe/codeigniter4.php:1
Orphaned files with no living knowledge
What to do
- Resolve the 9 Orphaned file finding(s) in Knowledge Freshness — start with codeigniter4.php, supervisord-monitor.php, chatwork.php. — One of this dimension's main actionable groups (9 recommendation-level).
- Resolve the 1 Orphaned files with no living knowledge finding(s) in Knowledge Freshness. — One of this dimension's main actionable groups (1 recommendation-level).
Do you agree with this assessment?
D35 · Change Coupling
Strongest change-coupling: ProcessRunner.php↔SshClient.php 61%; WorkerCommand.php↔Master.php 56%; rsync.php↔SshClient.php 50%
Boundary-crossing change coupling: ProcessRunner.php ↔ SshClient.php src/ProcessRunner/ProcessRunner.php:1
What to do
- Resolve the 3 Boundary-crossing change coupling finding(s) in Change Coupling — start with ProcessRunner.php, WorkerCommand.php, rsync.php. — One of this dimension's main actionable groups (3 issue-level).
Do you agree with this assessment?
D36 · Supply-chain Provenance & Signing
3/4 supply-chain integrity signals present (provenance, signing, SBOM, pinned actions).
REDACTED
REDACTED
REDACTED
What to do
- Resolve the 1 REDACTED finding(s) in Supply-chain Provenance & Signing. — One of this dimension's main actionable groups (1 recommendation-level).
- Resolve the 1 REDACTED finding(s) in Supply-chain Provenance & Signing. — One of this dimension's main actionable groups (1 recommendation-level).
- Resolve the 1 REDACTED finding(s) in Supply-chain Provenance & Signing. — One of this dimension's main actionable groups (1 recommendation-level).
Do you agree with this assessment?
D37 · Vulnerability-disclosure Policy
A vulnerability-disclosure policy (SECURITY.md) is published with a reporting contact.
Do you agree with this assessment?
D44 · Platform End-of-Life
0 end-of-life runtime(s) and 0 end-of-life framework(s), read from 0 platform declaration(s) and 4 dependency declaration(s). This dimension reads what the repository says about ITSELF — a pinned target framework, a version file, a capped requires-python, a Rust toolchain pin, a framework major a constraint cannot move off. A FLOOR is deliberately never charged: `requires-python = ">=3.8"` states what the package SUPPORTS, not what it runs on, and a well-maintained library declares exactly that while running its own CI on a current release. The end-of-life facts are FROZEN and dated, so this dimension needs no network and answers identically inside a closed scan fence; as the table ages it loses recall and never precision, because a statement about support that ended in the past cannot become false. The OS layer of a container image is D31's question and the toolchain a CI workflow installs is D29's; this row is neither.
Do you agree with this assessment?
Frontend & cross-cutting dimensions
AX10 · Code composition
What to do
- The domain core is a small share of production code, but most of the rest matched no layer vocabulary at all — so this is not yet an anemic-domain finding. The namespace/path convention could not place that code, which makes the composition above a statement about the naming, not about the design. Name the layers (or check that the repository's conventions differ from the ones this check knows) before reading a thin domain into it.
Do you agree with this assessment?
AX3 · Project dependency cycles
Do you agree with this assessment?
AX4 · Dependency direction
Do you agree with this assessment?
M1 · Documentation (README)
- The root README is 93 words, against a bar of 120. Of the three newcomer-critical sections this check looks for by heading, it found no a build/run or getting-started section, no a testing section, no an architecture or project-map section. Sections are matched on HEADING text only, so material written under a heading this check does not recognise — or with no heading at all — is not seen and this row may understate what the document covers.
What to do
- Expand the README with getting-started, architecture overview and a project map.
- Add a build/run (quick start) section to the root README — the first thing a newcomer needs.
- Explain in the README how to run the tests. Add a section called Testing to the README in the repository's top folder, saying how to run the test suite.
- Add an 'Architecture' / 'How it works' section to the root README — the high-level shape.
Do you agree with this assessment?
M2 · Architecture documentation
- No Architecture Decision Records found — no conventional ADR directory, no numbered `NNNN-title` documents in any markup this check reads, and nothing ADR-shaped by content. Design rationale recorded elsewhere (a design-notes tree, a mailing list, pull-request discussion) is not visible to this check and is not re-findable per decision, so a future maintainer cannot ask why one choice was made and get an answer.
- No C4/Structurizr/PlantUML/Mermaid/Graphviz/D2 diagram, no drawn diagram named for the architecture, no file named `architecture` or `design` in any markup this check reads, and nothing in the README, docs or contributor guides that announces the shape — no `## Architecture` heading, no "architecture overview"/"high-level design" phrasing, no "the architecture is …" introduction, no guided code tour. A shape laid out in prose that never names itself as the architecture is not visible to this check, and neither is one kept outside the repository, so this row reports the absence of a re-findable shape document — not evidence that nobody wrote the shape down.
What to do
- Record your significant design decisions. Write one short document per decision, giving its date, the situation, the decision and its consequences, and keep them together with your other design documents. A docs/adr folder with each file named by number and title is the easiest place to find them.
- Add a C4 context/container diagram (Structurizr, PlantUML or Mermaid) or an architecture.md overview.
Do you agree with this assessment?
M3 · Folder & project structure
Do you agree with this assessment?
M4 · Documentation accuracy
- docs/avoid-php-fpm-reloading.md documents the environment variable `SCRIPT_FILENAME`, but no code, script or configuration file names it. Checked without a model against the repository: its files and folders, the scripts and dependencies of every package.json, the projects, namespaces, package references and target frameworks of the .NET build, the SDK and Node pins, and the identifiers of every file that is not a document; the documents' own text never counts. A footprint generated at build time, read only by a platform, or living outside this repository is not seen, and this row is then wrong. — docs/avoid-php-fpm-reloading.md:15
- docs/avoid-php-fpm-reloading.md documents the environment variable `DOCUMENT_ROOT`, but no code, script or configuration file names it. Checked without a model against the repository: its files and folders, the scripts and dependencies of every package.json, the projects, namespaces, package references and target frameworks of the .NET build, the SDK and Node pins, and the identifiers of every file that is not a document; the documents' own text never counts. A footprint generated at build time, read only by a platform, or living outside this repository is not seen, and this row is then wrong. — docs/avoid-php-fpm-reloading.md:30
- docs/ci-cd.md documents the environment variable `SSH_KNOWN_HOSTS`, but no code, script or configuration file names it. Checked without a model against the repository: its files and folders, the scripts and dependencies of every package.json, the projects, namespaces, package references and target frameworks of the .NET build, the SDK and Node pins, and the identifiers of every file that is not a document; the documents' own text never counts. A footprint generated at build time, read only by a platform, or living outside this repository is not seen, and this row is then wrong. — docs/ci-cd.md:49
- docs/ci-cd.md documents the environment variable `SSH_PRIVATE_KEY`, but no code, script or configuration file names it. Checked without a model against the repository: its files and folders, the scripts and dependencies of every package.json, the projects, namespaces, package references and target frameworks of the .NET build, the SDK and Node pins, and the identifiers of every file that is not a document; the documents' own text never counts. A footprint generated at build time, read only by a platform, or living outside this repository is not seen, and this row is then wrong. — docs/ci-cd.md:52
- docs/installation.md links to `/download`, but `download` does not exist. Checked without a model against the repository: its files and folders, the scripts and dependencies of every package.json, the projects, namespaces, package references and target frameworks of the .NET build, the SDK and Node pins, and the identifiers of every file that is not a document; the documents' own text never counts. A footprint generated at build time, read only by a platform, or living outside this repository is not seen, and this row is then wrong. — docs/installation.md:85
What to do
- Reconcile the README with reality: docs/avoid-php-fpm-reloading.md documents the environment variable `SCRIPT_FILENAME`, but no code, script or configuration file names it; docs/avoid-php-fpm-reloading.md documents the environment variable `DOCUMENT_ROOT`, but no code, script or configuration file names it; docs/ci-cd.md documents the environment variable `SSH_KNOWN_HOSTS`, but no code, script or configuration file names it; docs/ci-cd.md documents the environment variable `SSH_PRIVATE_KEY`, but no code, script or configuration file names it; docs/installation.md links to `/download`, but `download` does not exist.
Do you agree with this assessment?
P1 · CI/CD gates
Do you agree with this assessment?
P2 · Observability
- No logging or diagnostics emission found. This repository ships a binary its users launch rather than a service you operate, so there is no operator to page — but when a run fails on a user's machine, neither they nor you have anything to read.
What to do
- Write a diagnostic trail the user can hand back with a bug report: a log file under the platform's per-user data directory, switchable with a `--verbose`/`--debug` flag. Start with the error paths that emit nothing — a discarded error is the failure the user cannot describe and you cannot reproduce.
Do you agree with this assessment?
P3 · Security & performance tooling
What to do
- Enable Dependabot/Renovate or a dependency-review gate.
- Add gitleaks/trufflehog in CI to block PRs that introduce committed secrets.
Do you agree with this assessment?
P4 · Deployment & Rollback
- The release is automated and no gate that pauses it for a human is DECLARED IN THIS REPOSITORY'S PIPELINE FILES. What was read: every file under `.github/workflows/`, `.forgejo/workflows/`, `.gitea/workflows/`, `.azuredevops/` and `.azure-pipelines/`, plus `.gitlab-ci*` and `azure-pipelines*` — with comment text stripped, so documenting a gate is not declaring one. What would have counted: GitLab's `when: manual`, CircleCI's `type: approval`, an Azure `ManualValidation@` task or an `approvals:` block, a Jenkins `input` step, a `uses:` step naming an approval action, an `environment:` paired with `reviewers` / `required_reviewers` / `protection` / `wait-timer` / `deployment_branch_policy`, a draft-release step, a `workflow_dispatch` promotion, or a release-event gate. ★ What this cannot see, because none of it is a file: a GitHub environment whose required reviewers are configured in repo SETTINGS, a branch protection rule, or an organisation deployment policy — all of them real, enforced gates that live outside the repository. If yours is one of those, this row is wrong and nothing in the tree could have told us. Otherwise: whatever the release trigger points at is published to users unreviewed, so a mistagged or unverified commit ships and the only remedy is a follow-up release.
What to do
- Nothing pauses a release for a human: publish as a draft release (or gate the release job on a protected tag/manual dispatch) so a bad build can be stopped before users can download it.
Do you agree with this assessment?
P6 · Release Hygiene
- No CHANGELOG/HISTORY/RELEASES file — what shipped when isn't easy to reconstruct for support or audit. (Versioning/tagging makes releases traceable, but a changelog records the what.)
What to do
- Keep a changelog (e.g. Keep-a-Changelog) recording what shipped in each release.
Do you agree with this assessment?
X1 · Async correctness
Do you agree with this assessment?
X12 · Unreachable branch
Do you agree with this assessment?
X13 · Undrained process stream
Do you agree with this assessment?
X14 · Bypassable address classification
Do you agree with this assessment?
X15 · Unvalidated length from an untrusted reader
Do you agree with this assessment?
X16 · Unfloored truncation loop
Do you agree with this assessment?
X18 · Disposal-pattern correctness
Do you agree with this assessment?
X19 · Unrestored process-global state
Do you agree with this assessment?
X21 · Side-effecting pattern guard
Do you agree with this assessment?
X22 · Contradicted release guard
Do you agree with this assessment?
X23 · Unguarded diagnostic materialisation
Do you agree with this assessment?
X25 · Inert configuration knob
Do you agree with this assessment?
X28 · Index access outside its own emptiness guard
Do you agree with this assessment?
X29 · Per-element action decided by a fixed element
Do you agree with this assessment?
X3 · Exception handling
- `catch (\Throwable)` takes every exception and records none of it — the body neither logs it, rethrows it, nor even names it, so the failure is discarded as completely as by an empty catch and only the substituted value survives. Log it through whatever this codebase already uses to report problems, narrow the catch to the exception this call can actually raise, or say in a comment on the catch why the failure genuinely cannot matter. (×2) — recipe/deploy/release.php:182, src/Command/CommandCommon.php:37
What to do
- Swallowed exception (caught, then discarded)
Do you agree with this assessment?
X30 · Support guard that admits what it rejects
Do you agree with this assessment?
X5 · Nullable reference types
- 0/1 of this repository's PHPStan/Psalm configuration(s) run at a level that checks null — PHPStan level 8 or above (`max` included), or Psalm `errorLevel` 3 or below (Psalm's default, with none stated, is 1). A PHPStan level written neither in the file nor in an include inside the repository is 0, PHPStan's own default. Below those levels the checker removes `null` from a union before any rule looks, so `$order->customer()->name()` on a `?Customer` passes, and the first null reaching it is an `Error: Call to a member function name() on null` in production.
What to do
- Raise PHPStan to level 8 (`level: 8` in `phpstan.neon.dist`, or `max`) or Psalm to `errorLevel="3"` or stricter, so `?Type` is a type the checker holds you to; generate a baseline for what that surfaces only to pay it down, not to keep it. Then resolve the baselined nullness errors rather than adding to them: each is a call on a value the checker showed could be null — narrow it (`if ($x === null) { … }`, `?->`, an early return), make the property non-nullable and initialise it in the constructor, or change the return type so the null cannot arrive.
Do you agree with this assessment?
Reference — by lens
| Lens | Score | Rating | Impact |
|---|---|---|---|
| Code Health | 61% | Adequate — gated by X5 | Capped at Fair by a Critical contributor — resolve it before relying on this lens. |
| Architecture | 84% | Adequate — gated by D26 | Capped at Fair by a Critical contributor — resolve it before relying on this lens. |
| Maturity | 50% | Weak — gated by M2 | Capped at Fair by a Critical contributor — resolve it before relying on this lens. |
| Readiness | 44% | Weak — gated by P2 | Capped at Fair by a Critical contributor — resolve it before relying on this lens. |
| Security | 95% | Exemplary | Strongest area. |
Unscored — 2 check(s) recorded observations but carry no score
- P12 CI test-gate honesty — 1 observation(s) recorded · Reported, not scored — this card publishes what the CI gate does with the test inventory rather than grading it. The findings above are its output.
- X10 Duplicated predicate — 1 observation(s) recorded · Advisory — this card reports evidence and never carries a score.
Not evidenced — 1 control(s) we could not find positive evidence for
- P5 DR & Backup — not evidenced — repo shows no backup/RTO/RPO controls; absence of evidence is not evidence of a working control
Not included — 64 check(s) not relevant to this codebase
- AC1 Text alternatives — Frontend below the scale floor (12 DOM element(s) < 25) — too little surface to assess accessibility.
- AC2 Forms & labels — Frontend below the scale floor (12 DOM element(s) < 25) — too little surface to assess accessibility.
- AC3 Page structure — Frontend below the scale floor (12 DOM element(s) < 25) — too little surface to assess accessibility.
- AC4 Keyboard semantics — Frontend below the scale floor (12 DOM element(s) < 25) — too little surface to assess accessibility.
- AC5 ARIA correctness — Frontend below the scale floor (12 DOM element(s) < 25) — too little surface to assess accessibility.
- AC6 Visual & motion safety — Frontend below the scale floor (12 DOM element(s) < 25) — too little surface to assess accessibility.
- AC7 A11y enforcement — Frontend below the scale floor (12 DOM element(s) < 25) — too little surface to assess accessibility.
- AX1 Captive dependencies — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- AX2 Stateful singletons — Not applicable: PHP builds its object graph per request and shares none of it between requests.
- AX5 Architecture & structure — not assessed — architecture style/structure is computed from a project graph (projects, types, module namespaces) that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- AX6 Interface segregation — not assessed — interface segregation is computed over a type surface that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- AX7 Slice cohesion — not applicable — not a vertical-slice architecture
- AX8 Test isolation — no test/production split to check
- AX9 CQS / query purity — no CQRS query handlers detected — query purity is not applicable to this codebase
- AXB2 Runtime readiness — Advisory — this card reports evidence and never carries a score, so there is nothing missing here.
- AXR1 Runtime accessibility — docker build failed (exit 1) — DEPRECATED: The legacy builder is deprecated and will be removed in a future release. Install the buildx component to build images with BuildKit: https://docs.docker.com/go/bui…; runtime evidence skipped This is a statement about this run, not a statement about your application: nothing here says the surface is inaccessible, only that it was never rendered.
- C1 Data Protection — No personal data detected in a persisted data model — no PII-named field (email, first_name, date_of_birth, phone, …) or stored credential in a Laravel migration, an Eloquent $fillable/$hidden list or a Doctrine #[ORM\Column] property — and no database client (PDO, mysqli, Laravel's DB facade, $wpdb) in the source either, so this repository keeps no data at rest for these controls to protect.
- C2 Access Controls — No access-control surface detected in the analyzed source — this repository registers no route (no Laravel Route::…, no Symfony #[Route], no Filament panel, no WordPress REST route or AJAX action). Access control is therefore N/A here — a Composer library is authorized by the application that mounts it, not by itself. If this codebase grows request handlers, the dimension reactivates and a default-deny posture is expected then.
- C3 Audit Trail — No personal data detected in a persisted data model — no PII-named field (email, first_name, date_of_birth, phone_number, …) or stored credential in a Laravel migration, an Eloquent model's $fillable/$hidden list or a Doctrine #[ORM\Column] property — and no database client (PDO, mysqli, Laravel's DB facade, $wpdb) in the source either, so this repository keeps no sensitive data whose changes an audit trail would record. If it does (through a hosted backend configured outside this repository, for instance), the trail belongs to wherever that data is stored.
- C4 Data Retention — No personal data detected in a persisted data model — no PII-named field (email, first_name, date_of_birth, phone, …) or stored credential in a Laravel migration, an Eloquent $fillable/$hidden list or a Doctrine #[ORM\Column] property — and no database client (PDO, mysqli, Laravel's DB facade, $wpdb) in the source either, so this repository keeps no personal data whose lifetime a retention limit would bound.
- C5 Data-Subject Rights — No personal data detected in a persisted data model — no PII-named field (email, first_name, date_of_birth, phone, …) or stored credential in a Laravel migration, an Eloquent $fillable/$hidden list or a Doctrine #[ORM\Column] property — and no database client (PDO, mysqli, Laravel's DB facade, $wpdb) in the source either, so this repository keeps no personal data for a data subject to erase, export or consent over.
- D11 Test Reliability — Test reliability not included — no .php test runner
- D12 Dependency Hygiene — Not scored — 4 direct Composer requirement(s) were read, but the outdated signal needs Packagist, and no committed composer.lock resolves them to releases, so this dimension's own question is only partly answered. NOT a finding that these dependencies are current or healthy.
- D14 License Compliance — Composer package licences not graded — this repository commits no composer.lock and this pass does not run Composer's solver
- D18 Solution Shape — D18 scores the shape of a .NET solution; this repository has no .NET solution or project files, so the dimension does not apply.
- D22 Internal API Consistency — The exposed public-API surface could not be collected — no C#/VB projects loaded.
- D23 Boundary Type-Coupling — No bounded-context organisation was detected either — neither a context-shaped layout, nor 2+ sibling source directories each declaring an aggregate root, nor 2+ projects each declaring an entity of their own. Declaring this codebase's bounded contexts (≥2) would let cross-boundary type coupling be assessed. Declare them in `.codehealth/config.yaml` at the repository root (create it if absent), mapping each context name to the module-path or namespace prefixes that belong to it — e.g. `architecture:` → `contexts:` → `Billing: ["src/billing", "Acme.Billing"]`, `Catalog: ["src/catalog", "Acme.Catalog"]`.
- D24 Comment Value — No inline comments to assess — comment value is not applicable here.
- D25 ADR Conformance — no ADRs to check
- D27 Navigability — D27 counts a call into the standard library or a dependency as unresolved for this repository's language (.php), so too few call sites counted as resolved to assess navigability. Not scored: this is a gap in the analyzer, not a verdict about this repository.
- D30 Dependency Vulnerabilities — Not scored — no dependency manifest in a supported ecosystem was read for this repository. A gap in the analyzer's language coverage, NOT a finding that the repository is free of vulnerable dependencies (composer.json — not scanned yet).
- D32 Data Compliance (PII/GDPR) — 1 file(s) were not parsed by semgrep — the PII/GDPR ruleset never ran over them
- D39 IL Efficiency — D39 measures the IL emitted by a .NET build; this repository has no .NET solution or project files, so the dimension does not apply.
- D40 Network Egress Confinement — No Kubernetes/orchestration workloads found in the repository manifests; network egress policy is a cluster-native control that may live at the platform/firewall layer, so there is nothing to assess here.
- D41 Kernel & Syscall Confinement — No Kubernetes/orchestration workloads found in the repository manifests; seccomp/AppArmor/SELinux confinement is a workload-level control, so there is nothing to assess here.
- D42 Runtime Threat Enforcement — No Kubernetes/orchestration workloads found in the repository manifests; runtime threat-detection and admission-control policy are cluster-level controls, so there is nothing to assess here.
- D43 Malicious Dependencies — Not scored — no dependency manifest in a supported ecosystem was read for this repository. A gap in the analyzer's language coverage, NOT a finding that the repository is free of vulnerable dependencies (composer.json — not scanned yet).
- D5 Coupling — Not applicable — this Composer build ships 1 production module(s), so there is no coupling BETWEEN modules to measure. (Its test and non-production modules are not part of the shipped graph.)
- D7 Architectural Integrity — no checkable ADRs, and no project-reference graph for the cycle pass to read — so this dimension makes no claim about dependency cycles in either direction (where this repository's language has an import-cycle lens, cycles are reported there). Architectural integrity not assessed
- D8 Code Coverage — Coverage not included — suite not readable by the collector
- DM1 Domain Modelling — not scored — this repository shows none of the 3 signals this lens looks for
- ED1 Event-Driven — not scored — this repository shows none of the 3 signals this lens looks for
- ED5 Idempotency — no mutating command handlers or message consumers detected — idempotency check not applicable
- ES1 Event Sourcing — not scored — this repository shows none of the 3 signals this lens looks for
- GD1 Unfinished & placeholder code — no source files were read — this check reads C#, F#, JavaScript/TypeScript, Dart, Ruby and Scala, and none was read for this repository's product. That is a limit of the analyzer, not a finding about your code.
- IC1 Incompleteness & stubs — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- P7 Outbound HTTP resilience — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- P8 Schema migrations — no ORM, schema-migration tool or schema auto-create was found in this repository's dependency manifests or source, so there is no database schema for this check to judge
- P9 Domain vs controller coverage — no coverage report found on disk — produce a coverage report in a standard format (Clover XML — with Xdebug (`XDEBUG_MODE=coverage`) or PCOV installed, `vendor/bin/phpunit --coverage-clover coverage.xml`) and commit it — a hosted scan measures a clone of the repository, so a report that exists only in a working tree, a CI runner's or your own, never reaches it; the artefact is commonly gitignored, so `git add -f` that one file (or un-ignore its path) and commit it alongside the code it measures, or wire coverage collection into CI, to enable this cross-layer check
- PF1 Benchmark discipline — Not applicable: no benchmark suite was found. This check searched for PHPBench subjects (`bench*` methods, or `@Subject`/`#[Subject]` ones) in a file importing PhpBench or carrying its annotations, `bench*` methods in a `*Bench.php` file where PHPBench is installed, or phpbench/phpbench in a composer.json or a phpbench.json, and for a `*benchmark*` script that this repository's CI runs. Benchmarks are credited as a bonus, so their absence is neither scored nor deducted.
- PF2 Allocation hygiene — Not applicable: PHP runs on a garbage-collected runtime that gives a program no allocation-control idiom to choose on a hot path — no pools, stack allocation or value types — so allocation awareness is not something this code can be rated on.
- PF3 Async & latency hygiene — Not applicable: PHP has no async/await function colour, so there is no asynchronous code for a blocking call to stall.
- S1 Web-Security Posture — Not assessed: these web-security controls are read from a source model (declarative annotations, request middleware, entity/column names, guard methods) that was not loaded for this repository — because the repository is written in a language this check does not yet model, or because its projects failed to load. Absence of an idiom this check recognises is NOT evidence that this repository lacks web-security controls: it may implement them entirely in its own ecosystem. This is a gap in the analyzer's language coverage, not a finding about this repository.
- X17 Uncapped recursion over a caller-supplied document — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X2 Cancellation propagation — no C# was loaded; this repository's PHP was read and makes no request a caller can cancel (amphp's HttpClient or connect) — synchronous PHP offers its callers no cancellation to take
- X20 Mistyped argument guard — This check asks whether an argument guard reports an EMPTY value as a NULL one, which needs a language that throws a null-specific argument exception — .NET's ArgumentNullException, the JVM's NullPointerException, Dart's ArgumentError.notNull. This repository contains none of those languages: the ones it is written in have a single exception for a bad argument, so there is no pair of exceptions to confuse and nothing here for it to assess. Not a gap in the analyzer and not a finding about your code.
- X24 Document value interpolated into markup unescaped — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X26 Unsynchronised callback handoff — Not applicable: this check looks for a collection written by a callback on one thread while the body waiting on it touches it on another, and in this repository's languages no collection is reachable from two threads at once. PHP gives a request one thread of its own; the event-loop libraries (ReactPHP, Amp) run callbacks one at a time, and ext-parallel copies every value across its channels, so no array or collection is reachable from two threads at once. TypeScript/JavaScript runs every callback on the one thread that owns its objects: a callback runs only when the body waiting on it has yielded, never alongside it, and a worker thread receives a COPY of what it is sent. A SharedArrayBuffer carries raw bytes, never an Array, Map or Set, so no collection is reachable from two threads at once. Not a gap in the analyzer and not a finding about your code.
- X27 Collection changed while being enumerated — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X32 Type resolved by simple name across every loaded assembly — This check is about how a .NET program searches the assemblies loaded into its process for a type, and this repository contains no .NET source, so there is nothing here for it to assess. Not a gap in the analyzer and not a finding about your code.
- X4 Structured logging — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X6 Hand-rolled structured-format parsing — Advisory — this card reports evidence and never carries a score, so there is nothing missing here.
- X7 Silent fallback defaults — Advisory — this card reports evidence and never carries a score, so there is nothing missing here.
- X9 Subsumed condition operand — Advisory — this card reports evidence and never carries a score, so there is nothing missing here.
Appendix A — Findings (grouped)
Critical — 4 finding(s)
D35 · Change Coupling
- Boundary-crossing change coupling: ProcessRunner.php ↔ SshClient.php src/ProcessRunner/ProcessRunner.php:1
- Boundary-crossing change coupling: WorkerCommand.php ↔ Master.php src/Command/WorkerCommand.php:1
- Boundary-crossing change coupling: rsync.php ↔ SshClient.php contrib/rsync.php:1
D31 · IaC & Container Security
- REDACTED
Serious — 47 finding(s)
D17 · Explicit Debt
- TodoComment recipe/magento2.php:175
- TodoComment recipe/provision/user.php:17
- TodoComment recipe/provision/user.php:18
- TodoComment recipe/provision/user.php:19
D3 · God Classes
- MethodTooLong: DocGen.gen src/Documentation/DocGen.php:48
- MethodTooLong: BlackjackCommand.execute src/Command/BlackjackCommand.php:41
- MethodTooLong: DocRecipe.parse src/Documentation/DocRecipe.php:49
D3 · God Classes
- TooManyMethods: functions src/functions.php:1
- TooManyMethods: Host src/Host/Host.php:22
D4 · Code Duplication
- Duplicated block (10 lines × 2) src/Import/MamlRecipe.php:416
- Duplicated block (10 lines × 2) src/functions.php:922
X3 · Exception handling
- Swallowed exception (caught, then discarded) recipe/deploy/release.php:182
- Swallowed exception (caught, then discarded) src/Command/CommandCommon.php:37
D1 · Cyclomatic Complexity
- DocGen.gen (cyclomatic 49) src/Documentation/DocGen.php:48
D1 · Cyclomatic Complexity
- BlackjackCommand.execute (cyclomatic 30) src/Command/BlackjackCommand.php:41
D1 · Cyclomatic Complexity
- Master.run (cyclomatic 26) src/Executor/Master.php:59
D1 · Cyclomatic Complexity
- DocRecipe.parse (cyclomatic 25) src/Documentation/DocRecipe.php:49
D1 · Cyclomatic Complexity
- Rsync.call (cyclomatic 22) src/Utility/Rsync.php:43
D1 · Cyclomatic Complexity
- MamlRecipe.createTask (cyclomatic 19) src/Import/MamlRecipe.php:297
D1 · Cyclomatic Complexity
- YamlRecipe.tasks (cyclomatic 18) src/Import/YamlRecipe.php:79
D1 · Cyclomatic Complexity
- Master.runTask (cyclomatic 17) src/Executor/Master.php:148
D1 · Cyclomatic Complexity
- MainCommand.execute (cyclomatic 16) src/Command/MainCommand.php:88
D2 · Cognitive Complexity
- DocGen.gen (cognitive 137) src/Documentation/DocGen.php:48
D2 · Cognitive Complexity
- Master.run (cognitive 77) src/Executor/Master.php:59
D2 · Cognitive Complexity
- DocRecipe.parse (cognitive 67) src/Documentation/DocRecipe.php:49
D2 · Cognitive Complexity
- YamlRecipe.tasks (cognitive 38) src/Import/YamlRecipe.php:79
D2 · Cognitive Complexity
- Logger.renderException (cognitive 35) src/Logger/Logger.php:113
D2 · Cognitive Complexity
- BlackjackCommand.execute (cognitive 34) src/Command/BlackjackCommand.php:41
D2 · Cognitive Complexity
- MamlRecipe.createTask (cognitive 32) src/Import/MamlRecipe.php:297
D2 · Cognitive Complexity
- Rsync.call (cognitive 32) src/Utility/Rsync.php:43
D2 · Cognitive Complexity
- ApiGen.parse (cognitive 31) src/Documentation/ApiGen.php:20
D2 · Cognitive Complexity
- Server.handleClientRequests (cognitive 21) src/Executor/Server.php:145
D2 · Cognitive Complexity
- MainCommand.execute (cognitive 20) src/Command/MainCommand.php:88
D2 · Cognitive Complexity
- TreeCommand.createTreeFromTaskName (cognitive 19) src/Command/TreeCommand.php:78
D2 · Cognitive Complexity
- Deployer.run (cognitive 18) src/Deployer.php:234
D2 · Cognitive Complexity
- Master.runTask (cognitive 18) src/Executor/Master.php:148
D2 · Cognitive Complexity
- SshClient.run (cognitive 18) src/Ssh/SshClient.php:35
D2 · Cognitive Complexity
- ScriptManager.getTasks (cognitive 17) src/Task/ScriptManager.php:42
D2 · Cognitive Complexity
- ScriptManager.doGetTasks (cognitive 17) src/Task/ScriptManager.php:81
D2 · Cognitive Complexity
- MamlRecipe.hosts (cognitive 16) src/Import/MamlRecipe.php:248
D2 · Cognitive Complexity
- IOArguments.collect (cognitive 16) src/Ssh/IOArguments.php:19
D31 · IaC & Container Security
- REDACTED
D4 · Code Duplication
- Duplicated block (16 lines × 2) src/Import/YamlRecipe.php:106
D4 · Code Duplication
- Duplicated block (15 lines × 2) src/functions.php:913
D6 · Cohesion (LCOM4)
- Low cohesion: Task (LCOM4 12) src/Task/Task.php:15
P12 · CI test-gate honesty
- Coverage collected but not gated
P2 · Observability
- No structured logging
Minor — 29 finding(s)
D34 · Knowledge Freshness
- Orphaned file recipe/codeigniter4.php:1
- Orphaned file contrib/supervisord-monitor.php:1
- Orphaned file contrib/chatwork.php:1
- Orphaned file contrib/crontab.php:1
- Orphaned file recipe/spiral.php:1
- Orphaned file contrib/ntfy.php:1
- Orphaned file recipe/contao.php:1
- Orphaned file recipe/craftcms.php:1
- Orphaned file recipe/statamic.php:1
M4 · Documentation accuracy
- README/code drift docs/avoid-php-fpm-reloading.md:15
- README/code drift docs/avoid-php-fpm-reloading.md:30
- README/code drift docs/ci-cd.md:49
- README/code drift docs/ci-cd.md:52
- README/code drift docs/installation.md:85
D16 · Bus Factor
- Off-boarding risk: anonymized user #1
D16 · Bus Factor
- Further sole-owners (lower concentration)
D20 · ADR Quality
- No ADRs found
D26 · Project Cohesion
- Projects may be oversized for their cohesion
D34 · Knowledge Freshness
- Orphaned files with no living knowledge
D36 · Supply-chain Provenance & Signing
- REDACTED
D36 · Supply-chain Provenance & Signing
- REDACTED
D36 · Supply-chain Provenance & Signing
- REDACTED
M1 · Documentation (README)
- Thin README
M2 · Architecture documentation
- No ADRs
M2 · Architecture documentation
- No architecture diagram/doc
P4 · Deployment & Rollback
- No release approval gate
P6 · Release Hygiene
- No changelog
X10 · Duplicated predicate
- Duplicated predicate src/Ssh/SshClient.php:39
X5 · Nullable reference types
- PHP static analysis does not check null everywhere
Minor — 1 finding(s)
D10 · Test Quality
- Skipped (documented): testExtendDoesNotLeakWithFactories tests/src/Component/Pimple/PimpleTest.php:232
Appendix B — Reproduction & audit trail
| Dimension | Tool | Version | Command | Findings | Raw output |
|---|---|---|---|---|---|
| D28 · Secrets (history) | gitleaks | — | gitleaks detect --no-banner --config /opt/gitleaks-rules/watchdog-gitleaks.toml --report-format json --report-path /tmp/watchdog-gitleaks-45654b989ee647adb4763e8427fadc51/history.json --exit-code 0 --source . | 0 | artifacts/raw/gitleaks-history.json |
| D28 · Secrets (history) | gitleaks | — | gitleaks detect --no-git --no-banner --config /opt/gitleaks-rules/watchdog-gitleaks.toml --report-format json --report-path /tmp/watchdog-gitleaks-45654b989ee647adb4763e8427fadc51/tree.json --exit-code 0 --source . | 0 | artifacts/raw/gitleaks-tree.json |
| D29 · Static Analysis (SAST) | semgrep | — | semgrep --config /opt/semgrep-rules/security-audit.yml --config /opt/semgrep-rules/owasp-top-ten.yml --config /opt/semgrep-rules/watchdog-sast.yml --json --quiet --timeout 10 --timeout-threshold 3 --metrics off . | 0 | artifacts/raw/semgrep.json |
| D30 · Dependency Vulnerabilities | none (dependency manifest found, not scanned for vulnerabilities here) | — | none (dependency manifest found, not scanned for vulnerabilities here): not applicable — Not scored — no dependency manifest in a supported ecosystem was read for this repository. A gap in the analyzer's language coverage, NOT a finding that the repository is free of vulnerable dependencies (composer.json — not scanned yet). | 0 | — |
| D31 · IaC & Container Security | trivy | — | trivy config --format json --quiet . | 2 | artifacts/raw/trivy-config.json |
| D32 · Data Compliance (PII/GDPR) | semgrep | — | semgrep: not applicable — No personal data was found crossing a boundary the PII/GDPR ruleset checks — nothing written to a log or console sink, placed in a URL or query string, or persisted to browser storage. That is a clean result for the LEAK surface only: this ruleset detects personal data escaping, it does not inventory the personal data a repository holds, so it is not evidence that this repository has no personal-data surface. The personal-data map (Appendix C) and the C1-C5 compliance cards are what speak to that. semgrep could not parse 1 file(s) — `src/Ssh/RunParams.php` — so the PII/GDPR sweep did not cover the unparsed regions of them; rows reported elsewhere in those files are real. | 0 | — |
| D40 · Network Egress Confinement | runtime-hardening | — | runtime-hardening: not applicable — No Kubernetes/orchestration workloads found in the repository manifests; network egress policy is a cluster-native control that may live at the platform/firewall layer, so there is nothing to assess here. | 0 | — |
| D41 · Kernel & Syscall Confinement | runtime-hardening | — | runtime-hardening: not applicable — No Kubernetes/orchestration workloads found in the repository manifests; seccomp/AppArmor/SELinux confinement is a workload-level control, so there is nothing to assess here. | 0 | — |
| D42 · Runtime Threat Enforcement | runtime-hardening | — | runtime-hardening: not applicable — No Kubernetes/orchestration workloads found in the repository manifests; runtime threat-detection and admission-control policy are cluster-level controls, so there is nothing to assess here. | 0 | — |
| D43 · Malicious Dependencies | none (dependency manifest found, not scanned for vulnerabilities here) | — | none (dependency manifest found, not scanned for vulnerabilities here): not applicable — Not scored — no dependency manifest in a supported ecosystem was read for this repository. A gap in the analyzer's language coverage, NOT a finding that the repository is free of vulnerable dependencies (composer.json — not scanned yet). | 0 | — |