J5ik2o/akka-Cqrs-Es-Example-Typed

Each chip is a dimension scored from real signals across architecture, testing, dependencies, security & compliance, documentation, git-history and code quality — in one coherent pass. A surface report typically covers a handful.

These checks had nothing to measure here (no tests, no git history, the codebase is small, or the architecture style doesn't apply), so they're omitted above rather than scored low.

• AC1 Text alternatives — Frontend below the scale floor (10 DOM element(s) < 25) — too little surface to assess accessibility.
• AC2 Forms & labels — Frontend below the scale floor (10 DOM element(s) < 25) — too little surface to assess accessibility.
• AC3 Page structure — Frontend below the scale floor (10 DOM element(s) < 25) — too little surface to assess accessibility.
• AC4 Keyboard semantics — Frontend below the scale floor (10 DOM element(s) < 25) — too little surface to assess accessibility.
• AC5 ARIA correctness — Frontend below the scale floor (10 DOM element(s) < 25) — too little surface to assess accessibility.
• AC6 Visual & motion safety — Frontend below the scale floor (10 DOM element(s) < 25) — too little surface to assess accessibility.
• AC7 A11y enforcement — Frontend below the scale floor (10 DOM element(s) < 25) — too little surface to assess accessibility.
• AX1 Captive dependencies — no DI registrations detected
• AX10 Code composition — not assessed — code composition is computed by ROLE over the .NET document set and none was loaded for this repository, because it is written in another language or the solution failed to load. This is a gap in the analyzer, not a finding about this repository
• AX2 Stateful singletons — no singleton implementations detected
• AX3 Project dependency cycles — not assessed — project cycles and dependency direction are computed over the .NET project-reference graph and none was loaded for this repository, because it is written in another language or the solution failed to load. This is a gap in the analyzer, not a finding about this repository
• AX4 Dependency direction — not assessed — project cycles and dependency direction are computed over the .NET project-reference graph and none was loaded for this repository, because it is written in another language or the solution failed to load. This is a gap in the analyzer, not a finding about this repository
• AX6 Interface segregation — not assessed — interface segregation is computed over the .NET type surface and none was loaded for this repository, because it is written in another language or the solution failed to load. This is a gap in the analyzer, not a finding about this repository
• AX7 Slice cohesion — not applicable — not a vertical-slice architecture
• AX8 Test isolation — not assessed — test isolation is computed from the .NET project graph (which projects are test projects, and what they reference) and no such graph was loaded for this repository, because it is written in another language or the solution failed to load. This is a gap in the analyzer, not a finding about this repository
• AX9 CQS / query purity — no CQRS query handlers detected — query purity is not applicable to this codebase
• AXB2 Runtime readiness — no data
• C1 Data Protection — Not assessed: these personal data controls are read from C# source (attributes, middleware, entity/column names, guard methods) and no C# source was loaded for this repository — because it is written in another language, or the solution failed to load. Absence of a .NET idiom is NOT evidence that this repository lacks personal data controls: it may implement them entirely in its own ecosystem. This is a gap in the analyzer's language coverage, not a finding about this repository.
• C2 Access Controls — Not assessed: these authorization controls are read from C# source (attributes, middleware, entity/column names, guard methods) and no C# source was loaded for this repository — because it is written in another language, or the solution failed to load. Absence of a .NET idiom is NOT evidence that this repository lacks authorization controls: it may implement them entirely in its own ecosystem. This is a gap in the analyzer's language coverage, not a finding about this repository.
• C3 Audit Trail — Not assessed: these audit controls are read from C# source (attributes, middleware, entity/column names, guard methods) and no C# source was loaded for this repository — because it is written in another language, or the solution failed to load. Absence of a .NET idiom is NOT evidence that this repository lacks audit controls: it may implement them entirely in its own ecosystem. This is a gap in the analyzer's language coverage, not a finding about this repository.
• C4 Data Retention — Not assessed: these retention controls are read from C# source (attributes, middleware, entity/column names, guard methods) and no C# source was loaded for this repository — because it is written in another language, or the solution failed to load. Absence of a .NET idiom is NOT evidence that this repository lacks retention controls: it may implement them entirely in its own ecosystem. This is a gap in the analyzer's language coverage, not a finding about this repository.
• C5 Data-Subject Rights — Not assessed: these data-subject rights controls are read from C# source (attributes, middleware, entity/column names, guard methods) and no C# source was loaded for this repository — because it is written in another language, or the solution failed to load. Absence of a .NET idiom is NOT evidence that this repository lacks data-subject rights controls: it may implement them entirely in its own ecosystem. This is a gap in the analyzer's language coverage, not a finding about this repository.
• D1 Cyclomatic Complexity — Most of this repository's production source (.java, .kt, .scala) had no cyclomatic complexity computed for it, so cyclomatic complexity was not measured — whatever else this pass did read is not this repository's complexity. Not scored: no method bodies were exposed for those file kinds by any language model this pass could load. This is a gap in the analysis run, not a finding about this repository.
• D10 Test Quality — ~2906 lines of test source are present (.scala, .java, .kt) but the test-quality collector reads C# only, so skipped/assertion-free tests couldn't be counted. Not scored — this is a gap in the analyzer, not a finding about this repository.
• D11 Test Reliability — Test reliability not included
• D12 Dependency Hygiene — Dependency hygiene not measured — dependency manifest found but not parsed for hygiene
• D14 License Compliance — Not scored — this repository's package manifest is not parsed for licence data yet. A gap in the analyzer's language coverage, NOT a finding that the repository's licenses are compliant (an sbt build (build.sbt)), which this pass does not parse yet — so this dimension asserts nothing about this repository's licensing in either direction.
• D15 Churn × Complexity Hotspots — complexity unreadable for .java, .kt, .scala — churn × complexity hotspots could not be measured
• D17 Explicit Debt — explicit-debt markers are read through a C# workspace today, so they were not read for this repository's language — this asserts nothing about how many markers the code carries. Not scored — this is a gap in the analyzer, not a finding about this repository
• D18 Solution Shape — D18 scores the shape of a .NET solution; this repository has no .NET solution or project files, so the dimension does not apply.
• D19 Documentation Quality — LLM evaluation failed
• D2 Cognitive Complexity — Most of this repository's production source (.java, .kt, .scala) had no cognitive complexity computed for it, so cognitive complexity was not measured — whatever else this pass did read is not this repository's complexity. Not scored: no method bodies were exposed for those file kinds by any language model this pass could load. This is a gap in the analysis run, not a finding about this repository.
• D20 ADR Quality — N/A — this repo declares itself a template / kata / sample / demo; a formal ADR log is deferred to a real application built from it.
• D22 Internal API Consistency — No exposed public API
• D23 Boundary Type-Coupling — Production source is present (.java, .kt, .scala) but bounded contexts are resolved over the C#/VB project set, which exposed none, so context scope could not be assessed. Not scored — this is a gap in the analyzer, not a verdict about this repository. Declaring the codebase's bounded contexts (≥2) would let cross-boundary type coupling be assessed — see the recommendation on this dimension for where. Declare them in `.codehealth/config.yaml` at the repository root (create it if absent), mapping each context name to the namespace prefixes that belong to it — e.g. `architecture:` → `contexts:` → `Billing: ["Acme.Billing"]`, `Catalog: ["Acme.Catalog"]`.
• D24 Comment Value — No inline comments to assess — comment value is not applicable here.
• D25 ADR Conformance — no ADRs to check
• D26 Project Cohesion — Project cohesion is assessed over the .NET project set; this target exposed no projects, so project size and spread could not be assessed. Not scored — this is a gap in the analyzer's reach, not a verdict about this repository.
• D27 Navigability — No calls could be sampled, so navigability was not assessed — tracing effort is measured over resolved call sites and this target exposed none. Not scored — this is a gap in the analyzer's reach, not a verdict about this repository.
• D30 Dependency Vulnerabilities — Not scored — no dependency manifest in a supported ecosystem was read for this repository. A gap in the analyzer's language coverage, NOT a finding that the repository is free of vulnerable dependencies (an sbt build (build.sbt) — not scanned yet) — where an OSV-supported manifest exists, dependency vulnerabilities for this repository are reported under D38 instead.
• D32 Data Compliance (PII/GDPR) — No PII/GDPR ruleset is bundled (the public p/gdpr semgrep pack was retired) — data compliance is not assessed in this scan.
• D33 JS/npm Dependency Vulnerabilities — No JS/npm manifest or lockfile found outside build output (package.json, package-lock.json, yarn.lock, pnpm-lock.yaml, bun.lockb); no JS dependencies to scan.
• D36 Supply-chain Provenance & Signing — The CI pipeline builds and tests but publishes no released artifact — no package publish, container push, GitHub release or deployment step. Supply-chain provenance, signing and SBOM attest RELEASED artifacts, so there is nothing to attest here. Add them to the release pipeline when this repo starts shipping artifacts (a NuGet package, a container image, a GitHub release).
• D37 Vulnerability-disclosure Policy — No vulnerability-disclosure policy file found (SECURITY.md/.markdown/.rst/.txt at root or under .github/.forgejo/.gitea/docs, .well-known/security.txt). A coordinated-disclosure policy may live off-repo, so this is not evidenced rather than failed.
• D38 OSV Dependency Vulnerabilities — No supported non-.NET dependency lockfile found outside build output (npm package-lock/yarn/pnpm/bun, Go go.mod, Rust Cargo.lock, Maven pom.xml, Gradle lockfiles, Python requirements.txt/poetry.lock/Pipfile.lock/pdm.lock, PHP composer.lock, Ruby Gemfile.lock, Elixir mix.lock, Dart pubspec.lock, Swift Package.resolved); nothing for OSV to scan. A NuGet-only repo stays NotApplicable — .NET CVEs are D30's domain.
• D39 IL Efficiency — D39 measures the IL emitted by a .NET build; this repository has no .NET solution or project files, so the dimension does not apply.
• D5 Coupling — Inter-project coupling could not be assessed — no analyzable project graph was found for this repository. Not scored: a gap in the analyzer's reach, not a verdict about this repository. (Coupling here is Martin afferent/efferent/instability plus reference cycles across a project-reference graph, read today from .NET project files; other ecosystems' module graphs are not read yet.)
• D6 Cohesion (LCOM4) — Cohesion (LCOM4) is measured over a C#/VB class graph, and this repository's production source is .java, .kt, .scala, which this pass does not read — so no class could be assessed. Not scored — this is a gap in the analyzer, not a finding about this repository.
• D7 Architectural Integrity — no checkable ADRs and no dependency cycles — architectural integrity not assessed
• D8 Code Coverage — Coverage not included — suite not readable by the collector
• D9 Test Distribution — Test source is present (.scala, .java, .kt) but the test-pyramid classifier reads C# only, so its unit/integration/BDD/E2E split couldn't be counted. Not scored — this is a gap in the analyzer, not a finding about this repository.
• DM1 Aggregate boundaries — not scored for TypeScript: a class holding another class reads the same whether the inner type is an aggregate or a value object, so this cannot be decided from source without guessing — reported as guidance rather than measured
• DM2 Strongly-typed ids — not scored for TypeScript: branded ids (`type Id = string & { __brand }`) are an uncommon idiom, so a bare-string id is not on its own evidence of a missing typed id — reported as guidance rather than measured
• DM3 Integration-event coupling — not scored for TypeScript: a domain type used across packages is indistinguishable in source from a deliberate shared-kernel package, so this is reported as guidance rather than measured
• DM4 Rich vs anemic model — not scored for TypeScript: telling a rich domain entity from an anemic data holder needs the behaviour a source-only read cannot always attribute (components, DTOs and readonly value objects are all legitimately data-shaped), so this is reported as guidance rather than measured
• DM5 Encapsulated state — not scored for TypeScript: the language already steers state behind #private/private/readonly, so a mutable public field is rare enough that we report this as guidance rather than measuring it
• DM7 Repository granularity — not scored for TypeScript: deciding whether a repository belongs to an aggregate root needs the aggregate structure, which source alone does not state — reported as guidance rather than measured
• ED1 Event-Driven — not scored — this repository shows none of the 3 signals this check looks for
• ED5 Idempotency — no mutating command handlers or message consumers detected — idempotency check not applicable
• ES1 Event Sourcing — not scored — this repository shows none of the 3 signals this check looks for
• GD1 Unfinished & placeholder code — no source files
• IC1 Incompleteness & stubs — not analysed — these correctness checks are read from C# source and none was loaded for this repository, because it is written in another language or the solution failed to load. This is a gap in the analyzer, not a finding about this repository
• P12 CI test-gate honesty — no data
• P2 Observability — Observability was not assessed: this check reads a source model that does not carry this repository's product — because the repository is written in a language this check does not yet model, or because its projects failed to load. Absence of a logging idiom this check recognises is NOT evidence that this repo lacks structured logging (it may log through its own ecosystem's logger). This is a gap in the analyzer, not a finding about this repository.
• P6 Release Hygiene — not evidenced — no changelog, version stamp or semver release tag in the repo
• P7 Outbound HTTP resilience — not applicable — this isn't a service/API/worker
• P8 Schema migrations — not assessed — schema-migration practice is read from a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
• P9 Domain vs controller coverage — no coverage report found on disk — produce a coverage report in a standard format (`sbt clean coverage test coverageReport` via sbt-scoverage) into the repo working tree before the scan — a CI step is the usual place, since the artefact is commonly gitignored, or wire coverage collection into CI, to enable this cross-layer check
• PF1 Benchmark discipline — Performance was not assessed: this lens reads a source model that was not loaded for this repository, because the repository is written in a language this lens does not yet model or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository — in particular it is NOT a statement that this repo is unpackaged or performance-careless.
• PF2 Allocation hygiene — Performance was not assessed: this lens reads a source model that was not loaded for this repository, because the repository is written in a language this lens does not yet model or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository — in particular it is NOT a statement that this repo is unpackaged or performance-careless.
• PF3 Async & latency hygiene — Performance was not assessed: this lens reads a source model that was not loaded for this repository, because the repository is written in a language this lens does not yet model or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository — in particular it is NOT a statement that this repo is unpackaged or performance-careless.
• S1 Web-Security Posture — Not assessed: these web-security controls are read from C# source (attributes, middleware, entity/column names, guard methods) and no C# source was loaded for this repository — because it is written in another language, or the solution failed to load. Absence of a .NET idiom is NOT evidence that this repository lacks web-security controls: it may implement them entirely in its own ecosystem. This is a gap in the analyzer's language coverage, not a finding about this repository.
• X1 Async correctness — not analysed — these correctness checks are read from C# source and none was loaded for this repository, because it is written in another language or the solution failed to load. This is a gap in the analyzer, not a finding about this repository
• X2 Cancellation propagation — not analysed — these correctness checks are read from C# source and none was loaded for this repository, because it is written in another language or the solution failed to load. This is a gap in the analyzer, not a finding about this repository
• X3 Exception handling — not analysed — these correctness checks are read from C# source and none was loaded for this repository, because it is written in another language or the solution failed to load. This is a gap in the analyzer, not a finding about this repository
• X4 Structured logging — not analysed — these correctness checks are read from C# source and none was loaded for this repository, because it is written in another language or the solution failed to load. This is a gap in the analyzer, not a finding about this repository
• X5 Nullable reference types — not analysed — these correctness checks are read from C# source and none was loaded for this repository, because it is written in another language or the solution failed to load. This is a gap in the analyzer, not a finding about this repository