Executive summary
This system presents a fragile foundation for growth, scoring 44% overall. While the code itself is clean and well-structured, the underlying operational model is critically misaligned with modern reliability standards. The business risk here is not in the logic, but in how the system behaves under load, creating a high probability of service degradation that could disrupt customer experiences.
The asset is small, comprising roughly 14,500 lines of production code, with a rebuild cost of approximately €20,000. This low barrier to entry means the value at stake is manageable, but the current architecture creates unnecessary friction. The system relies heavily on synchronous communication patterns that introduce latency and potential deadlocks, directly impacting delivery speed and system stability. Rebuilding is cheap, but the cost of downtime and delayed features is high.
The primary theme is operational fragility. The event-driven architecture scores a mere 27%, indicating that the system struggles to handle asynchronous workloads efficiently. This leads to blocking behaviors where processes wait for each other, causing cascading failures and unpredictable response times. For the business, this translates to inconsistent service availability and increased support costs during peak usage. The second theme is observability gaps. With a readiness score of 41%, the system lacks the necessary monitoring and recovery controls to ensure safe operation. Without clear visibility into backup and recovery procedures, the organization faces significant security and compliance exposure in the event of a failure.
On the positive side, the code health is excellent at 95%, and the architecture is sound at 97%. This indicates that the core logic is maintainable and well-designed, providing a solid base for future improvements. The maturity level is also respectable at 76%, suggesting that the team has a good understanding of the system.
Focus first on decoupling synchronous interactions. Removing blocking calls and implementing asynchronous patterns will immediately reduce latency and improve reliability. This single change offers the highest return on effort, stabilizing the system without requiring a full rewrite. Addressing this will mitigate the most critical risks and lay the groundwork for further enhancements.
Code Health
95% ★
Exemplary
Architecture
97% ★
Exemplary
Maturity
76%
Strong
Readiness
41%
Weak · gated by P5, P7
Security
66%
Adequate · gated by D29, D36
Event-Driven
27%
Weak · gated by ED1
How the score is built — each lens's share of the headline
Width is the lens's weight in the worst-heaviest fold (the weakest area pulls hardest); colour is that lens's own band. A lens fixes the score in proportion to its width.
Event-Driven 27% · 46% weightReadiness 41% · 25% weightSecurity 66% · 14% weightMaturity 76% · 8% weightCode Health 95% · 4% weightArchitecture 97% · 2% weight
Raise Event-Driven 27 → 70 (the Healthy floor) ⇒ headline 44 → ~58.
Code composition — where the lines go
Tests 100%
New since the last scan (18+)
- D12 · Floating source dependency: clique
- D12 · Floating source dependency: grpcbox
- D12 · Floating source dependency: helium_proto
- D12 · Floating source dependency: erlang_lorawan
- D12 · Floating source dependency: enacl
- D12 · Floating source dependency: xxhash
- D12 · Floating source dependency: erl_angry_purple_tiger
- D12 · Floating source dependency: h3
- D29 · REDACTED
- D29 · REDACTED
- D29 · REDACTED
- D29 · REDACTED
- D29 · REDACTED
- D29 · REDACTED
- D29 · REDACTED
- D30 · REDACTED
- P7 · Outbound HTTP without resilience src/protocols/http/hpr_http_roaming_downlink_stream_worker.erl
- P7 · Outbound HTTP without resilience src/protocols/http/hpr_http_roaming_worker.erl
Rebuild cost & value ~ Modeled — €6,600–€33,000
| Cost to rebuild | €6,600–€33,000 |
|---|---|
| Domain complexity | Standard |
| Quality factor | 0.7× (at 44% quality) |
| Size & shape | Small · effort split not classified (source measured from disk; the effort-tier breakdown is a C#-only syntax walk) |
This codebase represents roughly ~0.1 person-years of build effort (about ~€20,000 to rebuild). Its weakest lens is Event-Driven at 27% — the part of that asset most exposed by the findings below.
Top priorities
1
Remove synchronous peer round-trips (gen_server:call / hand-rolled receive) and blocking sleeps from OTP message handlers — cast a follow-up or resolve state locally, so processes stay temporally decoupled and deadlock-free.
2
Resolve the 8 Floating source dependency finding(s) in Dependency Hygiene.
3
Enable Dependabot/Renovate or a dependency-review gate.
Diagnosis — what's actually going on
Value concentrated against a weak lens
This is a Small asset (~0.1 person-years to rebuild), and its weakest lens is Event-Driven at 27%. The operational and business risk on an asset this size concentrates there — that's where remediation buys the most protection.
Highest-leverage move
Of everything flagged, the best return on effort is: Remove synchronous peer round-trips (gen_server:call / hand-rolled receive) and blocking sleeps from OTP message handlers — cast a follow-up or resolve state locally, so processes stay temporally decoupled and deadlock-free. The rest can wait behind it.
At a glance — Code Health
The Good
At a glance — Architecture
The Good
At a glance — Maturity
The Good
The Ugly
At a glance — Readiness
The Good
The Bad
The Ugly
At a glance — Security
The Good
At a glance — Event-Driven
Security & Compliance — OWASP Top-10 mapping
| OWASP category | Findings | Severity |
|---|---|---|
| A03:2021 — Injection | 11 | High / Critical |
| A05:2021 — Security Misconfiguration | 9 | High / Critical |
| A06:2021 — Vulnerable & Outdated Components | 1 | High / Critical |
Roadmap
First, eliminate synchronous blocking and temporal coupling in OTP handlers to prevent deadlocks and ensure processes remain decoupled. Second, enable automated dependency review and security scanning tools to strengthen the codebase's security posture. Third, establish clear documentation linking this repository to the operational backup and disaster recovery controls for production data. Fourth, enforce explicit timeouts and circuit breakers on all outbound HTTP requests to improve resilience. Finally, maintain a changelog to track release history and improve release hygiene.
| Do this | Helps | Effort | Dimension |
|---|---|---|---|
| Remove synchronous peer round-trips (gen_server:call / hand-rolled receive) and blocking sleeps from OTP message handlers — cast a follow-up or resolve state locally, so processes stay temporally decoupled and deadlock-free. | +16.0 pts | Medium | Handler temporal coupling |
| Resolve the 8 Floating source dependency finding(s) in Dependency Hygiene. | +5.3 pts | Low | Dependency Hygiene |
| Enable Dependabot/Renovate or a dependency-review gate. | +9.4 pts | Medium | Security & performance tooling |
| Point at where production persistence is operated — a link from this repo to the ops/platform repo that holds its backup, geo-recovery and RTO/RPO controls — so the DR posture is reviewable from here; the dev-stack volume is not the thing to protect. | +9.4 pts | Medium | DR & Backup |
| Pass an explicit bound on every request — `{timeout, Ms}` in `httpc:request/4`'s HTTP options (its default is `infinity`), `{recv_timeout, Ms}` for hackney, a timeout on `gun:await/3` — and wrap dependencies that fail in a breaker (`fuse`) with back-off (`backoff`). | +9.4 pts | Medium | Outbound HTTP resilience |
| Keep a changelog (e.g. Keep-a-Changelog) recording what shipped in each release. | +9.0 pts | Medium | Release Hygiene |
| Resolve the 1 No ADRs found finding(s) in ADR Quality. | +1.6 pts | Low | ADR Quality |
| Resolve the 7 REDACTED finding(s) in Static Analysis (SAST) — start with REDACTED (7). | +1.3 pts | Low | Static Analysis (SAST) |
File quality
| File | Score | Band | Worst signal |
|---|---|---|---|
| REDACTED | 2.3 | Slop | Static Analysis (SAST): High: REDACTED |
| REDACTED | 2.7 | Slop | IaC & Container Security: High IaC: REDACTED |
| REDACTED | 4.1 | Mixed | IaC & Container Security: High IaC: REDACTED |
| src/protocols/http/hpr_http_roaming_downlink_stream_worker.erl | 6.7 | Mixed | Explicit Debt: TodoComment |
| src/grpc/packet_router/hpr_packet_up.erl | 6.7 | Mixed | Explicit Debt: TodoComment |
| REDACTED | 6.9 | Mixed | IaC & Container Security: Medium IaC: REDACTED |
| src/cli/hpr_cli_config.erl | 7.1 | Mixed | God Classes: FileTooLong: cli/hpr_cli_config.erl |
| src/grpc/iot_config/hpr_devaddr_range_storage.erl | 7.2 | Mixed | God Classes: FileTooLong: iot_config/hpr_devaddr_range_storage.erl |
| REDACTED | 7.2 | Mixed | Static Analysis (SAST): High: REDACTED |
| REDACTED | 7.2 | Mixed | Dependency Vulnerabilities: High CVE: REDACTED |
| src/hpr_packet_reporter.erl | 7.3 | Mixed | Explicit Debt: XxxComment |
| src/protocols/http/hpr_http_roaming.erl | 7.4 | Mixed | God Classes: FileTooLong: http/hpr_http_roaming.erl |
| src/grpc/iot_config/hpr_route_stream_worker.erl | 7.8 | Mixed | God Classes: FileTooLong: iot_config/hpr_route_stream_worker.erl |
| src/protocols/gwmp/hpr_gwmp_worker.erl | 8.2 | Near-clean | Explicit Debt: TodoComment |
| test/hpr_protocol_http_roaming_packet_SUITE.erl | 8.2 | Near-clean | Explicit Debt: TodoComment |
| src/protocols/hpr_protocol_router.erl | 8.5 | Near-clean | Cyclomatic Complexity: hpr_protocol_router.get_stream (cyclomatic 19) |
| src/protocols/http/hpr_http_roaming_worker.erl | 8.5 | Near-clean | Cognitive Complexity: hpr_http_roaming_worker.send_data (cognitive 16) |
| src/hpr_routing.erl | 8.5 | Near-clean | God Classes: FileTooLong: src/hpr_routing.erl |
| src/hpr_multi_buy.erl | 8.5 | Near-clean | God Classes: FileTooLong: src/hpr_multi_buy.erl |
| src/grpc/iot_config/hpr_route_ets.erl | 8.5 | Near-clean | God Classes: FileTooLong: iot_config/hpr_route_ets.erl |
How the grades work
Critical — 15
A definite problem that already costs you something and drags the score down: a missing authorisation check, a dependency with a known exploit, a build that does not reproduce. Failure here tends to cause failures elsewhere.
Serious — 54
Likely wrong, but not failing yet. It degrades the codebase over a longer horizon and can cause failures elsewhere — not urgent this week, not something to carry for two years either.
Minor — 13
Recorded, with no effect on how the codebase functions. Present so the survey is complete, not because it needs doing.
Could not be resolved — 36
Something this survey could not settle from the outside, and which could be critical or serious. Either a control was required and no positive evidence of it exists in the repository — a backup job that nothing shows was ever restored from proves nothing about restores — or our own analysis could not run over that part of the tree. This is not a clean result. These are excluded from the score rather than awarded a pass, so the number on the cover neither rewards nor penalises them: if you act on this survey without resolving them, you carry that risk yourself. Each one is named under Limitations.
Methodology & how to trust this report
Watchdog is a deep, periodic assessment — run each sprint, monthly, or quarterly, taking the time to go wider and deeper than a quick check and surfacing in one coherent report what you'd otherwise piece together from a dozen separate tools. It scores deterministically: the same commit yields the same score, every run. 37 of 40 evaluated dimensions are computed purely by tools and static analysis (confidence 1.0); 3 documentation/naming judgement(s) are LLM-assisted and labelled advisory. Overall confidence is 0.9 — the weighted average across measured dimensions; it falls as more of the score leans on LLM-assisted judgement and rises when it's fully tool-backed.
What we checked — 40 dimensions across the health lenses
D1D2D3D4D6D12D13D14D15D16D17D19D20D21D26D28D29D30D31D34D35D36D43AX10AX3AX4AX9ED1M1M2M3M4P1P2P3P4P5P6P7X28
How to trust any code-health report — three questions
- Can you open the finding? Real findings cite a repo-relative file and line you can open at the cited line — never an absolute scratch path. Here, 58 of 82 do; the remainder are repo-wide signals — a dimension-level measurement, not a single line.
- Is there a tool behind the number? Every score below names the method that produced it — Roslyn, git, a scanner, or (for a handful of documentation/naming dimensions) an LLM labelled sampled · advisory — not a narrative.
- Does re-running give the same result? Run it again on the same commit and the score — and this report, byte for byte — is identical. A report whose numbers move between runs is describing the run, not the code.
Tools & methods
| Method | Backs | Version | Evaluator |
|---|---|---|---|
| Roslyn static analysis | Complexity, cohesion, coupling, dead code, API surface, layering | 5.3.0 | ✓ deterministic |
| Native secret scanner | Hardcoded secrets / credentials | 1.0.0 | ✓ deterministic |
| Watchdog duplication detector (in-process) | Code duplication | 1.0.0 | ✓ deterministic |
| Coverage (coverlet / dotnet-coverage) | Line & branch coverage | 10.0.400 | ✓ deterministic |
| NuGet / dotnet | Outdated, vulnerable & deprecated dependencies | 10.0.400 | ✓ deterministic |
| git / LibGit2Sharp | Churn hotspots, knowledge concentration, history | 2.43.0 · 0.31.0 | ✓ deterministic |
| gitleaks · semgrep · trivy · checkov | Secrets in history, SAST, CVEs, IaC & container, PII / GDPR | 1.86.0 · 0.69.3 · 3.2.533 | ✓ deterministic |
| LLM (sampled · advisory) | Documentation quality, ADR conformance, naming — sampled over a bounded sample; advisory, never a deterministic measurement | Local LLM | ◐ LLM · sampled · advisory |
Run transparency — what happened this run
- D8 Code Coverage — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. Coverage NOT MEASURED: test source is present (.erl) but the built-in coverage collector has no runner for this repository's ecosystem — so this suite was never executed by it. Not scored — this is a gap in the analyzer's language coverage, not a defect in the repo. To have real coverage read, produce a coverage report in a standard format (`rebar3 do eunit --cover, cover` (or covertool for Cobertura XML)) and commit it — a hosted scan measures a clone of the repository, so a report that exists only in a working tree, a CI runner's or your own, never reaches it; the artefact is commonly gitignored, so `git add -f` that one file (or un-ignore its path) and commit it alongside the code it measures. You can widen what we reach: optional: produce a coverage report in a standard format (`rebar3 do eunit --cover, cover` (or covertool for Cobertura XML)) and commit it — a hosted scan measures a clone of the repository, so a report that exists only in a working tree, a CI runner's or your own, never reaches it; the artefact is commonly gitignored, so `git add -f` that one file (or un-ignore its path) and commit it alongside the code it measures — then the real number is read on the next scan.
- D11 Test Reliability — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. Test source is present (.erl) and this repository declares a rebar3 project (repository root, 37 test files, 13 Common Test suites), but it was not re-run: the analyzer environment could not run it. Not scored — this is a gap in the analyzer's language coverage, not a finding about this repository.
- D22 Internal API Consistency — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. D22 identifies the intentionally-exposed surface from `IsPackable` and `.Contracts` project names, MSBuild conventions read off the loaded project set. This target exposed no such projects, so the probe never ran; this says nothing about whether the repository has a public API. This repository commits no C#/VB source at all, so there was never an MSBuild project set to read these conventions off. That is OUR side and it is a COLLECTOR gap, not an environment fault: it declares a published package (src/hpr.app.src), but no published-package marker D22 reads admitted any project here, so this ecosystem's public API has no collector, and the remedy is to write one — no change to the scan image can close it.
- D44 Platform End-of-Life — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This dimension reads a project's own statement about the platform it runs on: a TargetFramework in a .NET project file, a .nvmrc or .python-version, a capped requires-python, a Rust toolchain file or Cargo.toml rust-version, a .go-version, .java-version, .ruby-version, .tool-versions or .sdkmanrc, a go.mod go directive, a Maven or Gradle Java level or toolchain, a Gemfile's ruby directive, a mix.exs elixir requirement, a rebar.config minimum_otp_vsn, a pubspec.yaml SDK constraint, a build.sbt scalaVersion, or a framework major pinned by a dependency constraint. This repository carries none of them, so nothing about its platform was established. That is a gap in this analyzer's coverage, NOT a finding that the platform is supported — a language whose runtime is declared elsewhere (Package.swift, a REDACTED) is simply not read here yet.
- AX6 Interface segregation — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check is computed over the public interfaces this run's compilations declare, and none was loaded, so it had nothing to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- C1 Data Protection — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. These personal data controls are read from declarative annotations, request middleware, entity/column names and guard methods in a C# source model, and none was loaded on this run, so there was nothing to gather. That is a gap in this analyzer's language reach — not a finding that the repository lacks personal data controls.
- C2 Access Controls — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. These authorization controls are read from declarative annotations, request middleware, entity/column names and guard methods in a C# source model, and none was loaded on this run, so there was nothing to gather. That is a gap in this analyzer's language reach — not a finding that the repository lacks authorization controls.
- C3 Audit Trail — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. These audit controls are read from declarative annotations, request middleware, entity/column names and guard methods in a C# source model, and none was loaded on this run, so there was nothing to gather. That is a gap in this analyzer's language reach — not a finding that the repository lacks audit controls.
- C4 Data Retention — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. These retention controls are read from declarative annotations, request middleware, entity/column names and guard methods in a C# source model, and none was loaded on this run, so there was nothing to gather. That is a gap in this analyzer's language reach — not a finding that the repository lacks retention controls.
- C5 Data-Subject Rights — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. These data-subject rights controls are read from declarative annotations, request middleware, entity/column names and guard methods in a C# source model, and none was loaded on this run, so there was nothing to gather. That is a gap in this analyzer's language reach — not a finding that the repository lacks data-subject rights controls.
- GD1 Unfinished & placeholder code — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax and JavaScript/TypeScript source only, and no C# or JavaScript/TypeScript was found, and this repository's Erlang is not read yet, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- IC1 Incompleteness & stubs — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax and JavaScript/TypeScript source only, and no C# or JavaScript/TypeScript was found, and this repository's Erlang is not read yet, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- P10 Library API & versioning — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads NuGet packaging and C# public API, and npm, PyPI, crates.io, Maven/Gradle, Go module, RubyGems, Composer, SwiftPM, pub.dev and Hex package manifests only, and no .NET project and no package manifest of those ecosystems was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- P8 Schema migrations — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads EF Core usage in C# and the schema tooling its file scan recognises only, and no .NET project was loaded, and this repository's language is not one the scan models, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- PF1 Benchmark discipline — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check's reader does not cover the language this repository's product is written in, so it had nothing of the product to read. That is a gap in this analyzer's language reach — not a finding about this repository.
- S1 Web-Security Posture — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. These web-security controls are read from declarative annotations, request middleware, entity/column names and guard methods in a C# source model, and none was loaded on this run, so there was nothing to gather. That is a gap in this analyzer's language reach — not a finding that the repository lacks web-security controls.
- X1 Async correctness — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript source only, and no C# was loaded and no JavaScript/TypeScript was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- X12 Unreachable branch — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript source only, and no C# was loaded and no JavaScript/TypeScript was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- X13 Undrained process stream — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript source only, and no C# was loaded and no JavaScript/TypeScript was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- X14 Bypassable address classification — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript, Java, Kotlin, Rust, PHP, Python and Go source only, and no C# was loaded and no JavaScript/TypeScript, Java, Kotlin, Rust, PHP, Python or Go was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- X15 Unvalidated length from an untrusted reader — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript, Java, Kotlin, PHP and Ruby source only, and no C# was loaded and no JavaScript/TypeScript, Java, Kotlin, PHP or Ruby was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- X16 Unfloored truncation loop — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript source only, and no C# was loaded and no JavaScript/TypeScript was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- X17 Uncapped recursion over a caller-supplied document — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and TypeScript source only, and no C# was loaded and no TypeScript was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- X18 Disposal-pattern correctness — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript source only, and no C# was loaded and no JavaScript/TypeScript was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- X19 Unrestored process-global state — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript source only, and no C# was loaded and no JavaScript/TypeScript was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- X2 Cancellation propagation — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript source only, and no C# was loaded and no JavaScript/TypeScript was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- X23 Unguarded diagnostic materialisation — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript source only, and no C# was loaded and no JavaScript/TypeScript was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- X24 Document value interpolated into markup unescaped — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript, Java and Ruby source only, and no C# was loaded and no JavaScript/TypeScript, Java or Ruby was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- X25 Inert configuration knob — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript, Java and PHP source only, and no C# was loaded and no JavaScript/TypeScript, Java or PHP was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- X27 Collection changed while being enumerated — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and Java and Rust source only, and no C# was loaded, no Java or Rust was found, and this repository's Erlang is not read yet, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- X29 Per-element action decided by a fixed element — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript, Java and Rust source only, and no C# was loaded and no JavaScript/TypeScript, Java or Rust was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- X3 Exception handling — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and PHP, Java, Kotlin, Python, Ruby and Scala source only, and no C# was loaded and no PHP, Java, Kotlin, Python, Ruby or Scala was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- X30 Support guard that admits what it rejects — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and Scala, JavaScript/TypeScript, Java and Kotlin source only, and no C# was loaded and no Scala, JavaScript, TypeScript, Java or Kotlin was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- X4 Structured logging — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript source only, and no C# was loaded and no JavaScript/TypeScript was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- X6 Hand-rolled structured-format parsing — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and Python, JavaScript/TypeScript, Go, Java/Kotlin/Scala, Ruby, PHP, Rust and Swift source only, and no C# was loaded and none of those languages was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- X7 Silent fallback defaults — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C#, Python, TypeScript/JavaScript, Rust, Go, Java, Kotlin and PHP syntax only, and no C#, Python, TypeScript/JavaScript, Rust, Go, Java, Kotlin or PHP was loaded for this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
Limitations & what we did not check
Watchdog assesses the repository exactly as committed, and only the repository. By design it does not reach outside the source tree: the live cloud account, the running CI/CD pipeline, the host's branch-protection and approval rules, the production configuration, or a restore actually exercised against a backup are all out of scope. That boundary is a feature, not a gap — a repo-relative, deterministic scan re-runs identically on any commit and every finding opens at a real file and line, where a live audit can neither be reproduced nor traced. The visible consequence is that controls which leave no in-repo evidence are reported as "not evidenced" and excluded from the score rather than awarded a number a static scan cannot justify.
Per-dimension blind spots
- D1 Cyclomatic Complexity: Cyclomatic complexity counts branches statically — it cannot tell an essential decision tree from accidental tangle, nor see complexity that lives in data or configuration (large switch-case token tables, DSL lexers/parsers, data-as-code rule tables) rather than control flow: a tokenizer's many single-character cases read as high complexity though each branch is trivial.
- D2 Cognitive Complexity: Cognitive-complexity heuristics approximate how hard code is to follow; genuine domain difficulty and well-named intent that eases reading are not captured.
- D3 God Classes: "God class" is sized by members and responsibilities visible in the type — a deliberately broad facade over a coherent subsystem can read the same as an accidental grab-bag. For front-end JS the file-length check is cohesion-aware (a single-responsibility module — one class/IIFE — earns a 3× threshold), but cohesion is approximated from top-level declarations, not true dependency structure.
- D4 Code Duplication: Duplication is token-similarity — an in-process token-stream comparison over sliding windows, with type-aware normalization — so it finds copy-paste, not semantic duplication expressed differently. Committed machine-written code (scaffolded migrations, designer/codegen output, protobuf/OpenAPI stubs, model snapshots) is EXCLUDED — its repetition is the tool's, not the team's — so the score reflects hand-written duplication only.
- D6 Cohesion (LCOM4): LCOM4 cohesion is syntactic — it infers connectivity from which methods touch which fields/methods by name, not from real runtime behaviour or intent.
- D12 Dependency Hygiene: Dependency health reads manifests and lockfiles — a vulnerability in a vendored/copied dependency, or risk from how a dependency is actually used, is outside this view.
- D13 Secret Scanning: Secret detection is signature- and entropy-based on the current tree — a secret that does not match a known pattern, or one already rotated, will not be flagged (a clean scan is "nothing matched", not "no secrets exist").
- D14 License Compliance: License compatibility is checked against declared package metadata and a policy — mislabelled or missing license metadata, and obligations that depend on how you distribute, are not resolved here.
- D15 Churn × Complexity Hotspots: Churn hotspots come from git history — a freshly imported or squashed repository has no churn signal, and recent rewrites can mask a historically risky file.
- D16 Bus Factor: Bus-factor is a time-decayed model of commit attribution (who has recently, repeatedly worked a file), not comprehension — pairing, review and reading-without-committing spread knowledge it can't see; bot commits and shared accounts still distort it.
- D17 Explicit Debt: Acknowledged-debt signals (TODO/FIXME, suppressions, dead code) are textual — undocumented debt that nobody marked, and debt that lives in design rather than annotations, is invisible. Committed machine-written code (scaffolded migrations, designer/codegen output, generated stubs) is excluded — it is never the team's dead code to delete.
- D19 Documentation Quality: Documentation quality is judged by an LLM over a bounded sample of docs — it reads what is written, not whether the docs match the running system, and it is advisory, not a measurement. Its critique rows are drawn from a closed category vocabulary and each row means the same thing in every run, so two scans can be compared row by row; the SET that fires is still a sample, and does not repeat exactly. Measured on one frozen input, six scans at one engine SHA: 2-5 critique rows per scan, 8 distinct rows across the six, 3 of those 8 seen in only one scan. So a D19 row is evidence about the documentation, but a COUNT of D19 rows is not a quantity — never read a change in it as an improvement or a regression.
- D20 ADR Quality: ADR quality is an LLM read of the decision records present — it cannot know about decisions made and never recorded, and its verdict is sampled and advisory.
- D21 Naming Consistency: Naming quality is an LLM judgement over a bounded sample — it assesses clarity/consistency of the names it sees, not domain-correctness, and is advisory.
- D26 Project Cohesion: Project focus is sized from members/namespaces per project — a project that is broad by deliberate design reads the same as one that has sprawled.
- D28 Secrets (history): Secret-history scanning sweeps the git log for known patterns — a secret that predates the available history, or never matched a signature, is not found (clean means "nothing matched in the history we can see").
- D29 Static Analysis (SAST): SAST findings are pattern-based (semgrep) — it finds classes of bug it has rules for; logic flaws, auth/authorization gaps and issues needing runtime context are out of reach (and clean means "no rule matched").
- D30 Dependency Vulnerabilities: CVE matching depends on accurate package/version metadata and on the advisory databases — a vulnerability with no published advisory, or in code not declared as a dependency, is not seen. Coverage needs a RESOLVED graph: an unpinned requirements.txt, or a pom without a resolved build, yields partial coverage rather than a clean verdict. An ecosystem the analyzer cannot scan is reported as unmeasured, never as clean.
- D31 IaC & Container Security: IaC scanning checks Dockerfiles/Terraform/Kubernetes against best-practice rules — it cannot see the live cloud account, runtime configuration, or drift between the committed config and what is actually deployed.
- D34 Knowledge Freshness: Freshness is decayed commit RECENCY, not comprehension — code read often but rarely committed reads as orphaned, and stable code that genuinely needs no changes is penalised the same as forgotten code; bot/squash commits distort it like the bus factor.
- D35 Change Coupling: Change coupling is co-change in COMMITS — files split across separate commits, or coupled only through a shared config/build step, read as uncoupled, and a sweeping commit (rename/format) is excluded so it doesn't couple everything. It shows that files change together, not WHY: a high coupling can be a healthy cohesive pair as readily as a hidden leak.
- D43 Malicious Dependencies: Only packages some vulnerability database has already NAMED as malicious are seen — a compromise published in the last hours, or never reported at all, is invisible here, and this dimension reading 10 is not evidence that a dependency is trustworthy. There is no typosquat or dependency-confusion analysis: a package nobody has reported is simply absent from the feeds. Coverage is the dependency scan's: an ecosystem that could not be scanned is disclosed as unmeasured, never as clean.
- AX10 Code composition: Role is inferred from namespace/folder convention, not semantics — a domain concept living in a folder named "Services" reads as application, and the split is lines-of-code, not business value. The business-logic-share score is a SOFT, FLOORED signal: it contributes to the Architecture lens but is floored at the Critical gate, so an infrastructure-heavy design (a gateway, an ETL, a driver) is legitimately low without being nuked to zero.
- AX9 CQS / query purity: Handlers are found by interface/name convention — a query handler using neither is not seen. Mutation is a resolved write/publish invocation (SaveChanges/repository/bus), so a write hidden behind a hand-rolled wrapper, reflection, or a string-keyed service locator resolves to a non-persistence type and isn't flagged; it detects that a query writes state, not whether the write is a legitimate read-side cache update. Clean means "no resolved write/publish in a query body", not a proof of CQS purity.
- M4 Documentation accuracy: Onboarding quality is an LLM read of the docs/setup present — it cannot run the onboarding or measure how long a real new joiner takes; the verdict is sampled and advisory.
- P4 Deployment & Rollback: Approval/branch-protection rules live in repository settings the scan cannot see — only their in-repo evidence (config files, workflows) is checked, so a control enforced purely in the host's settings reads as "not evidenced".
- P5 DR & Backup: Backup/restore and disaster-recovery readiness is judged from in-repo evidence — a config that exists is not a tested restore, so the absence of positive evidence is reported as "not evidenced", never scored as present.
- P6 Release Hygiene: Rollback/observability controls are inferred from repo artefacts (pipelines, dashboards-as-code) — controls configured in external tooling, with no in-repo trace, cannot be credited.
The LLM boundary
Dimensions
D1 · Cyclomatic Complexity
1 function(s) exceeded the cyclomatic complexity threshold of 15; the worst was hpr_protocol_router.get_stream at 19. A further 2 function(s) were over the threshold but excluded as flat dispatchers (a long switch/match over independent cases: many branches, almost no nesting), the largest being hpr_gwmp_worker.handle_info at 19 — they are counted neither in the figure above nor in this dimension's score. 2 files carry no cyclomatic complexity row at all for this reason — every one of their over-threshold functions was excluded, so the exclusion is disclosed nowhere in the file itself: src/protocols/gwmp/hpr_gwmp_worker.erl (hpr_gwmp_worker.handle_info at 19), src/grpc/iot_config/hpr_route_stream_worker.erl (hpr_route_stream_worker.handle_call at 17). They are named here because the per-file figures other dimensions report are taken BEFORE this exclusion, so such a file can show a high maximum complexity elsewhere in this report and nothing here, with nothing to reconcile the two.
hpr_protocol_router.get_stream (cyclomatic 19)src/protocols/hpr_protocol_router.erl:230
What to do
- Bring the 1 body over 15 down to 15 or less in Cyclomatic Complexity — start with hpr_protocol_router.get_stream (cyclomatic 19). — Refactoring it lifts Cyclomatic Complexity from 9.7 to about 10.0/10.
- Enforce Cyclomatic Complexity in CI to reach Verified (currently Documented). — Hardens enforcement from Documented toward Prevented — provenance only; does not change the score.
Do you agree with this assessment?
D2 · Cognitive Complexity
2 function(s) exceeded the cognitive complexity threshold of 15; the worst was hpr_http_roaming_downlink_stream_worker.process_downlink at 17.
hpr_http_roaming_downlink_stream_worker.process_downlink (cognitive 17)src/protocols/http/hpr_http_roaming_downlink_stream_worker.erl:153
hpr_http_roaming_worker.send_data (cognitive 16)src/protocols/http/hpr_http_roaming_worker.erl:204
What to do
- Bring the 2 bodies over 15 down to 15 or less in Cognitive Complexity — start with hpr_http_roaming_downlink_stream_worker.process_downlink (cognitive 17), hpr_http_roaming_worker.send_data (cognitive 16). — This score is capped by its worst body, so a finding fixed alone moves it by almost nothing — the next one down takes its place. Refactoring these 2 together lifts Cognitive Complexity from 9.7 to about 10.0/10, projected with the scoring formula itself and assuming each lands exactly at 15.
- Enforce Cognitive Complexity in CI to reach Verified (currently Documented). — Hardens enforcement from Documented toward Prevented — provenance only; does not change the score.
Do you agree with this assessment?
D3 · God Classes
7 over-large unit(s) detected — types, modules or files that carry too much.
FileTooLong: src/hpr_routing.erl src/hpr_routing.erl
What to do
- Resolve the 7 FileTooLong finding(s) in God Classes — start with hpr_routing.erl, hpr_multi_buy.erl, hpr_cli_config.erl. — One of this dimension's main actionable groups (7 warning-level).
- Enforce God Classes in CI to reach Verified (currently Documented). — Hardens enforcement from Documented toward Prevented — provenance only; does not change the score.
Do you agree with this assessment?
D4 · Code Duplication
16 duplicated block group(s) detected.
Duplicated block (6 lines × 2) src/cli/hpr_cli_config.erl:671
Duplicated block (7 lines × 2) src/grpc/iot_config/hpr_devaddr_range_storage.erl:332
Duplicated block (11 lines × 2) src/grpc/packet_router/hpr_register.erl:51
Duplicated block (27–29 lines × 2)src/cli/hpr_cli_config.erl:678
Duplicated block (22–26 lines × 2)src/grpc/iot_config/hpr_route_stream_worker.erl:433
What to do
- Resolve the 4 Duplicated block (6 lines × 2) finding(s) in Code Duplication — start with hpr_cli_config.erl (2), hpr_gateway_liveness_storage.erl, hpr_packet_up.erl. — One of this dimension's main actionable groups (4 warning-level).
- Resolve the 3 Duplicated block (7 lines × 2) finding(s) in Code Duplication — start with hpr_devaddr_range_storage.erl (2), hpr_gwmp_sup.erl. — One of this dimension's main actionable groups (3 warning-level).
- Resolve the 2 Duplicated block (11 lines × 2) finding(s) in Code Duplication — start with hpr_register.erl, hpr_http_roaming.erl. — One of this dimension's main actionable groups (2 warning-level).
- Enforce Code Duplication in CI to reach Verified (currently Documented). — Hardens enforcement from Documented toward Verified — provenance only; does not change the score.
Do you agree with this assessment?
D6 · Cohesion (LCOM4)
0 of 9 classes have LCOM4 above 3.
Do you agree with this assessment?
D12 · Dependency Hygiene
5 outdated, 0 retired direct Hex dependencies declared by rebar3, 8 pinning defect(s). 12 of 13 Hex declarations were graded against hex.pm (0 not published there, 1 not resolved to a release by a committed `REDACTED`). A dependency declared at an EXACT version — rebar3's own idiom — is graded against the current release and its remedy is an edit to the `rebar.config` declaration, because `rebar3 upgrade` cannot move past the version the manifest names; a `~>` or bounded requirement that EXCLUDES the newest release is reported as nothing, because that bound is a deliberate constraint. A `{ref, …}`, `{tag, …}` or branch-tracked git dependency is not graded for currency at all: its version is a revision, not a Hex release. Whether any of these packages is UNMAINTAINED is not graded — hex.pm publishes no maintenance status, and release age does not stand in for one. Whether any is UNUSED is not graded either: a large idiomatic class of BEAM dependencies — runtime adapters, codec plugins, protocol implementations and OTP applications the release starts — is correctly declared and never referenced in source. Known CVEs in this dependency graph are D30's question.
Floating source dependency: clique
Outdated: gproc
What to do
- Resolve the 8 Floating source dependency finding(s) in Dependency Hygiene. — One of this dimension's main actionable groups (8 warning-level).
- Enforce Dependency Hygiene in CI to reach Verified (currently Documented). — Hardens enforcement from Documented toward Verified — provenance only; does not change the score.
Do you agree with this assessment?
D13 · Secret Scanning
Secret scan ran and found no leaked secrets.
Do you agree with this assessment?
D14 · License Compliance
0 of 34 shipped Hex package(s) use a banned license. Licences were resolved from hex.pm over the packages a consumer installs — this repository's REDACTED, which is already the transitive closure a consumer installs. rebar3 writes that lock for the DEFAULT profile ONLY, so a dependency declared inside `{profiles, [{test, [{deps, […]}]}]}` has no entry in it and is excluded here for the reason the Mix arm excludes an `only: [:dev, :test]` declaration: it is not installed by anything that depends on this repository. Each licence is the one hex.pm publishes for the package's current release. A further 16 package(s) the closure reaches resolve from git, a path or a local override and publish no licence this pass can read; they are outside this verdict. This repository publishes itself under Apache 2.0, which is its own choice and is not judged here.
Do you agree with this assessment?
D15 · Churn × Complexity Hotspots
No churn × complexity hotspots in the window.
Do you agree with this assessment?
D16 · Bus Factor
15 source file(s) have their living knowledge concentrated in one author (≥90% of recent, decayed contribution). The largest is src/cli/hpr_cli_config.erl. Counted over 45 of the 68 production source files in this repository: the rest are under the ~2,400-byte size floor this dimension measures over.
Off-boarding risk: anonymized user #1
What to do
- Resolve the 1 Off-boarding risk finding(s) in Bus Factor. — One of this dimension's main actionable groups (1 recommendation-level).
Do you agree with this assessment?
D17 · Explicit Debt
6 deducted task-comment markers across 14514 LoC (0.0/KLoC) → score 9.9. Task comments only: this repository's language is read without a compiler, so D17's suppression, dead-code and commented-out-code arms did not run and this score counts fewer marker kinds than a .NET repository's would.
TodoComment src/grpc/packet_router/hpr_packet_up.erl:270
XxxComment src/hpr_packet_reporter.erl:263
What to do
- Resolve the 4 TodoComment finding(s) in Explicit Debt — start with hpr_packet_up.erl, hpr_gwmp_worker.erl, hpr_http_roaming_downlink_stream_worker.erl. — One of this dimension's main actionable groups (4 warning-level).
- Resolve the 2 XxxComment finding(s) in Explicit Debt — start with hpr_packet_reporter.erl (2). — One of this dimension's main actionable groups (2 warning-level).
- Enforce Explicit Debt in CI to reach Verified (currently Documented). — Hardens enforcement from Documented toward Prevented — provenance only; does not change the score.
Do you agree with this assessment?
D19 · Documentation Quality
The repository's root README and three docs (multi-buy.md, playbook.md, routing.md) are all well written for the project. The multi-buy.md is a detailed distributed-system architecture document with an outline that lists every section present in the body; the routing.md describes the routing mechanism post HIP 70 with a Mermaid diagram and configuration sections; the playbook.md covers drop-in IOT Config Service updates, commands, and notes about restart safety. All three docs are well written for their audience but the README is thin on overview and lacks installation/usage guidance (the outline lists only 'Routing' as an entry under the root heading).
What to do
- Improve Documentation Quality — currently 8.0/10. — The repository's root README and three docs (multi-buy.md, playbook.md, routing.md) are all well written for the project. The multi-buy.md is a detailed distributed-system architecture document with an outline that lists every section present in the body; the routing.md describes the routing mechanism post HIP 70 with a Mermaid diagram and configuration sections; the playbook.md covers drop-in IOT Config Service updates, commands, and notes about restart safety. All three docs are well written for their audience but the README is thin on overview and lacks installation/usage guidance (the outline lists only 'Routing' as an entry under the root heading).
Do you agree with this assessment?
D20 · ADR Quality
No architecture decision records were found.
No ADRs found
What to do
- Resolve the 1 No ADRs found finding(s) in ADR Quality. — One of this dimension's main actionable groups (1 recommendation-level).
Do you agree with this assessment?
D21 · Naming Consistency
0 naming inconsistencies across 0 sampled symbols.
Do you agree with this assessment?
D26 · Project Cohesion
0 of 1 build units (rebar3) flagged as possibly oversized/incoherent.
Do you agree with this assessment?
D28 · Secrets (history)
gitleaks scanned the full history AND the current working tree and found no secrets.
Do you agree with this assessment?
D29 · Static Analysis (SAST)
11 finding(s): 0 critical, 10 high, 1 medium, 0 low. 1 unpinned-GitHub-Actions row(s) are reported here but scored by D36 (supply-chain provenance), which measures that posture as `pinned_actions` — one pinning decision is charged once, not once per lens. Separately, one or more rules could not re-parse an embedded snippet in 2 file(s) (e.g. a workflow `run:` block read as shell). Those files WERE scanned and their other rows are unaffected; only those rules' view of those snippets is missing.
REDACTED
REDACTED
REDACTED
REDACTED
REDACTED
What to do
- Resolve the 7 REDACTED finding(s) in Static Analysis (SAST) — start with REDACTED (7). — One of this dimension's main actionable groups (7 issue-level).
- Resolve the 1 REDACTED finding(s) in Static Analysis (SAST) — start with REDACTED. — One of this dimension's main actionable groups (1 issue-level).
- No action in Static Analysis (SAST) — all 1 REDACTED finding(s) are reported here at file:line but scored by D36 (supply-chain provenance), so none is charged to this dimension. — One of this dimension's main actionable groups (1 issue-level, 0 of them charged here).
Do you agree with this assessment?
D30 · Dependency Vulnerabilities
1 finding(s): 0 critical, 1 high, 0 medium, 0 low.
REDACTED
What to do
- Resolve the 1 High CVE finding(s) in Dependency Vulnerabilities — start with REDACTED. — One of this dimension's main actionable groups (1 issue-level).
Do you agree with this assessment?
D31 · IaC & Container Security
9 finding(s): 0 critical, 3 high, 6 medium, 0 low.
REDACTED
REDACTED
What to do
- Resolve the 3 High IaC finding(s) in IaC & Container Security — start with REDACTED (2), REDACTED. — One of this dimension's main actionable groups (3 issue-level).
- Resolve the 6 Medium IaC finding(s) in IaC & Container Security — start with REDACTED (2), REDACTED (2), REDACTED (2). — One of this dimension's main actionable groups (6 warning-level).
Do you agree with this assessment?
D34 · Knowledge Freshness
7 of 45 significant source file(s) are orphaned — their living knowledge has decayed to nothing, so no one currently understands them. The largest is src/protocols/http/hpr_http_roaming.erl. Counted over 45 of the 68 production source files in this repository: the rest are under the ~2,400-byte size floor this dimension measures over.
Orphaned knowledgesrc/protocols/http/hpr_http_roaming.erl
Further orphaned files (smaller)
What to do
- Resolve the 1 Orphaned knowledge finding(s) in Knowledge Freshness — start with hpr_http_roaming.erl. — One of this dimension's main actionable groups (1 issue-level).
- Resolve the 1 Further orphaned files (smaller) finding(s) in Knowledge Freshness. — One of this dimension's main actionable groups (1 recommendation-level).
Do you agree with this assessment?
D35 · Change Coupling
No strong hidden change-coupling between production files.
Do you agree with this assessment?
D36 · Supply-chain Provenance & Signing
0/4 supply-chain integrity signals present (provenance, signing, SBOM, pinned actions).
REDACTED
REDACTED
REDACTED
REDACTED
REDACTED
What to do
- Resolve the 1 REDACTED finding(s) in Supply-chain Provenance & Signing. — One of this dimension's main actionable groups (1 warning-level).
- Resolve the 1 REDACTED finding(s) in Supply-chain Provenance & Signing. — One of this dimension's main actionable groups (1 warning-level).
- Resolve the 1 REDACTED finding(s) in Supply-chain Provenance & Signing. — One of this dimension's main actionable groups (1 recommendation-level).
Do you agree with this assessment?
D43 · Malicious Dependencies
No dependency in any ecosystem this repository declares is published as malicious.
Do you agree with this assessment?
Frontend & cross-cutting dimensions
AX10 · Code composition
What to do
- The domain core is a small share of production code, but most of the rest matched no layer vocabulary at all — so this is not yet an anemic-domain finding. The namespace/path convention could not place that code, which makes the composition above a statement about the naming, not about the design. Name the layers (or check that the repository's conventions differ from the ones this check knows) before reading a thin domain into it.
Do you agree with this assessment?
AX3 · Project dependency cycles
Do you agree with this assessment?
AX4 · Dependency direction
Do you agree with this assessment?
AX9 · CQS / query purity
Do you agree with this assessment?
ED1 · Handler temporal coupling
- `hpr_http_roaming_worker` clause `handle_cast/2#113` blocks the process on a synchronous outbound I/O client call (a remote HTTP request, a socket receive, or a blocking pool checkout) awaited inline while handling a message — the process is blocked (holding its mailbox) until a peer replies or the sleep elapses. That couples this handler in real time to another process being up and fast, and a mutual call can DEADLOCK. To decouple, issue the request off the hot path — reply asynchronously and do the I/O in a throwaway spawned worker (or use the async client API), so the process keeps serving its mailbox. — src/protocols/http/hpr_http_roaming_worker.erl:233
- `hpr_http_roaming_worker` clause `handle_info/2#152` blocks the process on a synchronous outbound I/O client call (a remote HTTP request, a socket receive, or a blocking pool checkout) awaited inline while handling a message — the process is blocked (holding its mailbox) until a peer replies or the sleep elapses. That couples this handler in real time to another process being up and fast, and a mutual call can DEADLOCK. To decouple, issue the request off the hot path — reply asynchronously and do the I/O in a throwaway spawned worker (or use the async client API), so the process keeps serving its mailbox. — src/protocols/http/hpr_http_roaming_worker.erl:233
What to do
- Remove synchronous peer round-trips (gen_server:call / hand-rolled receive) and blocking sleeps from OTP message handlers — cast a follow-up or resolve state locally, so processes stay temporally decoupled and deadlock-free.
Do you agree with this assessment?
M1 · Documentation (README)
What to do
- Add a build/run (quick start) section to the root README — the first thing a newcomer needs.
- Add a 'Testing' section to the root README — how to run the test suite.
- Add an 'Architecture' / 'How it works' section to the root README — the high-level shape.
Do you agree with this assessment?
M2 · Architecture documentation
- No Architecture Decision Records found — no conventional ADR directory, no numbered `NNNN-title` documents in any markup this check reads, and nothing ADR-shaped by content. Design rationale recorded elsewhere (a design-notes tree, a mailing list, pull-request discussion) is not visible to this check and is not re-findable per decision, so a future maintainer cannot ask why one choice was made and get an answer.
What to do
- Record significant decisions one document per decision — dated, stating the context, the decision and its consequences — and keep them together wherever your design docs already live (a conventional `docs/adr/` tree, with each file named `NNNN-title` in whatever markup those docs already use, is the most discoverable form).
Do you agree with this assessment?
M3 · Folder & project structure
Do you agree with this assessment?
M4 · Documentation accuracy
Do you agree with this assessment?
P1 · CI/CD gates
Do you agree with this assessment?
P2 · Observability
What to do
- Add a health-check endpoint (a /health handler in your cowboy dispatch) so orchestrators and load balancers can probe liveness/readiness.
Do you agree with this assessment?
P3 · Security & performance tooling
What to do
- Enable Dependabot/Renovate or a dependency-review gate.
- Add gitleaks/trufflehog in CI to block PRs that introduce committed secrets.
Do you agree with this assessment?
P4 · Deployment & Rollback
Do you agree with this assessment?
P5 · DR & Backup
- The only persistence guard found is a data volume in a stack this repo names a DEVELOPER stack, and no backup, geo-recovery or RTO/RPO controls were evidenced anywhere. A dev volume holds no production data, so there may be nothing here to recover — if this system's data lives in a platform or ops repo we can't see, that is where the DR evidence belongs, and this row is about what this repository can show rather than about that volume.
What to do
- Point at where production persistence is operated — a link from this repo to the ops/platform repo that holds its backup, geo-recovery and RTO/RPO controls — so the DR posture is reviewable from here; the dev-stack volume is not the thing to protect.
Do you agree with this assessment?
P6 · Release Hygiene
- No CHANGELOG/HISTORY/RELEASES file — what shipped when isn't easy to reconstruct for support or audit. (Versioning/tagging makes releases traceable, but a changelog records the what.)
What to do
- Keep a changelog (e.g. Keep-a-Changelog) recording what shipped in each release.
Do you agree with this assessment?
P7 · Outbound HTTP resilience
- `hackney:post(` makes an outbound HTTP call, and nothing bounds it: no timeout, deadline, retry or circuit breaker is set for it here, and the client has no process-wide default. A slow or failing dependency will hold this service's request, thread or connection until the call gives up on its own — or never, for a client with no default timeout. 2 of the 2 files that make outbound calls are unbounded; the first 2 are listed. — src/protocols/http/hpr_http_roaming_downlink_stream_worker.erl:196
- `hackney:post(` makes an outbound HTTP call, and nothing bounds it: no timeout, deadline, retry or circuit breaker is set for it here, and the client has no process-wide default. A slow or failing dependency will hold this service's request, thread or connection until the call gives up on its own — or never, for a client with no default timeout. — src/protocols/http/hpr_http_roaming_worker.erl:233
What to do
- Pass an explicit bound on every request — `{timeout, Ms}` in `httpc:request/4`'s HTTP options (its default is `infinity`), `{recv_timeout, Ms}` for hackney, a timeout on `gun:await/3` — and wrap dependencies that fail in a breaker (`fuse`) with back-off (`backoff`).
Do you agree with this assessment?
X28 · Index access outside its own emptiness guard
Do you agree with this assessment?
Reference — by lens
| Lens | Score | Rating | Impact |
|---|---|---|---|
| Code Health | 95% | Exemplary | Solid. |
| Architecture | 97% | Exemplary | Strongest area. |
| Maturity | 76% | Strong | Solid. |
| Readiness | 41% | Weak — gated by P5, P7 | Capped at Fair by a Critical contributor — resolve it before relying on this lens. |
| Security | 66% | Adequate — gated by D29, D36 | Capped at Fair by a Critical contributor — resolve it before relying on this lens. |
| Event-Driven | 27% | Weak — gated by ED1 | Capped at Fair by a Critical contributor — resolve it before relying on this lens. |
Not evidenced — 3 control(s) we could not find positive evidence for
- C3 Audit Trail — Not assessed: these audit controls are read from a source model (declarative annotations, request middleware, entity/column names, guard methods) that was not loaded for this repository — because the repository is written in a language this check does not yet model, or because its projects failed to load. Absence of an idiom this check recognises is NOT evidence that this repository lacks audit controls: it may implement them entirely in its own ecosystem. This is a gap in the analyzer's language coverage, not a finding about this repository.
- C4 Data Retention — Not assessed: these retention controls are read from a source model (declarative annotations, request middleware, entity/column names, guard methods) that was not loaded for this repository — because the repository is written in a language this check does not yet model, or because its projects failed to load. Absence of an idiom this check recognises is NOT evidence that this repository lacks retention controls: it may implement them entirely in its own ecosystem. This is a gap in the analyzer's language coverage, not a finding about this repository.
- C5 Data-Subject Rights — Not assessed: these data-subject rights controls are read from a source model (declarative annotations, request middleware, entity/column names, guard methods) that was not loaded for this repository — because the repository is written in a language this check does not yet model, or because its projects failed to load. Absence of an idiom this check recognises is NOT evidence that this repository lacks data-subject rights controls: it may implement them entirely in its own ecosystem. This is a gap in the analyzer's language coverage, not a finding about this repository.
Not included — 78 check(s) not relevant to this codebase
- AC1 Text alternatives — No web markup found — accessibility is not applicable to this repository.
- AC2 Forms & labels — No web markup found — accessibility is not applicable to this repository.
- AC3 Page structure — No web markup found — accessibility is not applicable to this repository.
- AC4 Keyboard semantics — No web markup found — accessibility is not applicable to this repository.
- AC5 ARIA correctness — No web markup found — accessibility is not applicable to this repository.
- AC6 Visual & motion safety — No web markup found — accessibility is not applicable to this repository.
- AC7 A11y enforcement — No web markup found — accessibility is not applicable to this repository.
- AX1 Captive dependencies — Not applicable: the BEAM has no dependency-injection container — state lives in processes, and no process is handed an instance whose lifetime another one scopes.
- AX2 Stateful singletons — Not applicable: Erlang processes share no mutable memory — state lives in a process's own mailbox — so there is no shared object to race on.
- AX5 Architecture & structure — not assessed — architecture style/structure is computed from a project graph (projects, types, module namespaces) that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- AX6 Interface segregation — not assessed — interface segregation is computed over a type surface that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- AX7 Slice cohesion — not applicable — not a vertical-slice architecture
- AX8 Test isolation — no test/production split to check
- AXB2 Runtime readiness — Advisory — this card reports evidence and never carries a score, so there is nothing missing here.
- AXR1 Runtime accessibility — compose up failed (exit 18 — an image could not be pulled) — rustfs Pulling rustfs-init Pulling rustfs-init Error Get "https://registry-1.docker.io/v2/": Forbidden rustfs Error context canceled Error response from daemon: Get "https://registry-1.docker.io/v2/": Forbidden; the earlier `compose pull` step reported: rustfs Pulling rustfs-init Pulling rustfs-init Error Get "https://registry-1.docker.io/v2/": Forbidden rustfs Error Get "https://registry-1.docker.io/v2/": Forbidden Error response from daemon: Get "https://registry-1.docker.io/v2/": Forbidden; the runtime sandbox reaches registries only through the in-fence pull-through mirror, so an image the mirror does not carry cannot be fetched — this is a limit of our sandbox, not of your stack; runtime evidence skipped This is a statement about this run, not a statement about your application: nothing here says the surface is inaccessible, only that it was never rendered.
- C1 Data Protection — Not assessed: these personal data controls are read from a source model (declarative annotations, request middleware, entity/column names, guard methods) that was not loaded for this repository — because the repository is written in a language this check does not yet model, or because its projects failed to load. Absence of an idiom this check recognises is NOT evidence that this repository lacks personal data controls: it may implement them entirely in its own ecosystem. This is a gap in the analyzer's language coverage, not a finding about this repository.
- C2 Access Controls — Not assessed: these authorization controls are read from a source model (declarative annotations, request middleware, entity/column names, guard methods) that was not loaded for this repository — because the repository is written in a language this check does not yet model, or because its projects failed to load. Absence of an idiom this check recognises is NOT evidence that this repository lacks authorization controls: it may implement them entirely in its own ecosystem. This is a gap in the analyzer's language coverage, not a finding about this repository.
- D10 Test Quality — ~8008 lines of test source are present (.erl) but no test cases reached the test census for this repository — no test root we could resolve declared them, or the files we read declare no cases in a test framework we recognise — so skipped/assertion-free tests couldn't be counted. Not scored — this is a gap in the analyzer, not a finding about this repository.
- D11 Test Reliability — Test reliability not included — the .erl suite was found but not re-run
- D18 Solution Shape — D18 scores the shape of a .NET solution; this repository has no .NET solution or project files, so the dimension does not apply.
- D22 Internal API Consistency — The exposed public-API surface could not be collected — no C#/VB projects loaded.
- D23 Boundary Type-Coupling — No bounded-context organisation was detected either — neither a context-shaped layout nor 2+ sibling source directories each declaring an aggregate root. Declaring this codebase's bounded contexts (≥2) would let cross-boundary type coupling be assessed. Declare them in `.codehealth/config.yaml` at the repository root (create it if absent), mapping each context name to the module-path or namespace prefixes that belong to it — e.g. `architecture:` → `contexts:` → `Billing: ["src/billing", "Acme.Billing"]`, `Catalog: ["src/catalog", "Acme.Catalog"]`.
- D24 Comment Value — No inline comments to assess — comment value is not applicable here.
- D25 ADR Conformance — no ADRs to check
- D27 Navigability — symbol resolution incomplete — navigability not assessed
- D32 Data Compliance (PII/GDPR) — No personal data was found crossing a boundary the PII/GDPR ruleset checks — nothing written to a log or console sink, placed in a URL or query string, or persisted to browser storage. That is a clean result for the LEAK surface only: this ruleset detects personal data escaping, it does not inventory the personal data a repository holds, so it is not evidence that this repository has no personal-data surface. The personal-data map (Appendix C) and the C1-C5 compliance cards are what speak to that.
- D37 Vulnerability-disclosure Policy — No vulnerability-disclosure policy file found (SECURITY.md/.markdown/.rst/.txt at root or under .github/.forgejo/.gitea/docs, .well-known/security.txt). A coordinated-disclosure policy may live off-repo, so this is not evidenced rather than failed.
- D39 IL Efficiency — D39 measures the IL emitted by a .NET build; this repository has no .NET solution or project files, so the dimension does not apply.
- D40 Network Egress Confinement — No Kubernetes/orchestration workloads found in the repository manifests; network egress policy is a cluster-native control that may live at the platform/firewall layer, so there is nothing to assess here.
- D41 Kernel & Syscall Confinement — No Kubernetes/orchestration workloads found in the repository manifests; seccomp/AppArmor/SELinux confinement is a workload-level control, so there is nothing to assess here.
- D42 Runtime Threat Enforcement — No Kubernetes/orchestration workloads found in the repository manifests; runtime threat-detection and admission-control policy are cluster-level controls, so there is nothing to assess here.
- D44 Platform End-of-Life — Platform end-of-life not assessed — this repository declares no platform this pass reads
- D5 Coupling — Not applicable — this OTP build ships 1 production module(s), so there is no coupling BETWEEN modules to measure. (Its test and non-production modules are not part of the shipped graph.)
- D7 Architectural Integrity — no checkable ADRs, and no project-reference graph for the cycle pass to read — so this dimension makes no claim about dependency cycles in either direction (where this repository's language has an import-cycle lens, cycles are reported there). Architectural integrity not assessed
- D8 Code Coverage — Coverage not included — suite not readable by the collector
- D9 Test Distribution — Test source is present (.erl) but no test cases reached the test census for this repository — no test root we could resolve declared them, or the files we read declare no cases in a test framework we recognise — so its unit/integration/BDD/E2E split couldn't be counted. Not scored — this is a gap in the analyzer, not a finding about this repository.
- DM1 Domain Modelling — not scored — this repository shows only 1 of the 3 signals this lens looks for (20 value object(s))
- ED5 Idempotency — no mutating command handlers or message consumers detected — idempotency check not applicable
- ES1 Event Sourcing — not scored — this repository shows none of the 3 signals this lens looks for
- GD1 Unfinished & placeholder code — no source files were read — this check reads C# and JavaScript/TypeScript, and neither was read for this repository's product. That is a limit of the analyzer, not a finding about your code.
- IC1 Incompleteness & stubs — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- P10 Library API & versioning — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- P12 CI test-gate honesty — Reported, not scored — and nothing was matched here. The coverage check applies to any stack, and the automatic-re-run check to any GitHub-Actions workflow, but the checks for excluded tests, skipped tests and sleep-based synchronisation currently recognise only some ecosystems' test-runner idioms, so on a repository built with another stack the zeros below mean 'not checked', not 'clean'.
- P8 Schema migrations — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- P9 Domain vs controller coverage — no coverage report found on disk — produce a coverage report in a standard format (`rebar3 do eunit --cover, cover` (or covertool for Cobertura XML)) and commit it — a hosted scan measures a clone of the repository, so a report that exists only in a working tree, a CI runner's or your own, never reaches it; the artefact is commonly gitignored, so `git add -f` that one file (or un-ignore its path) and commit it alongside the code it measures, or wire coverage collection into CI, to enable this cross-layer check
- PF1 Benchmark discipline — Benchmark discipline was not assessed: this repository is written in Erlang, whose benchmark frameworks this check does not search yet. That is a gap in the analyzer's language reach, not a finding about your code.
- PF2 Allocation hygiene — Not applicable: Erlang runs on a garbage-collected runtime that gives a program no allocation-control idiom to choose on a hot path — no pools, stack allocation or value types — so allocation awareness is not something this code can be rated on.
- PF3 Async & latency hygiene — Not applicable: Erlang has no async/await function colour, so there is no asynchronous code for a blocking call to stall.
- S1 Web-Security Posture — Not assessed: these web-security controls are read from a source model (declarative annotations, request middleware, entity/column names, guard methods) that was not loaded for this repository — because the repository is written in a language this check does not yet model, or because its projects failed to load. Absence of an idiom this check recognises is NOT evidence that this repository lacks web-security controls: it may implement them entirely in its own ecosystem. This is a gap in the analyzer's language coverage, not a finding about this repository.
- X1 Async correctness — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X10 Duplicated predicate — Advisory — this card reports evidence and never carries a score, so there is nothing missing here.
- X12 Unreachable branch — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X13 Undrained process stream — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X14 Bypassable address classification — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X15 Unvalidated length from an untrusted reader — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X16 Unfloored truncation loop — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X17 Uncapped recursion over a caller-supplied document — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X18 Disposal-pattern correctness — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X19 Unrestored process-global state — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X2 Cancellation propagation — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X20 Mistyped argument guard — This check asks whether an argument guard reports an EMPTY value as a NULL one, which needs a language that throws a null-specific argument exception — .NET's ArgumentNullException, the JVM's NullPointerException, Dart's ArgumentError.notNull. This repository contains none of those languages: the ones it is written in have a single exception for a bad argument, so there is no pair of exceptions to confuse and nothing here for it to assess. Not a gap in the analyzer and not a finding about your code.
- X21 Side-effecting pattern guard — Not applicable: this check looks for a pattern guard or `case` label that increments, decrements or assigns while the switch is deciding whether it matches, and in this repository's languages none can. An Erlang guard admits only comparisons, arithmetic and guard BIFs — the compiler rejects anything with an effect — and a variable is bound exactly once. Not a gap in the analyzer and not a finding about your code.
- X22 Contradicted release guard — Not applicable: this check looks for a method whose returned value contradicts the flag its `finally` reads to decide whether to give back a lock it took, and in this repository's languages the body cannot set a flag that its cleanup reads. Erlang will not compile it: a variable bound inside `try` is "unsafe" in its `after` clause, so the body cannot record a handoff where the cleanup can read it. Not a gap in the analyzer and not a finding about your code.
- X23 Unguarded diagnostic materialisation — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X24 Document value interpolated into markup unescaped — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X25 Inert configuration knob — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X26 Unsynchronised callback handoff — Not applicable: this check looks for a collection written by a callback on one thread while the body waiting on it touches it on another, and in this repository's languages no collection is reachable from two threads at once. Erlang processes share no heap: a value sent to another process arrives as a copy, so no collection is reachable from two processes at once. Not a gap in the analyzer and not a finding about your code.
- X27 Collection changed while being enumerated — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X29 Per-element action decided by a fixed element — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X3 Exception handling — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X30 Support guard that admits what it rejects — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X31 Test-only surface in a production module — Advisory — this card reports evidence and never carries a score, so there is nothing missing here.
- X32 Type resolved by simple name across every loaded assembly — This check is about how a .NET program searches the assemblies loaded into its process for a type, and this repository contains no .NET source, so there is nothing here for it to assess. Not a gap in the analyzer and not a finding about your code.
- X4 Structured logging — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X5 Nullable reference types — Not applicable: this check asks whether the null-typed discipline a language offers is switched on, and how much of that the assertion operator takes back, and in this repository's languages there is no such switch and no such operator. Erlang has no null: every variable is bound, absence is a value you pattern-match (`undefined`, `nil`, the error tuples), and there is no static type checker whose null warning could be turned on or off. Not a gap in the analyzer and not a finding about your code.
- X6 Hand-rolled structured-format parsing — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X7 Silent fallback defaults — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X9 Subsumed condition operand — Advisory — this card reports evidence and never carries a score, so there is nothing missing here.
Appendix A — Findings (grouped)
Critical — 15 finding(s)
D29 · Static Analysis (SAST)
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
D31 · IaC & Container Security
- REDACTED
- REDACTED
- REDACTED
D29 · Static Analysis (SAST)
- REDACTED
D29 · Static Analysis (SAST)
- REDACTED
D29 · Static Analysis (SAST)
- REDACTED
D30 · Dependency Vulnerabilities
- REDACTED
D34 · Knowledge Freshness
- Orphaned knowledge src/protocols/http/hpr_http_roaming.erl
Serious — 54 finding(s)
D12 · Dependency Hygiene
- Floating source dependency: clique
- Floating source dependency: grpcbox
- Floating source dependency: helium_proto
- Floating source dependency: erlang_lorawan
- Floating source dependency: enacl
- Floating source dependency: xxhash
- Floating source dependency: erl_angry_purple_tiger
- Floating source dependency: h3
D3 · God Classes
- FileTooLong: src/hpr_routing.erl src/hpr_routing.erl
- FileTooLong: src/hpr_multi_buy.erl src/hpr_multi_buy.erl
- FileTooLong: cli/hpr_cli_config.erl src/cli/hpr_cli_config.erl
- FileTooLong: http/hpr_http_roaming.erl src/protocols/http/hpr_http_roaming.erl
- FileTooLong: iot_config/hpr_devaddr_range_storage.erl src/grpc/iot_config/hpr_devaddr_range_storage.erl
- FileTooLong: iot_config/hpr_route_ets.erl src/grpc/iot_config/hpr_route_ets.erl
- FileTooLong: iot_config/hpr_route_stream_worker.erl src/grpc/iot_config/hpr_route_stream_worker.erl
D31 · IaC & Container Security
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
- REDACTED
D17 · Explicit Debt
- TodoComment src/grpc/packet_router/hpr_packet_up.erl:270
- TodoComment src/protocols/gwmp/hpr_gwmp_worker.erl:215
- TodoComment src/protocols/http/hpr_http_roaming_downlink_stream_worker.erl:77
- TodoComment test/hpr_protocol_http_roaming_packet_SUITE.erl:284
D4 · Code Duplication
- Duplicated block (6 lines × 2) src/cli/hpr_cli_config.erl:671
- Duplicated block (6 lines × 2) src/grpc/iot_config/hpr_gateway_liveness_storage.erl:107
- Duplicated block (6 lines × 2) src/grpc/packet_router/hpr_packet_up.erl:149
- Duplicated block (6 lines × 2) src/cli/hpr_cli_config.erl:195
D4 · Code Duplication
- Duplicated block (7 lines × 2) src/grpc/iot_config/hpr_devaddr_range_storage.erl:332
- Duplicated block (7 lines × 2) src/grpc/iot_config/hpr_devaddr_range_storage.erl:353
- Duplicated block (7 lines × 2) src/protocols/gwmp/hpr_gwmp_sup.erl:42
D17 · Explicit Debt
- XxxComment src/hpr_packet_reporter.erl:263
- XxxComment src/hpr_packet_reporter.erl:264
D4 · Code Duplication
- Duplicated block (11 lines × 2) src/grpc/packet_router/hpr_register.erl:51
- Duplicated block (11 lines × 2) src/protocols/http/hpr_http_roaming.erl:185
ED1 · Handler temporal coupling
- Handler temporal coupling: hpr_http_roaming_worker clause `handle_cast/2#113` src/protocols/http/hpr_http_roaming_worker.erl:233
- Handler temporal coupling: hpr_http_roaming_worker clause `handle_info/2#152` src/protocols/http/hpr_http_roaming_worker.erl:233
P7 · Outbound HTTP resilience
- Outbound HTTP without resilience src/protocols/http/hpr_http_roaming_downlink_stream_worker.erl:196
- Outbound HTTP without resilience src/protocols/http/hpr_http_roaming_worker.erl:233
D1 · Cyclomatic Complexity
- hpr_protocol_router.get_stream (cyclomatic 19) src/protocols/hpr_protocol_router.erl:230
D2 · Cognitive Complexity
- hpr_http_roaming_downlink_stream_worker.process_downlink (cognitive 17) src/protocols/http/hpr_http_roaming_downlink_stream_worker.erl:153
D2 · Cognitive Complexity
- hpr_http_roaming_worker.send_data (cognitive 16) src/protocols/http/hpr_http_roaming_worker.erl:204
D29 · Static Analysis (SAST)
- REDACTED
D36 · Supply-chain Provenance & Signing
- REDACTED
D36 · Supply-chain Provenance & Signing
- REDACTED
D4 · Code Duplication
- Duplicated block (27–29 lines × 2) src/cli/hpr_cli_config.erl:678
D4 · Code Duplication
- Duplicated block (22–26 lines × 2) src/grpc/iot_config/hpr_route_stream_worker.erl:433
D4 · Code Duplication
- Duplicated block (13–14 lines × 2) src/protocols/http/hpr_http_roaming.erl:302
D4 · Code Duplication
- Duplicated block (9–12 lines × 3) src/grpc/iot_config/hpr_eui_pair_storage.erl:318
D4 · Code Duplication
- Duplicated block (5 lines × 4) src/cli/hpr_cli_config.erl:40
D4 · Code Duplication
- Duplicated block (12 lines × 2) src/grpc/iot_config/hpr_route_list_req.erl:47
D4 · Code Duplication
- Duplicated block (9 lines × 2) src/grpc/iot_config/hpr_devaddr_range_storage.erl:150
P5 · DR & Backup
- No DR/backup evidence
Minor — 8 finding(s)
D16 · Bus Factor
- Off-boarding risk: anonymized user #1
D20 · ADR Quality
- No ADRs found
D34 · Knowledge Freshness
- Further orphaned files (smaller)
D36 · Supply-chain Provenance & Signing
- REDACTED
D36 · Supply-chain Provenance & Signing
- REDACTED
D36 · Supply-chain Provenance & Signing
- REDACTED
M2 · Architecture documentation
- No ADRs
P6 · Release Hygiene
- No changelog
Minor — 5 finding(s)
D12 · Dependency Hygiene
- Outdated: gproc
- Outdated: hackney
- Outdated: observer_cli
- Outdated: prometheus
- Outdated: recon
Appendix B — Reproduction & audit trail
| Dimension | Tool | Version | Command | Findings | Raw output |
|---|---|---|---|---|---|
| D28 · Secrets (history) | gitleaks | — | gitleaks detect --no-banner --config /opt/gitleaks-rules/watchdog-gitleaks.toml --report-format json --report-path /tmp/watchdog-gitleaks-73c8f1c29693467b81f4fd2de85bbd42/history.json --exit-code 0 --source . | 0 | artifacts/raw/gitleaks-history.json |
| D28 · Secrets (history) | gitleaks | — | gitleaks detect --no-git --no-banner --config /opt/gitleaks-rules/watchdog-gitleaks.toml --report-format json --report-path /tmp/watchdog-gitleaks-73c8f1c29693467b81f4fd2de85bbd42/tree.json --exit-code 0 --source . | 0 | artifacts/raw/gitleaks-tree.json |
| D29 · Static Analysis (SAST) | semgrep | — | semgrep --config /opt/semgrep-rules/security-audit.yml --config /opt/semgrep-rules/owasp-top-ten.yml --config /opt/semgrep-rules/watchdog-sast.yml --json --quiet --timeout 10 --timeout-threshold 3 --metrics off . | 11 | artifacts/raw/semgrep.json |
| D30 · Dependency Vulnerabilities | osv-scanner | — | osv-scanner --format json --recursive . /tmp/codehealth-osv-sbom-0dc4caacbe254bb090c2c8ced0a94476 | 1 | artifacts/raw/osv-scanner.json |
| D31 · IaC & Container Security | trivy | — | trivy config --format json --quiet . | 9 | artifacts/raw/trivy-config.json |
| D32 · Data Compliance (PII/GDPR) | semgrep | — | semgrep: not applicable — No personal data was found crossing a boundary the PII/GDPR ruleset checks — nothing written to a log or console sink, placed in a URL or query string, or persisted to browser storage. That is a clean result for the LEAK surface only: this ruleset detects personal data escaping, it does not inventory the personal data a repository holds, so it is not evidence that this repository has no personal-data surface. The personal-data map (Appendix C) and the C1-C5 compliance cards are what speak to that. | 0 | — |
| D37 · Vulnerability-disclosure Policy | disclosure | — | disclosure: not applicable — No vulnerability-disclosure policy file found (SECURITY.md/.markdown/.rst/.txt at root or under .github/.forgejo/.gitea/docs, .well-known/security.txt). A coordinated-disclosure policy may live off-repo, so this is not evidenced rather than failed. | 0 | — |
| D40 · Network Egress Confinement | runtime-hardening | — | runtime-hardening: not applicable — No Kubernetes/orchestration workloads found in the repository manifests; network egress policy is a cluster-native control that may live at the platform/firewall layer, so there is nothing to assess here. | 0 | — |
| D41 · Kernel & Syscall Confinement | runtime-hardening | — | runtime-hardening: not applicable — No Kubernetes/orchestration workloads found in the repository manifests; seccomp/AppArmor/SELinux confinement is a workload-level control, so there is nothing to assess here. | 0 | — |
| D42 · Runtime Threat Enforcement | runtime-hardening | — | runtime-hardening: not applicable — No Kubernetes/orchestration workloads found in the repository manifests; runtime threat-detection and admission-control policy are cluster-level controls, so there is nothing to assess here. | 0 | — |
| D43 · Malicious Dependencies | osv-scanner | — | osv-scanner --format json --recursive . /tmp/codehealth-osv-sbom-0dc4caacbe254bb090c2c8ced0a94476 | 0 | artifacts/raw/osv-scanner.json |