Executive summary
jorzel/opentable scores 62 out of 100, but it is rated At risk while a critical security finding is open; the score itself is unchanged.
The weakest lens counts most in the score, and here that is Maturity, which scores 56 and is rated Adequate. Its Architecture documentation dimension scores 0 out of 10, and until that reaches 4, Maturity can't be rated higher than Adequate. The first actions are to record your significant design decisions and to improve Documentation Quality — currently 5.0/10, and if Maturity rose to 70, the score would rise from 62 to about 67.
Four findings are critical: three in Static Analysis (SAST) and one in Dependency Vulnerabilities.
Watchdog couldn't measure 15 dimensions in this code, among them Code Coverage, Test Reliability and ADR Quality, so they are left out of the score. The product code is 388 lines.
Code Health
76
Adequate, capped by Structured logging
Architecture
69
Adequate
Maturity
56
Adequate, capped by Architecture documentation
Production Readiness
67
Adequate, capped by Security & performance tooling
Security and Compliance
93 ★
Exemplary
Domain Modelling
65
Adequate, capped by Encapsulated state
How the score is built: what each lens counts for
The lenses don't count equally. The weakest lens counts most, the next weakest a little less, and so on, so a weak area pulls the score down instead of being averaged away. In the bar below, each part's width shows how much that lens counts and its colour shows its rating. Improving the widest part moves the score most, and as that lens improves, it counts for less, because another lens becomes the weakest.
Maturity 56 · counts for 46%Domain Modelling 65 · counts for 25%Production Readiness 67 · counts for 14%Architecture 69 · counts for 8%Code Health 76 · counts for 4%Security and Compliance 93 · counts for 2%
If Maturity rose from 56 to 70, the lowest score rated Strong, the score would rise from 62 to about 67.
Code composition: what the lines of code are
Product code 66%Tests 34%
New since the last survey: 1 finding
- Supply-chain Provenance & Signing · REDACTED
Fixed since the last survey: 1 finding
- Supply-chain Provenance & Signing REDACTED
Rebuild cost: about €890 · Estimate
| Cost to rebuild | €290 to €1,500, for 5 to 16 hours of work, about 0.1 person-years for one engineer |
|---|---|
| Difficulty of the problem | High, judged from the kind of software and how it is built. Code that solves a harder problem, such as payments or medical bookings, costs more per line to write. |
| Quality factor | ×0.9 at a score of 62. Better code takes more work to write, so the factor is ×1.0 at a score of 70, lower below it and higher above it. |
| Size | Very small: 388 lines of product code |
Top priorities
1
Record your significant design decisions.
Write one short document per decision, giving its date, the situation, the decision and its consequences, and keep them together with your other design documents. A docs/adr folder with each file named by number and title is the easiest place to find them.
2
Improve Documentation Quality — currently 5.0/10.
3
Add an 'Architecture' / 'How it works' section to the root README — the high-level shape.
Diagnosis: what the measurements show together
If you do one thing first
Record your significant design decisions. Of all the actions in this report, it raises the score most for the work it takes: about 6 points for medium effort. The next survey will show the change in the score.
Architecture: which parts of the code depend on which
| uses → | 1 api.nameko.audit | 2 api.nameko.booking | 3 application.handlers | 4 application.uow | 5 domain.commands | 6 domain.entities.table | 7 domain.events | 8 domain.events.publisher | 9 domain.repository | 10 infrastructure.db.sqlalchemy | 11 infrastructure.events | 12 application.services.booking_table | 13 domain.entities.restaurant | 14 domain.events.table | 15 infrastructure.db.memory.uow | 16 infrastructure.db.sqlalchemy.uow | 17 infrastructure.events.local_publisher | 18 infrastructure.events.nameko_publisher | 19 domain | 20 infrastructure.db.memory.repository | 21 infrastructure.db.sqlalchemy.repository |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 api.nameko.audit | |||||||||||||||||||||
| 2 api.nameko.booking | |||||||||||||||||||||
| 3 application.handlers | |||||||||||||||||||||
| 4 application.uow | |||||||||||||||||||||
| 5 domain.commands | |||||||||||||||||||||
| 6 domain.entities.table | |||||||||||||||||||||
| 7 domain.events | |||||||||||||||||||||
| 8 domain.events.publisher | |||||||||||||||||||||
| 9 domain.repository | |||||||||||||||||||||
| 10 infrastructure.db.sqlalchemy | |||||||||||||||||||||
| 11 infrastructure.events | |||||||||||||||||||||
| 12 application.services.booking_table | 1 | 1 | 1 | 1 | |||||||||||||||||
| 13 domain.entities.restaurant | 1 | ||||||||||||||||||||
| 14 domain.events.table | 1 | ||||||||||||||||||||
| 15 infrastructure.db.memory.uow | 1 | ||||||||||||||||||||
| 16 infrastructure.db.sqlalchemy.uow | 1 | ||||||||||||||||||||
| 17 infrastructure.events.local_publisher | 1 | ||||||||||||||||||||
| 18 infrastructure.events.nameko_publisher | 1 | ||||||||||||||||||||
| 19 domain | 1 | 1 | |||||||||||||||||||
| 20 infrastructure.db.memory.repository | 1 | 1 | |||||||||||||||||||
| 21 infrastructure.db.sqlalchemy.repository | 1 | 1 |
Uses a module listed above itPart of a loopThe module itself
12→4 application.services.booking_table uses application.uow✕
- Connections
- 1 pair of types, where a type in application.services.booking_table uses a type in application.uow.
- The types involved
src.application.services.booking_table.BookingTableApplicationService→src.application.uow.UnitOfWork
- Direction
- application.services.booking_table uses application.uow, so a change to application.uow can break application.services.booking_table, while a change to application.services.booking_table can't break application.uow.
- Position
- Below the diagonal: application.services.booking_table uses a module listed above it, which is the healthy direction.
12→5 application.services.booking_table uses domain.commands✕
- Connections
- 1 pair of types, where a type in application.services.booking_table uses a type in domain.commands.
- The types involved
src.application.services.booking_table.BookingTableApplicationService→src.domain.commands.BookTableCommand
- Direction
- application.services.booking_table uses domain.commands, so a change to domain.commands can break application.services.booking_table, while a change to application.services.booking_table can't break domain.commands.
- Position
- Below the diagonal: application.services.booking_table uses a module listed above it, which is the healthy direction.
12→8 application.services.booking_table uses domain.events.publisher✕
- Connections
- 1 pair of types, where a type in application.services.booking_table uses a type in domain.events.publisher.
- The types involved
src.application.services.booking_table.BookingTableApplicationService→src.domain.events.publisher.EventPublisher
- Direction
- application.services.booking_table uses domain.events.publisher, so a change to domain.events.publisher can break application.services.booking_table, while a change to application.services.booking_table can't break domain.events.publisher.
- Position
- Below the diagonal: application.services.booking_table uses a module listed above it, which is the healthy direction.
12→9 application.services.booking_table uses domain.repository✕
- Connections
- 1 pair of types, where a type in application.services.booking_table uses a type in domain.repository.
- The types involved
src.application.services.booking_table.BookingTableApplicationService→src.domain.repository.RestaurantRepository
- Direction
- application.services.booking_table uses domain.repository, so a change to domain.repository can break application.services.booking_table, while a change to application.services.booking_table can't break domain.repository.
- Position
- Below the diagonal: application.services.booking_table uses a module listed above it, which is the healthy direction.
13→7 domain.entities.restaurant uses domain.events✕
- Connections
- 1 pair of types, where a type in domain.entities.restaurant uses a type in domain.events.
- The types involved
src.domain.entities.restaurant.Restaurant→src.domain.events.DomainEventMixin
- Direction
- domain.entities.restaurant uses domain.events, so a change to domain.events can break domain.entities.restaurant, while a change to domain.entities.restaurant can't break domain.events.
- Position
- Below the diagonal: domain.entities.restaurant uses a module listed above it, which is the healthy direction.
14→7 domain.events.table uses domain.events✕
- Connections
- 1 pair of types, where a type in domain.events.table uses a type in domain.events.
- The types involved
src.domain.events.table.BookedTableEvent→src.domain.events.DomainEvent
- Direction
- domain.events.table uses domain.events, so a change to domain.events can break domain.events.table, while a change to domain.events.table can't break domain.events.
- Position
- Below the diagonal: domain.events.table uses a module listed above it, which is the healthy direction.
15→4 infrastructure.db.memory.uow uses application.uow✕
- Connections
- 1 pair of types, where a type in infrastructure.db.memory.uow uses a type in application.uow.
- The types involved
src.infrastructure.db.memory.uow.FakeUnitOfWork→src.application.uow.UnitOfWork
- Direction
- infrastructure.db.memory.uow uses application.uow, so a change to application.uow can break infrastructure.db.memory.uow, while a change to infrastructure.db.memory.uow can't break application.uow.
- Position
- Below the diagonal: infrastructure.db.memory.uow uses a module listed above it, which is the healthy direction.
16→4 infrastructure.db.sqlalchemy.uow uses application.uow✕
- Connections
- 1 pair of types, where a type in infrastructure.db.sqlalchemy.uow uses a type in application.uow.
- The types involved
src.infrastructure.db.sqlalchemy.uow.SQLAlchemyUnitOfWork→src.application.uow.UnitOfWork
- Direction
- infrastructure.db.sqlalchemy.uow uses application.uow, so a change to application.uow can break infrastructure.db.sqlalchemy.uow, while a change to infrastructure.db.sqlalchemy.uow can't break application.uow.
- Position
- Below the diagonal: infrastructure.db.sqlalchemy.uow uses a module listed above it, which is the healthy direction.
17→8 infrastructure.events.local_publisher uses domain.events.publisher✕
- Connections
- 1 pair of types, where a type in infrastructure.events.local_publisher uses a type in domain.events.publisher.
- The types involved
src.infrastructure.events.local_publisher.LocalEventPublisher→src.domain.events.publisher.EventPublisher
- Direction
- infrastructure.events.local_publisher uses domain.events.publisher, so a change to domain.events.publisher can break infrastructure.events.local_publisher, while a change to infrastructure.events.local_publisher can't break domain.events.publisher.
- Position
- Below the diagonal: infrastructure.events.local_publisher uses a module listed above it, which is the healthy direction.
18→8 infrastructure.events.nameko_publisher uses domain.events.publisher✕
- Connections
- 1 pair of types, where a type in infrastructure.events.nameko_publisher uses a type in domain.events.publisher.
- The types involved
src.infrastructure.events.nameko_publisher.NamekoEventPublisher→src.domain.events.publisher.EventPublisher
- Direction
- infrastructure.events.nameko_publisher uses domain.events.publisher, so a change to domain.events.publisher can break infrastructure.events.nameko_publisher, while a change to infrastructure.events.nameko_publisher can't break domain.events.publisher.
- Position
- Below the diagonal: infrastructure.events.nameko_publisher uses a module listed above it, which is the healthy direction.
19→6 domain uses domain.entities.table✕
- Connections
- 1 pair of types, where a type in domain uses a type in domain.entities.table.
- The types involved
src.domain.serializers→src.domain.entities.table.Table
- Direction
- domain uses domain.entities.table, so a change to domain.entities.table can break domain, while a change to domain can't break domain.entities.table.
- Position
- Below the diagonal: domain uses a module listed above it, which is the healthy direction.
19→13 domain uses domain.entities.restaurant✕
- Connections
- 1 pair of types, where a type in domain uses a type in domain.entities.restaurant.
- The types involved
src.domain.serializers→src.domain.entities.restaurant.Restaurant
- Direction
- domain uses domain.entities.restaurant, so a change to domain.entities.restaurant can break domain, while a change to domain can't break domain.entities.restaurant.
- Position
- Below the diagonal: domain uses a module listed above it, which is the healthy direction.
20→9 infrastructure.db.memory.repository uses domain.repository✕
- Connections
- 1 pair of types, where a type in infrastructure.db.memory.repository uses a type in domain.repository.
- The types involved
src.infrastructure.db.memory.repository.MemoryRestaurantRepository→src.domain.repository.RestaurantRepository
- Direction
- infrastructure.db.memory.repository uses domain.repository, so a change to domain.repository can break infrastructure.db.memory.repository, while a change to infrastructure.db.memory.repository can't break domain.repository.
- Position
- Below the diagonal: infrastructure.db.memory.repository uses a module listed above it, which is the healthy direction.
20→13 infrastructure.db.memory.repository uses domain.entities.restaurant✕
- Connections
- 1 pair of types, where a type in infrastructure.db.memory.repository uses a type in domain.entities.restaurant.
- The types involved
src.infrastructure.db.memory.repository.MemoryRestaurantRepository→src.domain.entities.restaurant.Restaurant
- Direction
- infrastructure.db.memory.repository uses domain.entities.restaurant, so a change to domain.entities.restaurant can break infrastructure.db.memory.repository, while a change to infrastructure.db.memory.repository can't break domain.entities.restaurant.
- Position
- Below the diagonal: infrastructure.db.memory.repository uses a module listed above it, which is the healthy direction.
21→9 infrastructure.db.sqlalchemy.repository uses domain.repository✕
- Connections
- 1 pair of types, where a type in infrastructure.db.sqlalchemy.repository uses a type in domain.repository.
- The types involved
src.infrastructure.db.sqlalchemy.repository.SQLAlchemyRestaurantRepository→src.domain.repository.RestaurantRepository
- Direction
- infrastructure.db.sqlalchemy.repository uses domain.repository, so a change to domain.repository can break infrastructure.db.sqlalchemy.repository, while a change to infrastructure.db.sqlalchemy.repository can't break domain.repository.
- Position
- Below the diagonal: infrastructure.db.sqlalchemy.repository uses a module listed above it, which is the healthy direction.
21→13 infrastructure.db.sqlalchemy.repository uses domain.entities.restaurant✕
- Connections
- 1 pair of types, where a type in infrastructure.db.sqlalchemy.repository uses a type in domain.entities.restaurant.
- The types involved
src.infrastructure.db.sqlalchemy.repository.SQLAlchemyRestaurantRepository→src.domain.entities.restaurant.Restaurant
- Direction
- infrastructure.db.sqlalchemy.repository uses domain.entities.restaurant, so a change to domain.entities.restaurant can break infrastructure.db.sqlalchemy.repository, while a change to infrastructure.db.sqlalchemy.repository can't break domain.entities.restaurant.
- Position
- Below the diagonal: infrastructure.db.sqlalchemy.repository uses a module listed above it, which is the healthy direction.
At a glance — Code Health
The Good
D1 · Python
Cyclomatic Complexity
10.0
D2 · Python
Cognitive Complexity
10.0
D3 · Python
God Classes
10.0
D4 · Python
Code Duplication
10.0
D17 · Python
Explicit Debt
10.0
X1 · Repo
Async correctness
10.0
X12 · Repo
Unreachable branch
10.0
X13 · Repo
Undrained process stream
10.0
X19 · Repo
Unrestored process-global state
10.0
X21 · Repo
Side-effecting pattern guard
10.0
X22 · Repo
Contradicted release guard
10.0
X23 · Repo
Unguarded diagnostic materialisation
10.0
X25 · Repo
Inert configuration knob
10.0
X26 · Repo
Unsynchronised callback handoff
10.0
X27 · Repo
Collection changed while being enumerated
10.0
X28 · Repo
Index access outside its own emptiness guard
10.0
X3 · Repo
Exception handling
10.0
X30 · Repo
Support guard that admits what it rejects
10.0
The Ugly
At a glance — Architecture
The Good
The Bad
At a glance — Maturity
The Good
At a glance — Readiness
The Good
At a glance — Security
The Good
D28 · Python
Secrets (history)
10.0
D29 · Python
Static Analysis (SAST)
7.6
D30 · Python
Dependency Vulnerabilities
8.8
D43 · Python
Malicious Dependencies
10.0
D44 · Python
Platform End-of-Life
10.0
X14 · Repo
Bypassable address classification
10.0
X15 · Repo
Unvalidated length from an untrusted reader
10.0
X17 · Repo
Uncapped recursion over a caller-supplied document
10.0
X24 · Repo
Document value interpolated into markup unescaped
10.0
At a glance — Domain Modelling
The Good
The Ugly
Security & Compliance — OWASP Top-10 mapping
| OWASP category | Findings | Severity |
|---|---|---|
| A05:2025 — Injection | 5 | High / Critical |
| A03:2025 — Software Supply Chain Failures | 1 | High / Critical |
Roadmap
Begin by establishing architectural clarity through concise decision records in a dedicated folder and by expanding the root README to explain the high-level design. Strengthen data integrity by restricting entity state mutation to private setters and invariant-enforcing methods. Finally, secure the development pipeline by integrating static analysis into CI to prevent security regressions from reaching production.
| Do this | Helps | Effort | Dimension |
|---|---|---|---|
| Record your significant design decisions. Write one short document per decision, giving its date, the situation, the decision and its consequences, and keep them together with your other design documents. A docs/adr folder with each file named by number and title is the easiest place to find them. | +6.0 pts | Medium | Architecture documentation |
| Improve Documentation Quality — currently 5.0/10. | +5.6 pts | Medium | Documentation Quality |
| Add an 'Architecture' / 'How it works' section to the root README — the high-level shape. | +3.4 pts | Medium | Documentation (README) |
| Make entity setters private/init-only and hand collections out as IReadOnlyList/IReadOnlyCollection over a private backing field; change state only through methods that enforce the invariants (Marten/EF can bind via constructor or private setters). | +2.0 pts | Medium | Encapsulated state |
| Add a SAST step to CI running what this repository's stack ships: bandit, `semgrep --config=p/python`, or CodeQL's python pack — so a security regression fails the build instead of landing. | +1.7 pts | Medium | Security & performance tooling |
| Give each aggregate one way in that can refuse — a guarded constructor, value-object parameters that validate themselves, or a private constructor behind a factory that returns a failure. | +1.2 pts | Medium | Constructible invalid state |
| Interpolated log message defeats structured logging | +0.9 pts | Medium | Structured logging |
| Resolve the 1 REDACTED finding(s) in Static Analysis (SAST) — start with REDACTED. | +0.1 pts | Low | Static Analysis (SAST) |
File quality
| File | Score | Band | Worst signal |
|---|---|---|---|
| REDACTED | 1.4 | Slop | Static Analysis (SAST): High: REDACTED |
| REDACTED | 7.2 | Mixed | Dependency Vulnerabilities: Critical CVE: REDACTED |
How the grades work
Critical — 4
A definite problem that already costs you something and drags the score down: a missing authorisation check, a dependency with a known exploit, a build that does not reproduce. Failure here tends to cause failures elsewhere.
Serious — 6
Likely wrong, but not failing yet. It degrades the codebase over a longer horizon and can cause failures elsewhere — not urgent this week, not something to carry for two years either.
Minor — 8
Recorded, with no effect on how the codebase functions. Present so the survey is complete, not because it needs doing.
Could not be resolved — 18
Something this survey could not settle from the outside, and which could be critical or serious. Either a control was required and no positive evidence of it exists in the repository — a backup job that nothing shows was ever restored from proves nothing about restores — or our own analysis could not run over that part of the tree. This is not a clean result. These are excluded from the score rather than awarded a pass, so the number on the cover neither rewards nor penalises them: if you act on this survey without resolving them, you carry that risk yourself. Each one is named under Limitations.
Methodology & how to trust this report
Watchdog is a deep, periodic assessment — run each sprint, monthly, or quarterly, taking the time to go wider and deeper than a quick check and surfacing in one coherent report what you'd otherwise piece together from a dozen separate tools. It scores deterministically: the same commit yields the same score, every run. 55 of 58 evaluated dimensions are computed purely by tools and static analysis (confidence 1.0); 3 documentation/naming judgement(s) are LLM-assisted and labelled advisory. Overall confidence is 0.8 — the weighted average across measured dimensions; it falls as more of the score leans on LLM-assisted judgement and rises when it's fully tool-backed.
What we checked — 58 dimensions across the health lenses
D1D2D3D4D5D6D9D12D13D14D15D17D19D21D26D28D29D30D35D43D44AX10AX3AX4AX5AX8DM1DM11DM12DM4DM5DM6DM8DM9M1M2M3M4P1P3X1X12X13X14X15X17X19X21X22X23X24X25X26X27X28X3X30X4
How to trust any code-health report — three questions
- Can you open the finding? Real findings cite a repo-relative file and line you can open at the cited line — never an absolute scratch path. Here, 12 of 18 do; the remainder are repo-wide signals — a dimension-level measurement, not a single line.
- Is there a tool behind the number? Every score below names the method that produced it — Roslyn, git, a scanner, or (for a handful of documentation/naming dimensions) an LLM labelled sampled · advisory — not a narrative.
- Does re-running give the same result? Run it again on the same commit and the score — and this report, byte for byte — is identical. A report whose numbers move between runs is describing the run, not the code.
Tools & methods
| Method | Backs | Version | Evaluator |
|---|---|---|---|
| Roslyn static analysis | Complexity, cohesion, coupling, dead code, API surface, layering | 5.3.0 | ✓ deterministic |
| Native secret scanner | Hardcoded secrets / credentials | 1.0.0 | ✓ deterministic |
| Watchdog duplication detector (in-process) | Code duplication | 1.0.0 | ✓ deterministic |
| Coverage (coverlet / dotnet-coverage) | Line & branch coverage | 10.0.400 | ✓ deterministic |
| NuGet / dotnet | Outdated, vulnerable & deprecated dependencies | 10.0.400 | ✓ deterministic |
| git / LibGit2Sharp | Churn hotspots, knowledge concentration, history | 2.43.0 · 0.31.0 | ✓ deterministic |
| gitleaks · semgrep · trivy | Secrets in history, SAST, CVEs, IaC & container, PII / GDPR | 1.86.0 · 0.69.3 | ✓ deterministic |
| LLM (sampled · advisory) | Documentation quality, ADR conformance, naming — sampled over a bounded sample; advisory, never a deterministic measurement | Local LLM | ◐ LLM · sampled · advisory |
Run transparency — what happened this run
- D8 Code Coverage — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. Coverage NOT MEASURED: test source is present (.py) but the built-in coverage collector has no runner for this repository's ecosystem — so this suite was never executed by it. Not scored — this is a gap in the analyzer's language coverage, not a defect in the repo. To have real coverage read, produce a coverage report in a standard format (`coverage run -m pytest` then `coverage xml`) and commit it — a hosted scan measures a clone of the repository, so a report that exists only in a working tree, a CI runner's or your own, never reaches it; the artefact is commonly gitignored, so `git add -f` that one file (or un-ignore its path) and commit it alongside the code it measures. You can widen what we reach: optional: produce a coverage report in a standard format (`coverage run -m pytest` then `coverage xml`) and commit it — a hosted scan measures a clone of the repository, so a report that exists only in a working tree, a CI runner's or your own, never reaches it; the artefact is commonly gitignored, so `git add -f` that one file (or un-ignore its path) and commit it alongside the code it measures — then the real number is read on the next scan.
- D11 Test Reliability — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. Test source is present (.py) and this repository declares a Python test suite (repository root, 6 test files), but it was not re-run: no test result was produced. Not scored — this is a gap in the analyzer's language coverage, not a finding about this repository.
- D16 Bus Factor — not measured this run — This is a true statement about the repository that carries nothing for its owner to act on, so it is reported here rather than as a defect in their code. Single-contributor repository — bus factor is not applicable (1 contributor(s) across 54 commit(s) sampled, automation and bot accounts excluded). Concentration needs a team to concentrate: with one contributor there is nobody to spread the knowledge to, so there is nothing here for the owner to act on.
- D20 ADR Quality — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. The ADR expectation is gated on whether a repository ships a deployable product. Our repo-kind classifier reads .NET project files and the host and package markers of the other ecosystems it knows (a Go `package main`, a Cargo binary, a package.json `bin`, `start` script or application dev server such as Vite or Next, Python console scripts or a Django/WSGI entry point, a Spring Boot / WAR / Gradle application build, a Rack or Rails app, a Composer project, an OTP release or escript, a Dockerfile, a Procfile, a Platform.sh `.platform/routes.yaml`, and the corresponding published-package manifests, including an OTP `*.app.src`, a Drupal module's `*.info` and a Claude Code `.claude-plugin/plugin.json`), and found none here, so we could not tell what kind of repository this is and did not assess its ADR log. This is a gap in our analyzer, not a finding about this repository.
- D22 Internal API Consistency — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. D22 identifies the intentionally-exposed surface from `IsPackable` and `.Contracts` project names, MSBuild conventions read off the loaded project set. This target exposed no such projects, so the probe never ran; this says nothing about whether the repository has a public API. This repository commits no C#/VB source at all, so there was never an MSBuild project set to read these conventions off. That is OUR side and it is an ADMISSION gap, not an environment fault: no published-package marker D22 reads admitted any project here. D22 DOES collect the public API of every language in this tree, and admits a project only when its manifest makes that ecosystem's publication act in a form the marker recognises — so what is missing is not a collector but an admission rule for the publication act this repository makes, if it makes one. The remedy is a better discriminator for that marker — not a collector, and no change to the scan image can close it. The marker's rules are measured to refuse applications, so one refused repository is the rule working as calibrated; several are the evidence that it is too strict.
- D27 Navigability — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. Navigability is taken over call sites whose callee resolved. For C# that population includes calls into referenced assemblies; for this language only calls declared inside the repository count, so the abstention threshold reads the repository's use of its standard library as a resolution failure. That is a limit of this analyzer, not a build problem in this repository.
- D34 Knowledge Freshness — not measured this run — This is a true statement about the repository that carries nothing for its owner to act on, so it is reported here rather than as a defect in their code. All 33 production source file(s) in this repository were read, and every one is under the ~2,400-byte (~100-line) size floor this dimension measures over (or declares itself generated), so there is no significant file to judge and knowledge freshness is not applicable. This is the size of the repository's files, not a file the engine failed to read.
- AX6 Interface segregation — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check is computed over the public interfaces this run's compilations declare, and none was loaded, so it had nothing to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- C1 Data Protection — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. These personal data controls are read from declarative annotations, request middleware, entity/column names and guard methods in a C# source model, and none was loaded on this run, so there was nothing to gather. That is a gap in this analyzer's language reach — not a finding that the repository lacks personal data controls.
- DM9 Scattered domain decisions — measured, with a gap in what it reached — Watchdog measured this, but not all of it. What it did not reach is a gap on our side — a collector, parser or image we have not built yet — so the numbers on that dimension cover less than the repository, and the part left out is not evidence that it would have passed. Arm two tells a construction that PRODUCES a measurement from one that merely passes it along, and this repository's frontend does not compute that fact. A measurement built independently in two places would not appear above.
- GD1 Unfinished & placeholder code — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, F#, JavaScript/TypeScript, Dart, Ruby and Scala source only, and no C#, F#, JavaScript/TypeScript, Dart, Ruby or Scala was found, and this repository's Python is not read yet, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- IC1 Incompleteness & stubs — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, JavaScript/TypeScript, Java, Dart, Ruby and Scala source only, and no C#, JavaScript/TypeScript, Java, Dart, Ruby or Scala was found, and this repository's Python is not read yet, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- P8 Schema migrations — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. The schema may be created by a runner, a deploy script or a config file outside what this check reads, so an absence here is our blind spot rather than a missing migration strategy. The card abstains instead of scoring. You can widen what we reach: if the schema is created and evolved by a tool this check does not name, naming it lets us teach the detector to read it.
- S1 Web-Security Posture — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. These web-security controls are read from declarative annotations, request middleware, entity/column names and guard methods in a C# source model, and none was loaded on this run, so there was nothing to gather. That is a gap in this analyzer's language reach — not a finding that the repository lacks web-security controls.
- X16 Unfloored truncation loop — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript, Java, PHP, Dart, Ruby, Scala and Kotlin source only, and no C# was loaded and no JavaScript/TypeScript, Java, PHP, Dart, Ruby, Scala or Kotlin was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- X18 Disposal-pattern correctness — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript, Java, Kotlin, Dart, Ruby, Scala and PHP source only, and no C# was loaded and no JavaScript/TypeScript, Java, Kotlin, Dart, Ruby, Scala or PHP was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- X29 Per-element action decided by a fixed element — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax, and JavaScript/TypeScript, Java, Rust, Dart, Ruby, Scala and Kotlin source only, and no C# was loaded and no JavaScript/TypeScript, Java, Rust, Dart, Ruby, Scala or Kotlin was found in this repository, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
- X5 Nullable reference types — not measured this run — Watchdog could not measure this here. That is a gap on our side — a collector, parser or image we have not built yet — and it is neither a defect in this repository nor evidence that the check would have passed. This check reads C# syntax and MSBuild project configuration, TypeScript source and its tsconfig files, Java source and its package and module declarations, PHP source and its PHPStan and Psalm configuration, Dart source and its pubspec language version, Ruby source and its Sorbet and Steep configuration, Scala source and its build's explicit-nulls, WartRemover and Scalafix settings, and Kotlin source only, and no C# was loaded, no TypeScript was found, and this repository's Python is not read yet, so it had nothing of this repository's product to read. That is a gap in this analyzer's language reach — not a finding that the repository is free of what this check looks for.
Limitations & what we did not check
Watchdog assesses the repository exactly as committed, and only the repository. By design it does not reach outside the source tree: the live cloud account, the running CI/CD pipeline, the host's branch-protection and approval rules, the production configuration, or a restore actually exercised against a backup are all out of scope. That boundary is a feature, not a gap — a repo-relative, deterministic scan re-runs identically on any commit and every finding opens at a real file and line, where a live audit can neither be reproduced nor traced. The visible consequence is that controls which leave no in-repo evidence are reported as "not evidenced" and excluded from the score rather than awarded a number a static scan cannot justify.
Per-dimension blind spots
- D1 Cyclomatic Complexity: Cyclomatic complexity counts branches statically — it cannot tell an essential decision tree from accidental tangle, nor see complexity that lives in data or configuration (large switch-case token tables, DSL lexers/parsers, data-as-code rule tables) rather than control flow: a tokenizer's many single-character cases read as high complexity though each branch is trivial.
- D2 Cognitive Complexity: Cognitive-complexity heuristics approximate how hard code is to follow; genuine domain difficulty and well-named intent that eases reading are not captured.
- D3 God Classes: "God class" is sized by members and responsibilities visible in the type — a deliberately broad facade over a coherent subsystem can read the same as an accidental grab-bag. For front-end JS the file-length check is cohesion-aware (a single-responsibility module — one class/IIFE — earns a 3× threshold), but cohesion is approximated from top-level declarations, not true dependency structure.
- D4 Code Duplication: Duplication is token-similarity — an in-process token-stream comparison over sliding windows, with type-aware normalization — so it finds copy-paste, not semantic duplication expressed differently. Committed machine-written code (scaffolded migrations, designer/codegen output, protobuf/OpenAPI stubs, model snapshots) is EXCLUDED — its repetition is the tool's, not the team's — so the score reflects hand-written duplication only.
- D5 Coupling: Coupling is measured between projects/assemblies — runtime coupling through DI, reflection, messaging or shared databases is invisible to a static reference graph.
- D6 Cohesion (LCOM4): LCOM4 cohesion is syntactic — it infers connectivity from which methods touch which fields/methods by name, not from real runtime behaviour or intent.
- D9 Test Distribution: The test-pyramid shape is inferred from project/folder naming and references, with a single test host bucketed per-file by its path tier and content signals — a suite that names tiers unconventionally and gives no per-file signal can still be mis-bucketed.
- D12 Dependency Hygiene: Dependency health reads manifests and lockfiles — a vulnerability in a vendored/copied dependency, or risk from how a dependency is actually used, is outside this view.
- D13 Secret Scanning: Secret detection is signature- and entropy-based on the current tree — a secret that does not match a known pattern, or one already rotated, will not be flagged (a clean scan is "nothing matched", not "no secrets exist").
- D14 License Compliance: License compatibility is checked against declared package metadata and a policy — mislabelled or missing license metadata, and obligations that depend on how you distribute, are not resolved here.
- D15 Churn × Complexity Hotspots: Churn hotspots come from git history — a freshly imported or squashed repository has no churn signal, and recent rewrites can mask a historically risky file.
- D17 Explicit Debt: Acknowledged-debt signals (TODO/FIXME, suppressions, dead code) are textual — undocumented debt that nobody marked, and debt that lives in design rather than annotations, is invisible. Committed machine-written code (scaffolded migrations, designer/codegen output, generated stubs) is excluded — it is never the team's dead code to delete.
- D19 Documentation Quality: Documentation quality is judged by an LLM over a bounded sample of docs — it reads what is written, not whether the docs match the running system, and it is advisory, not a measurement. Its critique rows are drawn from a closed category vocabulary and each row means the same thing in every run, so two scans can be compared row by row; the SET that fires is still a sample, and does not repeat exactly. Measured on one frozen input, six scans at one engine SHA: 2-5 critique rows per scan, 8 distinct rows across the six, 3 of those 8 seen in only one scan. So a D19 row is evidence about the documentation, but a COUNT of D19 rows is not a quantity — never read a change in it as an improvement or a regression.
- D21 Naming Consistency: Naming quality is an LLM judgement over a bounded sample — it assesses clarity/consistency of the names it sees, not domain-correctness, and is advisory.
- D26 Project Cohesion: Project focus is sized from members/namespaces per project — a project that is broad by deliberate design reads the same as one that has sprawled.
- D28 Secrets (history): Secret-history scanning sweeps the git log for known patterns — a secret that predates the available history, or never matched a signature, is not found (clean means "nothing matched in the history we can see").
- D29 Static Analysis (SAST): SAST findings are pattern-based (semgrep) — it finds classes of bug it has rules for; logic flaws, auth/authorization gaps and issues needing runtime context are out of reach (and clean means "no rule matched").
- D30 Dependency Vulnerabilities: CVE matching depends on accurate package/version metadata and on the advisory databases — a vulnerability with no published advisory, or in code not declared as a dependency, is not seen. Coverage needs a RESOLVED graph: an unpinned REDACTED, or a pom without a resolved build, yields partial coverage rather than a clean verdict. An ecosystem the analyzer cannot scan is reported as unmeasured, never as clean.
- D35 Change Coupling: Change coupling is co-change in COMMITS — files split across separate commits, or coupled only through a shared config/build step, read as uncoupled, and a sweeping commit (rename/format) is excluded so it doesn't couple everything. It shows that files change together, not WHY: a high coupling can be a healthy cohesive pair as readily as a hidden leak.
- D43 Malicious Dependencies: Only packages some vulnerability database has already NAMED as malicious are seen — a compromise published in the last hours, or never reported at all, is invisible here, and this dimension reading 10 is not evidence that a dependency is trustworthy. There is no typosquat or dependency-confusion analysis: a package nobody has reported is simply absent from the feeds. Coverage is the dependency scan's: an ecosystem that could not be scanned is disclosed as unmeasured, never as clean.
- D44 Platform End-of-Life: The support table is FROZEN, so it goes out of date by losing RECALL: a release that ended support after the table was written is missed until the table is refreshed, and this dimension reading 10 is not evidence that a platform is current. Only platforms the repository DECLARES in a place this pass reads are seen — a runtime named only in a Dockerfile (D31's subject), in a CI workflow (D29's), or in a file this pass does not parse (go.mod, a Gemfile ruby directive) is invisible here, which is why a repository declaring none of them abstains rather than scoring. Only frameworks with a PUBLISHED support policy are tracked: React, Flask and Express publish none, so their age cannot be judged and their absence from a report is not a statement that they are supported.
- AX10 Code composition: Role is inferred from namespace/folder convention, not semantics — a domain concept living in a folder named "Services" reads as application, and the split is lines-of-code, not business value. The business-logic-share score is a SOFT, FLOORED signal: it contributes to the Architecture lens but is floored at the Critical gate, so an infrastructure-heavy design (a gateway, an ETL, a driver) is legitimately low without being nuked to zero.
- DM4 Rich vs anemic model: Behaviour is detected as state mutation inside a method body — a method that enforces an invariant by validating-and-throwing without mutating reads as a query, and mutation delegated through an interface the scan can't resolve isn't credited; entities with zero public properties still drop out of the population. It detects that state changes, not whether the rule is correct.
- DM6 Domain ↔ infrastructure boundary: Infrastructure reached through a hand-rolled wrapper, a domain-named facade, reflection, or a string-keyed service locator resolves to a non-infra type and isn't seen; the body scan is symbol resolution over syntax, not full dataflow. A clean result means "no resolved infra reference in a domain body", not a proof of purity.
- M4 Documentation accuracy: Onboarding quality is an LLM read of the docs/setup present — it cannot run the onboarding or measure how long a real new joiner takes; the verdict is sampled and advisory.
The LLM boundary
Dimensions
D1 · Cyclomatic Complexity
0 method(s) exceeded the cyclomatic complexity threshold of 15.
Do you agree with this assessment?
D2 · Cognitive Complexity
0 method(s) exceeded the cognitive complexity threshold of 15.
Do you agree with this assessment?
D3 · God Classes
0 god class(es) detected.
Do you agree with this assessment?
D4 · Code Duplication
0 duplicated block group(s) detected.
Do you agree with this assessment?
D5 · Coupling
4 production modules (source-import), 0 dependency cycle(s), 0 unstable depended-on module(s). No manifest declares this repository's modules, so the modules are its top-level source directories and the edges the imports between them; 0 module(s) off the main sequence.
Do you agree with this assessment?
D6 · Cohesion (LCOM4)
0 of 3 classes have LCOM4 above 3.
Do you agree with this assessment?
D9 · Test Distribution
12 test methods: 10 unit, 2 integration, 0 BDD, 0 e2e. The Python suite contributes 12 test function(s) across 6 file(s) declaring at least one — every `def test…` in a file pytest or unittest would collect, which is those frameworks' own definition of a case; a parametrize table counts once, so this is a floor. Its tier split is read from file names and paths only.
Do you agree with this assessment?
D12 · Dependency Hygiene
2 outdated, 0 yanked pinned Python distributions. Only EXACT pins are graded for currency: a floor or a range already installs the newest release it admits, so reporting one would report this repository for being current. Whether a deliberate upper cap has itself gone stale is a different and weaker question, and is not asked. Whether any distribution is UNMAINTAINED is not graded — PyPI publishes no maintenance status, and release age does not stand in for one. Lockfiles are not read (poetry.lock, uv.lock, Pipfile.lock, pdm.lock), so a lock-resolved install is outside this verdict. Known CVEs in this dependency graph are D30's question.
Outdated: nameko
Do you agree with this assessment?
D13 · Secret Scanning
Secret scan ran and found no leaked secrets.
Do you agree with this assessment?
D14 · License Compliance
0 of 25 shipped Python distribution(s) use a banned license. Licences were resolved from PyPI over the distributions a consumer installs — this repository's 3 declared runtime requirement(s) closed transitively over each distribution's published `requires_dist` (22 reached that way). Requirements it states ONLY under an extra, a PEP 735 dependency group, a Poetry dev group or a dev-named requirements file are excluded: pip does not install any of them for a consumer. ★ This repository commits no dependency lockfile that this pass reads, so each licence is the one PyPI publishes for the distribution's CURRENT release rather than for a pinned version. 3 of them publish no licence on PyPI this pass can read; that is missing data, not a violation, and none of them is charged.
Do you agree with this assessment?
D15 · Churn × Complexity Hotspots
No churn × complexity hotspots in the window.
Do you agree with this assessment?
D17 · Explicit Debt
0 deducted task-comment markers across 388 LoC (0.0/KLoC) → score 10.0. Task comments only: this repository's language is read without a compiler, so D17's suppression, dead-code and commented-out-code arms did not run and this score counts fewer marker kinds than a .NET repository's would.
Do you agree with this assessment?
D19 · Documentation Quality
The repository's root README is a single cohesive overview of the Ports and Adapters DDD architecture with an internal design rationale (primary vs secondary ports, application core agnosticism), plus install and run commands. It documents what the project does and how to run it, but there are no accompanying files for the architectural principles it claims to explain: the referenced Architecture/Docs markdown files are zero in this summary.
What to do
- Improve Documentation Quality — currently 5.0/10. — The repository's root README is a single cohesive overview of the Ports and Adapters DDD architecture with an internal design rationale (primary vs secondary ports, application core agnosticism), plus install and run commands. It documents what the project does and how to run it, but there are no accompanying files for the architectural principles it claims to explain: the referenced Architecture/Docs markdown files are zero in this summary.
Do you agree with this assessment?
D21 · Naming Consistency
0 naming inconsistencies across 0 sampled symbols.
Do you agree with this assessment?
D26 · Project Cohesion
0 of 2 build units (Python) flagged as possibly oversized/incoherent.
Do you agree with this assessment?
D28 · Secrets (history)
gitleaks scanned the full history AND the current working tree and found no secrets.
Do you agree with this assessment?
D29 · Static Analysis (SAST)
5 finding(s): 0 critical, 3 high, 2 medium, 0 low. 2 unpinned-GitHub-Actions row(s) are reported here but scored by D36 (supply-chain provenance), which measures that posture as `pinned_actions` — one pinning decision is charged once, not once per lens.
REDACTED
REDACTED
REDACTED
What to do
- Resolve the 1 REDACTED finding(s) in Static Analysis (SAST) — start with REDACTED. — One of this dimension's main actionable groups (1 issue-level).
- Resolve the 2 REDACTED finding(s) in Static Analysis (SAST) — start with REDACTED (2). — One of this dimension's main actionable groups (2 warning-level).
- No action in Static Analysis (SAST) — all 2 REDACTED finding(s) are reported here at file:line but scored by D36 (supply-chain provenance), so none is charged to this dimension. — One of this dimension's main actionable groups (2 issue-level, 0 of them charged here).
Do you agree with this assessment?
D30 · Dependency Vulnerabilities
1 finding(s): 1 critical, 0 high, 0 medium, 0 low.
REDACTED
What to do
- Resolve the 1 Critical CVE finding(s) in Dependency Vulnerabilities — start with REDACTED. — One of this dimension's main actionable groups (1 issue-level).
Do you agree with this assessment?
D35 · Change Coupling
No strong hidden change-coupling between production files.
Do you agree with this assessment?
D43 · Malicious Dependencies
No dependency in any ecosystem this repository declares is published as malicious.
Do you agree with this assessment?
D44 · Platform End-of-Life
0 end-of-life runtime(s) and 0 end-of-life framework(s), read from 0 platform declaration(s) and 3 dependency declaration(s). This dimension reads what the repository says about ITSELF — a pinned target framework, a version file, a capped requires-python, a Rust toolchain pin, a framework major a constraint cannot move off. A FLOOR is deliberately never charged: `requires-python = ">=3.8"` states what the package SUPPORTS, not what it runs on, and a well-maintained library declares exactly that while running its own CI on a current release. The end-of-life facts are FROZEN and dated, so this dimension needs no network and answers identically inside a closed scan fence; as the table ages it loses recall and never precision, because a statement about support that ended in the past cannot become false. The OS layer of a container image is D31's question and the toolchain a CI workflow installs is D29's; this row is neither.
Do you agree with this assessment?
Frontend & cross-cutting dimensions
AX10 · Code composition
Do you agree with this assessment?
AX3 · Project dependency cycles
Do you agree with this assessment?
AX4 · Dependency direction
Do you agree with this assessment?
AX5 · Architecture & structure
Do you agree with this assessment?
AX8 · Test isolation
Do you agree with this assessment?
DM1 · Aggregate boundaries
Do you agree with this assessment?
DM11 · Constructible invalid state
- `Table`'s public constructor takes `max_persons` as raw primitives, and neither of the two things that would make that safe was found. What was searched, so you can tell an absence from a miss: for VALIDATION, the constructor body was scanned for `throw`, `Guard.`, `Ensure.`, `ArgumentNullException`, `ArgumentException`, `CheckRule` or `Requires.` — a guard reached through a helper method those tokens do not name is not seen; for a FACTORY, only this type's OWN static members were read, and only names beginning `Create`, `Of`, `From`, `New` or `Build` — one inherited from a base type, one on a companion builder, or one called `Parse`, `Make` or `Rehydrate` is not seen. If either exists, this row is wrong. If neither does, a caller can build a `Table` that breaks the rules it exists to enforce, and every rule downstream then has to cope with a state the model said was impossible. Guard in the constructor, take value objects that validate themselves, or make the constructor private behind a `Create` that can refuse. — src/domain/entities/table.py:13
What to do
- Give each aggregate one way in that can refuse — a guarded constructor, value-object parameters that validate themselves, or a private constructor behind a factory that returns a failure.
Do you agree with this assessment?
DM12 · Ambient inputs in the domain
Do you agree with this assessment?
DM4 · Rich vs anemic model
Do you agree with this assessment?
DM5 · Encapsulated state
- `Restaurant` exposes publicly writable state (id, tables). — src/domain/entities/restaurant.py:10
- `Table` exposes publicly writable state (id, max_persons, is_open). — src/domain/entities/table.py:12
What to do
- Make entity setters private/init-only and hand collections out as IReadOnlyList/IReadOnlyCollection over a private backing field; change state only through methods that enforce the invariants (Marten/EF can bind via constructor or private setters).
Do you agree with this assessment?
DM6 · Domain ↔ infrastructure boundary
Do you agree with this assessment?
DM8 · Value-object opportunities
Do you agree with this assessment?
DM9 · Scattered domain decisions
Do you agree with this assessment?
M1 · Documentation (README)
What to do
- Add an 'Architecture' / 'How it works' section to the root README — the high-level shape.
Do you agree with this assessment?
M2 · Architecture documentation
- No Architecture Decision Records found — no conventional ADR directory, no numbered `NNNN-title` documents in any markup this check reads, and nothing ADR-shaped by content. Design rationale recorded elsewhere (a design-notes tree, a mailing list, pull-request discussion) is not visible to this check and is not re-findable per decision, so a future maintainer cannot ask why one choice was made and get an answer.
- No C4/Structurizr/PlantUML/Mermaid/Graphviz/D2 diagram, no drawn diagram named for the architecture, no file named `architecture` or `design` in any markup this check reads, and nothing in the README, docs or contributor guides that announces the shape — no `## Architecture` heading, no "architecture overview"/"high-level design" phrasing, no "the architecture is …" introduction, no guided code tour. A shape laid out in prose that never names itself as the architecture is not visible to this check, and neither is one kept outside the repository, so this row reports the absence of a re-findable shape document — not evidence that nobody wrote the shape down.
What to do
- Record your significant design decisions. Write one short document per decision, giving its date, the situation, the decision and its consequences, and keep them together with your other design documents. A docs/adr folder with each file named by number and title is the easiest place to find them.
- Add a C4 context/container diagram (Structurizr, PlantUML or Mermaid) or an architecture.md overview.
Do you agree with this assessment?
M3 · Folder & project structure
Do you agree with this assessment?
M4 · Documentation accuracy
Do you agree with this assessment?
P1 · CI/CD gates
Do you agree with this assessment?
P3 · Security & performance tooling
- No static application security testing detected. For this repository's stack, add bandit, `semgrep --config=p/python`, or CodeQL's python pack as a CI step. What was searched, so you can tell an absence from a miss: the 636 CI workflow file(s) in this repository, and the scanner and linter configuration checked in beside them. A scan that runs outside CI, one configured in your forge's web UI rather than in a committed file, or a tool whose name is none of those this check carries, is not seen — if that is your case the row is wrong, and saying so is more useful than adding a second scanner.
What to do
- Add a SAST step to CI running what this repository's stack ships: bandit, `semgrep --config=p/python`, or CodeQL's python pack — so a security regression fails the build instead of landing.
- Enable Dependabot/Renovate or a dependency-review gate.
- Add gitleaks/trufflehog in CI to block PRs that introduce committed secrets.
Do you agree with this assessment?
X1 · Async correctness
Do you agree with this assessment?
X12 · Unreachable branch
Do you agree with this assessment?
X13 · Undrained process stream
Do you agree with this assessment?
X14 · Bypassable address classification
Do you agree with this assessment?
X15 · Unvalidated length from an untrusted reader
Do you agree with this assessment?
X17 · Uncapped recursion over a caller-supplied document
Do you agree with this assessment?
X19 · Unrestored process-global state
Do you agree with this assessment?
X21 · Side-effecting pattern guard
Do you agree with this assessment?
X22 · Contradicted release guard
Do you agree with this assessment?
X23 · Unguarded diagnostic materialisation
Do you agree with this assessment?
X24 · Document value interpolated into markup unescaped
Do you agree with this assessment?
X25 · Inert configuration knob
Do you agree with this assessment?
X26 · Unsynchronised callback handoff
Do you agree with this assessment?
X27 · Collection changed while being enumerated
Do you agree with this assessment?
X28 · Index access outside its own emptiness guard
Do you agree with this assessment?
X3 · Exception handling
Do you agree with this assessment?
X30 · Support guard that admits what it rejects
Do you agree with this assessment?
X4 · Structured logging
- `info` at line 23 is handed an f-string as its message, so the logger receives one finished string — the values in it cannot be queried, filtered or aggregated as fields, every occurrence reads as a different message, and the string is built even when the record is filtered out. Pass the values beside a constant message instead: `logger.info("order %s moved to %s", order_id, status)` with the standard library's `logging`, which keeps the message and its arguments apart on the record, or `log.info("order moved", order_id=order_id, status=status)` with structlog. — src/application/handlers/events.py:23
- `info` at line 10 is handed an f-string as its message, so the logger receives one finished string — the values in it cannot be queried, filtered or aggregated as fields, every occurrence reads as a different message, and the string is built even when the record is filtered out. Pass the values beside a constant message instead: `logger.info("order %s moved to %s", order_id, status)` with the standard library's `logging`, which keeps the message and its arguments apart on the record, or `log.info("order moved", order_id=order_id, status=status)` with structlog. — src/infrastructure/events/local_handler.py:10
What to do
- Interpolated log message defeats structured logging
Do you agree with this assessment?
Reference — by lens
| Lens | Score | Rating | Impact |
|---|---|---|---|
| Code Health | 76% | Adequate — gated by X4 | Capped at Fair by a Critical contributor — resolve it before relying on this lens. |
| Architecture | 69% | Adequate | Acceptable, with room to improve. |
| Maturity | 56% | Adequate — gated by M2 | Capped at Fair by a Critical contributor — resolve it before relying on this lens. |
| Readiness | 67% | Adequate — gated by P3 | Capped at Fair by a Critical contributor — resolve it before relying on this lens. |
| Security | 93% | Exemplary | Strongest area. |
| Domain Modelling | 65% | Adequate — gated by DM5 | Capped at Fair by a Critical contributor — resolve it before relying on this lens. |
Unscored — 1 check(s) recorded observations but carry no score
- D36 Supply-chain Provenance & Signing — 1 observation(s) recorded · The CI pipeline builds and tests but publishes no released artifact — no package publish, container push, GitHub release or deployment step. Supply-chain provenance, signing and SBOM attest RELEASED artifacts, so there is nothing to attest here. Add them to the release pipeline when this repo starts shipping artifacts (a published package, a container image, a deployed service or a tagged release). Build integrity and workflow-token hygiene are reported below: they describe what the CI runs and the token it runs with, neither of which is affected by whether the pipeline ships an artifact.
Not evidenced — 3 control(s) we could not find positive evidence for
- P4 Deployment & Rollback — not evidenced — no deploy/rollback/approval signal in the repo; absence of evidence is not evidence of a manual release
- P5 DR & Backup — not evidenced — repo shows no backup/RTO/RPO controls; absence of evidence is not evidence of a working control
- P6 Release Hygiene — not evidenced — no changelog, version stamp or semver release tag in the repo
Not included — 68 check(s) not relevant to this codebase
- AC1 Text alternatives — No web markup found — accessibility is not applicable to this repository.
- AC2 Forms & labels — No web markup found — accessibility is not applicable to this repository.
- AC3 Page structure — No web markup found — accessibility is not applicable to this repository.
- AC4 Keyboard semantics — No web markup found — accessibility is not applicable to this repository.
- AC5 ARIA correctness — No web markup found — accessibility is not applicable to this repository.
- AC6 Visual & motion safety — No web markup found — accessibility is not applicable to this repository.
- AC7 A11y enforcement — No web markup found — accessibility is not applicable to this repository.
- AX1 Captive dependencies — Not applicable: this repository's Python imports no dependency-injection container and defines no container of its own — nothing that both registers and resolves bindings, and nothing that names two lifetimes — so nothing holds one lifetime's instance while handing out another's.
- AX2 Stateful singletons — No container singleton was found, so there is no shared instance for concurrent requests to race on. No function in this Python code is served by a threaded web framework (a Flask, Bottle or FastAPI route, a Django or Pyramid view), so no module is shared between request threads.
- AX6 Interface segregation — not assessed — interface segregation is computed over a type surface that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- AX7 Slice cohesion — not applicable — not a vertical-slice architecture
- AX9 CQS / query purity — no CQRS query handlers detected — query purity is not applicable to this codebase
- AXB1 Runtime evidence locked — no reproducible boot — This repository has nothing the runtime tiers could boot or serve — no markup, no UI framework or web-server dependency, no UI component source, no native UI project and no API definition — nothing here is a surface to boot — so runtime a11y/egress/header evidence has no subject here. Not applicable: this is neither a gap in the scan nor a finding about your code.
- AXB2 Runtime readiness — Advisory — this card reports evidence and never carries a score, so there is nothing missing here.
- C1 Data Protection — Not assessed: these personal data controls are read from a source model (declarative annotations, request middleware, entity/column names, guard methods) that was not loaded for this repository — because the repository is written in a language this check does not yet model, or because its projects failed to load. Absence of an idiom this check recognises is NOT evidence that this repository lacks personal data controls: it may implement them entirely in its own ecosystem. This is a gap in the analyzer's language coverage, not a finding about this repository.
- C2 Access Controls — No access-control surface detected in the analyzed source — this repository registers no route and starts no server another machine can reach (no Flask/FastAPI/Starlette route, Django urlpatterns or class-based view, Tornado handler). Access control is therefore N/A here — a library or command-line tool is authorized by the application that serves it, not by itself. If this codebase grows request handlers, the dimension reactivates and a default-deny posture is expected then.
- C3 Audit Trail — No personal data detected in a persisted data model — no PII-named field (email, first_name, date_of_birth, phone, …) or stored credential in a Django, SQLAlchemy, SQLModel, Peewee, Tortoise or MongoEngine model, a migration or a SQL schema — and no database or data-store client (Django ORM, SQLAlchemy, psycopg, PyMongo, …) in the source either, so this repository keeps no sensitive data whose changes an audit trail would record. If it does (through a store configured outside this repository, for instance), the trail belongs to wherever that data is stored.
- C4 Data Retention — No personal data detected in a persisted data model — no PII-named field (email, first_name, date_of_birth, phone, …) or stored credential on a Django, SQLAlchemy, SQLModel, Peewee, Tortoise or mongoengine model, in a migration or in a SQL schema — and no database or data-store client (django.db, sqlalchemy, psycopg2, pymongo, sqlite3, …) imported either, so this repository keeps no personal data whose lifetime a retention limit would bound.
- C5 Data-Subject Rights — No personal data detected in a persisted data model — no PII-named field (email, first_name, date_of_birth, phone, …) or stored credential on a Django, SQLAlchemy, SQLModel, Peewee, Tortoise or mongoengine model, in a migration or in a SQL schema — and no database or data-store client (django.db, sqlalchemy, psycopg2, pymongo, sqlite3, …) imported either, so this repository keeps no personal data for a data subject to erase, export or consent over.
- D10 Test Quality — ~197 lines of test source are present (.py) but no test cases reached the test census for this repository — no test root we could resolve declared them, or the files we read declare no cases in a test framework we recognise — so skipped/assertion-free tests couldn't be counted. Not scored — this is a gap in the analyzer, not a finding about this repository.
- D11 Test Reliability — Test reliability not included — the .py suite was found but not re-run
- D16 Bus Factor — single-contributor repository — bus factor is not applicable
- D18 Solution Shape — D18 scores the shape of a .NET solution; this repository has no .NET solution or project files, so the dimension does not apply.
- D20 ADR Quality — Repository kind not determined
- D22 Internal API Consistency — The exposed public-API surface could not be collected — no C#/VB projects loaded.
- D23 Boundary Type-Coupling — No bounded-context organisation was detected either — neither a context-shaped layout, nor 2+ sibling source directories each declaring an aggregate root, nor 2+ projects each declaring an entity of their own. Aggregate roots were found in only one source directory (domain), which is a layered codebase, not two contexts. Declaring this codebase's bounded contexts (≥2) would let cross-boundary type coupling be assessed. Declare them in `.codehealth/config.yaml` at the repository root (create it if absent), mapping each context name to the module-path or namespace prefixes that belong to it — e.g. `architecture:` → `contexts:` → `Billing: ["src/billing", "Acme.Billing"]`, `Catalog: ["src/catalog", "Acme.Catalog"]`.
- D24 Comment Value — No inline comments to assess — comment value is not applicable here.
- D25 ADR Conformance — no ADRs to check
- D27 Navigability — D27 counts a call into the standard library or a dependency as unresolved for this repository's language (.py), so too few call sites counted as resolved to assess navigability. Not scored: this is a gap in the analyzer, not a verdict about this repository.
- D31 IaC & Container Security — No Infrastructure-as-Code or container manifests found (Dockerfile, Docker Compose, Terraform, Kubernetes/Helm, CloudFormation, ARM, Bicep, Ansible); nothing to scan.
- D32 Data Compliance (PII/GDPR) — No personal data was found crossing a boundary the PII/GDPR ruleset checks — nothing written to a log or console sink, placed in a URL or query string, or persisted to browser storage. That is a clean result for the LEAK surface only: this ruleset detects personal data escaping, it does not inventory the personal data a repository holds, so it is not evidence that this repository has no personal-data surface. The personal-data map (Appendix C) and the C1-C5 compliance cards are what speak to that.
- D34 Knowledge Freshness — every production source file is under the ~100-line size floor — too little code for knowledge freshness to be judged
- D37 Vulnerability-disclosure Policy — No vulnerability-disclosure policy file found (SECURITY.md/.markdown/.rst/.txt at root or under .github/.forgejo/.gitea/docs, .well-known/security.txt). A coordinated-disclosure policy may live off-repo, so this is not evidenced rather than failed.
- D39 IL Efficiency — D39 measures the IL emitted by a .NET build; this repository has no .NET solution or project files, so the dimension does not apply.
- D40 Network Egress Confinement — No Kubernetes/orchestration workloads found in the repository manifests; network egress policy is a cluster-native control that may live at the platform/firewall layer, so there is nothing to assess here.
- D41 Kernel & Syscall Confinement — No Kubernetes/orchestration workloads found in the repository manifests; seccomp/AppArmor/SELinux confinement is a workload-level control, so there is nothing to assess here.
- D42 Runtime Threat Enforcement — No Kubernetes/orchestration workloads found in the repository manifests; runtime threat-detection and admission-control policy are cluster-level controls, so there is nothing to assess here.
- D7 Architectural Integrity — no checkable ADRs, and no project-reference graph for the cycle pass to read — so this dimension makes no claim about dependency cycles in either direction (where this repository's language has an import-cycle lens, cycles are reported there). Architectural integrity not assessed
- D8 Code Coverage — Coverage not included — suite not readable by the collector
- DM10 One transaction, one aggregate — no repository writes detected — no operation to judge against the one-aggregate rule
- DM2 Strongly-typed ids — no id-bearing domain types detected — strongly-typed-id adoption not assessable
- DM3 Integration-event coupling — no integration events detected — coupling check not applicable
- DM7 Repository granularity — no repository abstraction detected (e.g. uses a document session)
- ED1 Event-Driven — not scored — this repository shows none of the 3 signals this lens looks for
- ED5 Idempotency — no mutating command handlers or message consumers detected — idempotency check not applicable
- ES1 Event Sourcing — not scored — this repository shows none of the 3 signals this lens looks for
- GD1 Unfinished & placeholder code — no source files were read — this check reads C#, F#, JavaScript/TypeScript, Dart, Ruby and Scala, and none was read for this repository's product. That is a limit of the analyzer, not a finding about your code.
- IC1 Incompleteness & stubs — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- P12 CI test-gate honesty — Reported, not scored — and nothing was matched here. The coverage check applies to any stack, and the automatic-re-run check to any GitHub-Actions workflow, but the checks for excluded tests, skipped tests and sleep-based synchronisation currently recognise only some ecosystems' test-runner idioms, so on a repository built with another stack the zeros below mean 'not checked', not 'clean'.
- P2 Observability — This repository's Python source (2 module(s), 33 file(s) read) declares no entry point and bootstraps no server, and nothing here deploys a service — it is a library, run inside whatever hosts it, so production observability (structured logging, tracing/metrics, health checks) is N/A. If it grows a binary or a service, the dimension reactivates.
- P7 Outbound HTTP resilience — not applicable — no HTTP server, API framework or worker entry point was found in the Python source, so there is no service whose uptime a failing dependency could take down
- P8 Schema migrations — SQLAlchemy is declared, but the schema-migration mechanism could not be identified. Our limit, not a verdict on this repository.
- P9 Domain vs controller coverage — no coverage report found on disk — produce a coverage report in a standard format (`coverage run -m pytest` then `coverage xml`) and commit it — a hosted scan measures a clone of the repository, so a report that exists only in a working tree, a CI runner's or your own, never reaches it; the artefact is commonly gitignored, so `git add -f` that one file (or un-ignore its path) and commit it alongside the code it measures, or wire coverage collection into CI, to enable this cross-layer check
- PF1 Benchmark discipline — Not applicable: no benchmark suite was found. This check searched for a pytest-benchmark or pytest-codspeed dependency with tests taking the `benchmark` fixture, an asv.conf.json with its `time_`/`mem_`/`peakmem_` benchmarks, or a pyperf Runner, and for a `*benchmark*` script that this repository's CI runs. Benchmarks are credited as a bonus, so their absence is neither scored nor deducted.
- PF2 Allocation hygiene — Not applicable: Python runs on a garbage-collected runtime that gives a program no allocation-control idiom to choose on a hot path — no pools, stack allocation or value types — so allocation awareness is not something this code can be rated on.
- PF3 Async & latency hygiene — Not applicable: this repository declares no async functions, so there is no asynchronous code for a blocking call to stall.
- S1 Web-Security Posture — Not assessed: these web-security controls are read from a source model (declarative annotations, request middleware, entity/column names, guard methods) that was not loaded for this repository — because the repository is written in a language this check does not yet model, or because its projects failed to load. Absence of an idiom this check recognises is NOT evidence that this repository lacks web-security controls: it may implement them entirely in its own ecosystem. This is a gap in the analyzer's language coverage, not a finding about this repository.
- X10 Duplicated predicate — Advisory — this card reports evidence and never carries a score, so there is nothing missing here.
- X16 Unfloored truncation loop — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X18 Disposal-pattern correctness — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X2 Cancellation propagation — no C# was loaded; this repository's Python was read, and no request in it can be cancelled by a caller — a Python request takes no token: asyncio cancels the task and trio or anyio the scope that made it, from outside the call, and requests, httpx, aiohttp and gRPC take a timeout, not a cancellation
- X20 Mistyped argument guard — This check asks whether an argument guard reports an EMPTY value as a NULL one, which needs a language that throws a null-specific argument exception — .NET's ArgumentNullException, the JVM's NullPointerException, Dart's ArgumentError.notNull. This repository contains none of those languages: the ones it is written in have a single exception for a bad argument, so there is no pair of exceptions to confuse and nothing here for it to assess. Not a gap in the analyzer and not a finding about your code.
- X29 Per-element action decided by a fixed element — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X32 Type resolved by simple name across every loaded assembly — This check is about how a .NET program searches the assemblies loaded into its process for a type, and this repository contains no .NET source, so there is nothing here for it to assess. Not a gap in the analyzer and not a finding about your code.
- X5 Nullable reference types — not analysed — these correctness checks read a source model that was not loaded for this repository, because the repository is written in a language this check does not yet model, or because its projects failed to load. This is a gap in the analyzer, not a finding about this repository
- X6 Hand-rolled structured-format parsing — Advisory — this card reports evidence and never carries a score, so there is nothing missing here.
- X7 Silent fallback defaults — Advisory — this card reports evidence and never carries a score, so there is nothing missing here.
- X9 Subsumed condition operand — Advisory — this card reports evidence and never carries a score, so there is nothing missing here.
Appendix A — Findings (grouped)
Critical — 4 finding(s)
D29 · Static Analysis (SAST)
- REDACTED
- REDACTED
D29 · Static Analysis (SAST)
- REDACTED
D30 · Dependency Vulnerabilities
- REDACTED
Serious — 6 finding(s)
D29 · Static Analysis (SAST)
- REDACTED
- REDACTED
DM5 · Encapsulated state
- Mutable entity: Restaurant src/domain/entities/restaurant.py:10
- Mutable entity: Table src/domain/entities/table.py:12
D36 · Supply-chain Provenance & Signing
- REDACTED
DM11 · Constructible invalid state
- Constructible in an invalid state: Table src/domain/entities/table.py:13
Minor — 6 finding(s)
X4 · Structured logging
- Interpolated log message defeats structured logging src/application/handlers/events.py:23
- Interpolated log message defeats structured logging src/infrastructure/events/local_handler.py:10
D36 · Supply-chain Provenance & Signing
- REDACTED
M2 · Architecture documentation
- No ADRs
M2 · Architecture documentation
- No architecture diagram/doc
P3 · Security & performance tooling
- No SAST
Minor — 2 finding(s)
D12 · Dependency Hygiene
- Outdated: nameko
- Outdated: sqlalchemy
Appendix B — Reproduction & audit trail
| Dimension | Tool | Version | Command | Findings | Raw output |
|---|---|---|---|---|---|
| D28 · Secrets (history) | gitleaks | — | gitleaks detect --no-banner --config /opt/gitleaks-rules/watchdog-gitleaks.toml --report-format json --report-path /tmp/watchdog-gitleaks-e9644a033e2f499d8df00e56478cd1c4/history.json --exit-code 0 --source . | 0 | artifacts/raw/gitleaks-history.json |
| D28 · Secrets (history) | gitleaks | — | gitleaks detect --no-git --no-banner --config /opt/gitleaks-rules/watchdog-gitleaks.toml --report-format json --report-path /tmp/watchdog-gitleaks-e9644a033e2f499d8df00e56478cd1c4/tree.json --exit-code 0 --source . | 0 | artifacts/raw/gitleaks-tree.json |
| D29 · Static Analysis (SAST) | semgrep | — | semgrep --config /opt/semgrep-rules/security-audit.yml --config /opt/semgrep-rules/owasp-top-ten.yml --config /opt/semgrep-rules/watchdog-sast.yml --json --quiet --timeout 10 --timeout-threshold 3 --metrics off . | 5 | artifacts/raw/semgrep.json |
| D30 · Dependency Vulnerabilities | osv-scanner | — | osv-scanner --format json --recursive --experimental-disable-plugins transitivedependency/requirements --experimental-disable-plugins dotnet/csproj --experimental-disable-plugins dotnet/nugetcpm . | 1 | artifacts/raw/osv-scanner.json |
| D31 · IaC & Container Security | trivy | — | trivy: not applicable — No Infrastructure-as-Code or container manifests found (Dockerfile, Docker Compose, Terraform, Kubernetes/Helm, CloudFormation, ARM, Bicep, Ansible); nothing to scan. | 0 | — |
| D32 · Data Compliance (PII/GDPR) | semgrep | — | semgrep: not applicable — No personal data was found crossing a boundary the PII/GDPR ruleset checks — nothing written to a log or console sink, placed in a URL or query string, or persisted to browser storage. That is a clean result for the LEAK surface only: this ruleset detects personal data escaping, it does not inventory the personal data a repository holds, so it is not evidence that this repository has no personal-data surface. The personal-data map (Appendix C) and the C1-C5 compliance cards are what speak to that. | 0 | — |
| D37 · Vulnerability-disclosure Policy | disclosure | — | disclosure: not applicable — No vulnerability-disclosure policy file found (SECURITY.md/.markdown/.rst/.txt at root or under .github/.forgejo/.gitea/docs, .well-known/security.txt). A coordinated-disclosure policy may live off-repo, so this is not evidenced rather than failed. | 0 | — |
| D40 · Network Egress Confinement | runtime-hardening | — | runtime-hardening: not applicable — No Kubernetes/orchestration workloads found in the repository manifests; network egress policy is a cluster-native control that may live at the platform/firewall layer, so there is nothing to assess here. | 0 | — |
| D41 · Kernel & Syscall Confinement | runtime-hardening | — | runtime-hardening: not applicable — No Kubernetes/orchestration workloads found in the repository manifests; seccomp/AppArmor/SELinux confinement is a workload-level control, so there is nothing to assess here. | 0 | — |
| D42 · Runtime Threat Enforcement | runtime-hardening | — | runtime-hardening: not applicable — No Kubernetes/orchestration workloads found in the repository manifests; runtime threat-detection and admission-control policy are cluster-level controls, so there is nothing to assess here. | 0 | — |
| D43 · Malicious Dependencies | osv-scanner | — | osv-scanner --format json --recursive --experimental-disable-plugins transitivedependency/requirements --experimental-disable-plugins dotnet/csproj --experimental-disable-plugins dotnet/nugetcpm . | 0 | artifacts/raw/osv-scanner.json |