Executive summary
Read through the Production lens — the standard calibration. *Green* means good enough to run in production. The score is absolute and comparable across repos.
tmasouris/flexibot-dotnet carries serious risk (39%). Several issues below can materially affect reliability, security, or the cost of change and warrant near-term attention.
It is strongest in Architecture (96%) — the structure is clean and changes stay contained.
Most urgent: a critical security exposure was detected (see the Security & Compliance lens). Treat it as a priority regardless of the overall grade.
The area that most needs attention is Readiness (22%) — operating, monitoring and recovering the system safely is harder. Security (51%) is the next concern — exposure to security and compliance incidents is elevated.
Leadership focus, highest impact first: Codify backups + geo-recovery in IaC and document RTO/RPO… (DR & Backup); `AddStandardResilienceHandler()` (or Polly policies) to your… (Outbound HTTP resilience); 1 No automated tests finding(s) in Code Coverage (Code Coverage).
For scale: Small (~4,393 production lines); rebuilding it from scratch would take roughly ~0.1 person-years (~1 engineer). Approximate, ±~30%.
It builds on a genuinely strong Architecture foundation (96%); the priorities above are the highest-leverage way to bring the rest up to that level.
Code Health
64%
Adequate
Architecture
96% ★
Exemplary
Maturity
51%
Adequate · gated by M2
Readiness
22% ⚠
Critical · gated by D8, D9, P3, P5, P7
Security
51%
Adequate · gated by C2
Accessibility
55%
Adequate
How the score is built — each lens's share of the headline
Width is the lens's weight in the worst-heaviest fold (the weakest area pulls hardest); colour is that lens's own band. A lens fixes the score in proportion to its width.
Readiness 22% · 46% weightSecurity 51% · 25% weightMaturity 51% · 14% weightAccessibility 55% · 8% weightCode Health 64% · 4% weightArchitecture 96% · 2% weight
Raise Readiness 22 → 70 (the Healthy floor) ⇒ headline 39 → ~54.
Code composition — where the lines go
Business logic 15%Plumbing 85%
Rebuild cost & value ~ Modeled — €1,200–€5,600
| Cost to rebuild | €1,200–€5,600 |
| Domain complexity | Standard |
| Quality factor | 0.7× (at 39% quality) |
| Size & shape | Small · 60% boilerplate · 26% straight-line · 15% branching logic |
This codebase represents roughly ~0.1 person-years of build effort (about ~€3,400 to rebuild). Its weakest lens is Readiness at 22% — the part of that asset most exposed by the findings below.
Top priorities
1
Resolve the 1 No automated tests finding(s) in Code Coverage.
2
Resolve the 1 No tests found finding(s) in Test Distribution.
3
Codify backups + geo-recovery in IaC and document RTO/RPO and the restore procedure — a persistence guard alone is not disaster recovery.
Diagnosis — what's actually going on
Value concentrated against a weak lens
This is a Small asset (~0.1 person-years to rebuild), and its weakest lens is Readiness at 22%. The operational and business risk on an asset this size concentrates there — that's where remediation buys the most protection.
Highest-leverage move
Of everything flagged, the best return on effort is: Codify backups + geo-recovery in IaC and document RTO/RPO and the restore procedure — a persistence guard alone is not disaster recovery. The rest can wait behind it.
Improving trajectory
The headline is improving steadily (+6.4 pts/run over 6 runs) — whatever you're doing is working; keep the gate.
Trajectory
OverallCode HealthArchitectureMaturityReadinessSecurityAccessibility
Architecture — module dependency graph
At a glance — Code Health
The Good
D1 · .NET / C#
Cyclomatic Complexity
10.0
D2 · .NET / C#
Cognitive Complexity
9.7
D3 · .NET / C#
God Classes
10.0
D4 · .NET / C#
Code Duplication
9.8
D17 · .NET / C#
Explicit Debt
9.9
D18 · .NET / C#
Solution Shape
10.0
D39 · .NET / C#
IL Efficiency
9.7
GD1 · Repo
Unfinished & placeholder code
10.0
IC1 · Repo
Incompleteness & stubs
7.8
X1 · Repo
Async correctness
7.2
X3 · Repo
Exception handling
10.0
X5 · Repo
Nullable reference types
9.9
At a glance — Architecture
The Good
D5 · .NET / C#
Coupling
10.0
D6 · .NET / C#
Cohesion (LCOM4)
10.0
D26 · .NET / C#
Project Cohesion
10.0
D27 · .NET / C#
Navigability
7.7
D35 · .NET / C#
Change Coupling
10.0
AX1 · Repo
Captive dependencies
10.0
AX10 · Repo
Code composition
8.9
AX2 · Repo
Stateful singletons
10.0
AX3 · Repo
Project dependency cycles
10.0
AX5 · Repo
Architecture & structure
10.0
AX6 · Repo
Interface segregation
10.0
At a glance — Maturity
At a glance — Readiness
The Good
The Ugly
At a glance — Security
The Good
At a glance — Accessibility
The Ugly
Security & Compliance — OWASP Top-10 mapping
| OWASP category | Findings | Severity |
|---|---|---|
| A05:2021 — Security Misconfiguration | 4 | High / Critical |
Roadmap
Top priorities: Codify backups + geo-recovery in IaC and document RTO/RPO and the restore procedure — a persistence guard alone is not disaster recovery; Add `AddStandardResilienceHandler()` (or Polly policies) to your HttpClient registrations so a flaky dependency can't take the app down; Resolve the 1 No automated tests finding(s) in Code Coverage.
| Do this | Helps | Effort | Dimension |
|---|---|---|---|
| Resolve the 1 No automated tests finding(s) in Code Coverage. | +15.0 pts | Low | Code Coverage |
| Resolve the 1 No tests found finding(s) in Test Distribution. | +15.0 pts | Low | Test Distribution |
| Codify backups + geo-recovery in IaC and document RTO/RPO and the restore procedure — a persistence guard alone is not disaster recovery. | +16.1 pts | Medium | DR & Backup |
| Add `AddStandardResilienceHandler()` (or Polly policies) to your HttpClient registrations so a flaky dependency can't take the app down. | +15.8 pts | Medium | Outbound HTTP resilience |
| Add readiness/liveness probes and a rolling-update (or blue/green) strategy so a bad release is caught and rolled back automatically. | +15.0 pts | Medium | Deployment & Rollback |
| Adopt EF migrations (dotnet ef migrations add + Migrate() on startup) as the explicit, versioned schema strategy — no migration mechanism was detected. | +14.5 pts | Medium | Schema migrations |
| Consider OpenTelemetry tracing/metrics and a health-check endpoint for operability. | +13.6 pts | Medium | Observability |
| Run the test suite in CI via an explicit runner step (e.g. `dotnet test`) and gate merges on it. | +6.9 pts | Medium | CI/CD gates |
File quality
| File | Score | Band | Worst signal |
|---|---|---|---|
| .devcontainer/Dockerfile | 4.4 | Mixed | IaC & Container Security: Critical IaC: DS-0010 |
| src/Shared/Services/AI/Language/TextNormalizationService.cs | 8.2 | Near-clean | Explicit Debt: TodoComment |
| src/Shared/Services/Cache/RedisService.cs | 8.2 | Near-clean | Explicit Debt: TodoComment |
| src/Api/Controllers/ChatController.cs | 8.2 | Near-clean | Explicit Debt: TodoComment |
| src/Shared/Services/AI/RAG/BaseRAGService.cs | 8.5 | Near-clean | Cognitive Complexity: BaseRAG.GenerateAnswerWithConfidenceAsync (cognitive 18) |
| src/Workers/ParserWorker/Services/RabbitMQConsumer.cs | 8.5 | Near-clean | Code Duplication: Duplicated block (18 lines × 4) |
| src/Workers/QnAWorker/Services/RabbitMQConsumerDelete.cs | 8.5 | Near-clean | Code Duplication: Duplicated block (15 lines × 2) |
Methodology & how to trust this report
Watchdog is a deep, periodic assessment — run each sprint, monthly, or quarterly, taking the time to go wider and deeper than a quick check and surfacing in one coherent report what you'd otherwise piece together from a dozen separate tools. It scores deterministically: the same commit yields the same score, every run. 53 of 53 evaluated dimensions are computed purely by tools and static analysis (confidence 1.0); none rely on LLM judgement. Overall confidence is 0.7 — the weighted average across measured dimensions; it falls as more of the score leans on LLM-assisted judgement and rises when it's fully tool-backed.
What we checked — 53 dimensions across the health lenses
D1D2D3D4D5D6D8D9D12D13D14D15D17D18D20D26D27D28D29D30D31D34D35D39AC2AC3AC6AC7AX1AX10AX2AX3AX5AX6C2GD1IC1M1M2M3P1P2P3P4P5P7P8S1X1X2X3X4X5
How to trust any code-health report — three questions
- Can you open the finding? Real findings cite a repo-relative file and line you can open at the cited line — never an absolute scratch path. Here, 31 of 95 do; the remainder are repo-wide signals — a dimension-level measurement, not a single line.
- Is there a tool behind the number? Every score below names the method that produced it — Roslyn, git, a scanner, or (for a handful of documentation/naming dimensions) an LLM labelled sampled · advisory — not a narrative.
- Does re-running give the same result? Run it again on the same commit and the score — and this report, byte for byte — is identical. A report whose numbers move between runs is describing the run, not the code.
Tools & methods
| Method | Backs | Version | Evaluator |
|---|---|---|---|
| Roslyn static analysis | Complexity, cohesion, coupling, dead code, API surface, layering | 5.3.0 | ✓ deterministic |
| Native secret scanner | Hardcoded secrets / credentials | 1.0.0 | ✓ deterministic |
| jscpd | Code duplication | — | ✓ deterministic |
| Coverage (coverlet / dotnet-coverage) | Line & branch coverage | 10.0.301 | ✓ deterministic |
| NuGet / dotnet | Outdated, vulnerable & deprecated dependencies | 10.0.301 | ✓ deterministic |
| git / LibGit2Sharp | Churn hotspots, knowledge concentration, history | 2.43.0 · 0.31.0 | ✓ deterministic |
| gitleaks · semgrep · trivy · checkov | Secrets in history, SAST, CVEs, IaC & container, PII / GDPR | 1.86.0 · 0.69.3 | ✓ deterministic |
| LLM (sampled · advisory) | Documentation quality, ADR conformance, naming — sampled over a bounded sample; advisory, never a deterministic measurement | — | ◐ LLM · sampled · advisory |
Run transparency — what happened this run
- D32 Data Compliance (PII/GDPR) — scanner not present in this environment — The backing tool was not installed where this scan ran, so this dimension was not scored. Install the tool (or run in the hosted environment, where it is always present) for a graded result.
- D33 JS/npm Dependency Vulnerabilities — scanner not present in this environment — The backing tool was not installed where this scan ran, so this dimension was not scored. Install the tool (or run in the hosted environment, where it is always present) for a graded result.
- D36 Supply-chain Provenance & Signing — scanner not present in this environment — The backing tool was not installed where this scan ran, so this dimension was not scored. Install the tool (or run in the hosted environment, where it is always present) for a graded result.
- D37 Vulnerability-disclosure Policy — scanner not present in this environment — The backing tool was not installed where this scan ran, so this dimension was not scored. Install the tool (or run in the hosted environment, where it is always present) for a graded result.
- D38 OSV Dependency Vulnerabilities — scanner not present in this environment — The backing tool was not installed where this scan ran, so this dimension was not scored. Install the tool (or run in the hosted environment, where it is always present) for a graded result.
Limitations & what we did not check
Watchdog assesses the repository exactly as committed, and only the repository. By design it does not reach outside the source tree: the live cloud account, the running CI/CD pipeline, the host's branch-protection and approval rules, the production configuration, or a restore actually exercised against a backup are all out of scope. That boundary is a feature, not a gap — a repo-relative, deterministic scan re-runs identically on any commit and every finding opens at a real file and line, where a live audit can neither be reproduced nor traced. The visible consequence is that controls which leave no in-repo evidence are reported as "not evidenced" and excluded from the score rather than awarded a number a static scan cannot justify.
Per-dimension blind spots
- D1 Cyclomatic Complexity: Cyclomatic complexity counts branches statically — it cannot tell an essential decision tree from accidental tangle, nor see complexity that lives in data or configuration (large switch-case token tables, DSL lexers/parsers, data-as-code rule tables) rather than control flow: a tokenizer's many single-character cases read as high complexity though each branch is trivial.
- D2 Cognitive Complexity: Cognitive-complexity heuristics approximate how hard code is to follow; genuine domain difficulty and well-named intent that eases reading are not captured.
- D3 God Classes: "God class" is sized by members and responsibilities visible in the type — a deliberately broad facade over a coherent subsystem can read the same as an accidental grab-bag. For front-end JS the file-length check is cohesion-aware (a single-responsibility module — one class/IIFE — earns a 3× threshold), but cohesion is approximated from top-level declarations, not true dependency structure.
- D4 Code Duplication: Duplication is token-similarity (jscpd) — it finds copy-paste, not semantic duplication expressed differently. Committed machine-written code (EF migration scaffolds, *.Designer.cs, model snapshots) is EXCLUDED — its repetition is the tool's, not the team's — so the score reflects hand-written duplication only; the generated footprint is reported separately under Solution Shape.
- D5 Coupling: Coupling is measured between projects/assemblies — runtime coupling through DI, reflection, messaging or shared databases is invisible to a static reference graph.
- D6 Cohesion (LCOM4): LCOM4 cohesion is syntactic — it infers connectivity from which methods touch which fields/methods by name, not from real runtime behaviour or intent.
- D8 Code Coverage: Coverage is measured by building and running the suite (`dotnet test --collect`) inside Watchdog's isolated image — the target repo is never modified, and nothing on your systems runs. So coverage exists only when the suite builds and runs within the inline time budget; one that needs external services, can't build, or exceeds the budget yields no coverage (D8 then degrades to not-measured, not a low score). Line coverage also says nothing about assertion quality.
- D9 Test Distribution: The test-pyramid shape is inferred from project/folder naming and references, with a single test host bucketed per-file by its path tier and content signals — a suite that names tiers unconventionally and gives no per-file signal can still be mis-bucketed.
- D12 Dependency Hygiene: Dependency health reads manifests and lockfiles — a vulnerability in a vendored/copied dependency, or risk from how a dependency is actually used, is outside this view.
- D13 Secret Scanning: Secret detection is signature- and entropy-based on the current tree — a secret that does not match a known pattern, or one already rotated, will not be flagged (a clean scan is "nothing matched", not "no secrets exist").
- D14 License Compliance: License compatibility is checked against declared package metadata and a policy — mislabelled or missing license metadata, and obligations that depend on how you distribute, are not resolved here.
- D15 Churn × Complexity Hotspots: Churn hotspots come from git history — a freshly imported or squashed repository has no churn signal, and recent rewrites can mask a historically risky file.
- D17 Explicit Debt: Acknowledged-debt signals (TODO/FIXME, suppressions, dead code) are textual — undocumented debt that nobody marked, and debt that lives in design rather than annotations, is invisible. Committed machine-written code (EF migrations, designer files, snapshots) is excluded — it is never the team's dead code to delete.
- D18 Solution Shape: Build integrity reflects whether the solution compiled in this environment — a build that needs a private feed, a specific SDK, or a generated file absent from the repo can read as broken when it is merely unreproducible here.
- D20 ADR Quality: ADR quality is an LLM read of the decision records present — it cannot know about decisions made and never recorded, and its verdict is sampled and advisory.
- D26 Project Cohesion: Project focus is sized from members/namespaces per project — a project that is broad by deliberate design reads the same as one that has sprawled.
- D27 Navigability: Indirection/navigability is structural — it measures hops to follow a call, not whether that indirection buys real flexibility or just ceremony.
- D28 Secrets (history): Secret-history scanning sweeps the git log for known patterns — a secret that predates the available history, or never matched a signature, is not found (clean means "nothing matched in the history we can see").
- D29 Static Analysis (SAST): SAST findings are pattern-based (semgrep) — it finds classes of bug it has rules for; logic flaws, auth/authorization gaps and issues needing runtime context are out of reach (and clean means "no rule matched").
- D30 Dependency Vulnerabilities: CVE matching depends on accurate package/version metadata and the advisory database — a vulnerability with no published advisory, or in code not declared as a dependency, is not seen.
- D31 IaC & Container Security: IaC scanning checks Dockerfiles/Terraform/Kubernetes against best-practice rules — it cannot see the live cloud account, runtime configuration, or drift between the committed config and what is actually deployed.
- D34 Knowledge Freshness: Freshness is decayed commit RECENCY, not comprehension — code read often but rarely committed reads as orphaned, and stable code that genuinely needs no changes is penalised the same as forgotten code; bot/squash commits distort it like the bus factor.
- D35 Change Coupling: Change coupling is co-change in COMMITS — files split across separate commits, or coupled only through a shared config/build step, read as uncoupled, and a sweeping commit (rename/format) is excluded so it doesn't couple everything. It shows that files change together, not WHY: a high coupling can be a healthy cohesive pair as readily as a hidden leak.
- AC2 Forms & labels: Label association is read from static markup — a label wired up at runtime (JS-set aria-labelledby, framework-injected ids) reads as missing, a present label says nothing about whether its text is correct, and component-wrapped fields (e.g. a <TextField>) are skipped. A clean result is "no unlabelled native control found", not a labelling proof.
- AC3 Page structure: Page structure is read from the static markup tree — landmarks, headings and lang injected at runtime aren't seen, heading ORDER is checked structurally (not against the rendered visual hierarchy), and lang/title/main fire only on full documents, never partials, and the data-table check sees header-cell presence (a <th> exists), not whether each header correctly associates with its cells. Static readiness, not conformance.
- AC6 Visual & motion safety: Contrast and motion safety are PARTIAL by construction — literal colours (hex/rgb/hsl/named) in inline styles, in-repo <style> blocks, in-repo .css files, var() tokens, Tailwind neutral utilities and CSS-in-JS top-level declarations are read (same-rule/same-element colour+background pairs only); computed/runtime/theme colour, external-CDN stylesheets, CSS-in-JS dynamic (${…}) and nested-selector colours, cross-element pairs and image contrast stay out of reach, so a clean result is bounded by what the static CSS itself shows.
- AC7 A11y enforcement: Enforcement is scored from in-repo config/CI evidence only — an a11y gate enforced in external tooling with no in-repo trace can't be credited, and a configured linter is presence, not proof the rules actually run or block a merge.
- AX10 Code composition: Role is inferred from namespace/folder convention, not semantics — a domain concept living in a folder named "Services" reads as application, and the split is lines-of-code, not business value. The business-logic-share score is a SOFT, FLOORED signal: it contributes to the Architecture lens but is floored at the Critical gate, so an infrastructure-heavy design (a gateway, an ETL, a driver) is legitimately low without being nuked to zero.
- P4 Deployment & Rollback: Approval/branch-protection rules live in repository settings the scan cannot see — only their in-repo evidence (config files, workflows) is checked, so a control enforced purely in the host's settings reads as "not evidenced".
- P5 DR & Backup: Backup/restore and disaster-recovery readiness is judged from in-repo evidence — a config that exists is not a tested restore, so the absence of positive evidence is reported as "not evidenced", never scored as present.
The LLM boundary
Dimensions
D1 · Cyclomatic Complexity
0 method(s) exceeded the cyclomatic complexity threshold of 15.
Do you agree with this assessment?
D2 · Cognitive Complexity
1 method(s) exceeded the cognitive complexity threshold of 15; the worst was BaseRAG.GenerateAnswerWithConfidenceAsync at 18.
BaseRAG.GenerateAnswerWithConfidenceAsync (cognitive 18)src/Shared/Services/AI/RAG/BaseRAGService.cs:156
Do you agree with this assessment?
D3 · God Classes
0 god class(es) detected.
Do you agree with this assessment?
D4 · Code Duplication
2 duplicated block group(s) detected.
Duplicated block (18 lines × 4)src/Workers/ParserWorker/Services/RabbitMQConsumer.cs:66
Duplicated block (15 lines × 2)src/Workers/QnAWorker/Services/RabbitMQConsumerDelete.cs:42
Do you agree with this assessment?
D5 · Coupling
10 projects, 0 dependency cycle(s), 0 unstable depended-on project(s).
Off the main sequence: Shared
Do you agree with this assessment?
D6 · Cohesion (LCOM4)
0 of 17 classes have LCOM4 above 3.
Do you agree with this assessment?
D8 · Code Coverage
No automated tests — the solution has no test code.
No automated tests
What to do
- Resolve the 1 No automated tests finding(s) in Code Coverage. — One of this dimension's main actionable groups (1 issue-level).
- Enforce Code Coverage in CI to reach Verified (currently Documented). — Hardens enforcement from Documented toward Verified — provenance only; does not change the score.
Do you agree with this assessment?
D9 · Test Distribution
No test projects found.
No tests found
What to do
- Resolve the 1 No tests found finding(s) in Test Distribution. — One of this dimension's main actionable groups (1 recommendation-level).
Do you agree with this assessment?
D12 · Dependency Hygiene
32 outdated, 0 vulnerable, 0 deprecated packages.
Outdated: CsvHelper
Do you agree with this assessment?
D13 · Secret Scanning
Secret scan ran and found no leaked secrets.
Do you agree with this assessment?
D14 · License Compliance
0 of 15 packages use a banned license.
Licenses scanned
Do you agree with this assessment?
D15 · Churn × Complexity Hotspots
No churn × complexity hotspots in the window.
Do you agree with this assessment?
D17 · Explicit Debt
3 deducted debt markers + 0 dead symbols across 4393 LoC (0.0/KLoC) → score 9.9.
TodoComment src/Shared/Services/AI/Language/TextNormalizationService.cs:52
Do you agree with this assessment?
D18 · Solution Shape
10 projects, 92 .cs files, 4393 hand-written lines of code (4393 production / 0 test), 9 inter-project edges.
Shared (Production)src/Shared/Shared.csproj
Api (Production)src/Api/Api.csproj
ParserWorker (Production)src/Workers/ParserWorker/ParserWorker.csproj
ChunkerWorker (Production)src/Workers/ChunkerWorker/ChunkerWorker.csproj
EmbedderWorker (Production)src/Workers/EmbedderWorker/EmbedderWorker.csproj
Do you agree with this assessment?
D20 · ADR Quality
No architecture decision records were found.
No ADRs found
What to do
- Resolve the 1 No ADRs found finding(s) in ADR Quality. — One of this dimension's main actionable groups (1 recommendation-level).
Do you agree with this assessment?
D26 · Project Cohesion
0 of 10 projects flagged as possibly oversized/incoherent.
Do you agree with this assessment?
D27 · Navigability
90 % of calls cross a namespace and 22 % go through an interface, but 74 % of collaborators are co-located — so following a call takes several hops. Baseline: small — navigation cost is tolerated.
What to do
- Improve Navigability — currently 7.7/10. — 90 % of calls cross a namespace and 22 % go through an interface, but 74 % of collaborators are co-located — so following a call takes several hops. Baseline: small — navigation cost is tolerated.
Do you agree with this assessment?
D28 · Secrets (history)
gitleaks scanned the full history AND the current working tree and found no secrets.
Do you agree with this assessment?
D29 · Static Analysis (SAST)
semgrep found no security issues.
Do you agree with this assessment?
D30 · Dependency Vulnerabilities
No known-vulnerable NuGet packages (direct or transitive).
Do you agree with this assessment?
D31 · IaC & Container Security
4 finding(s): 2 critical, 1 high, 0 medium, 1 low.
Critical IaC: DS-0010 .devcontainer/Dockerfile
High IaC: DS-0002.devcontainer/Dockerfile
Low IaC: DS-0026.devcontainer/Dockerfile
What to do
- Resolve the 2 Critical IaC finding(s) in IaC & Container Security — start with Dockerfile (2). — One of this dimension's main actionable groups (2 issue-level).
- Resolve the 1 High IaC finding(s) in IaC & Container Security — start with Dockerfile. — One of this dimension's main actionable groups (1 issue-level).
- Resolve the 1 Low IaC finding(s) in IaC & Container Security — start with Dockerfile. — One of this dimension's main actionable groups (1 recommendation-level).
Do you agree with this assessment?
D34 · Knowledge Freshness
11 of 31 significant source file(s) are orphaned — their living knowledge has decayed to nothing, so no one currently understands them. The largest is src/Shared/Services/Cache/RedisService.cs.
Orphaned knowledge src/Shared/Services/Cache/RedisService.cs
What to do
- Resolve the 11 Orphaned knowledge finding(s) in Knowledge Freshness — start with DocumentChunker.cs, DocumentDeleter.cs, DocumentParser.cs. — One of this dimension's main actionable groups (11 warning-level).
Do you agree with this assessment?
D35 · Change Coupling
No strong hidden change-coupling between production files.
Do you agree with this assessment?
D39 · IL Efficiency
12 of 922 methods have an oversized IL body.
Oversized method: ResponseWorker.Services.ChatBot/<CompleteChunkAsync>d__6.MoveNext
IL measured
Do you agree with this assessment?
Frontend & cross-cutting dimensions
AC2 · Forms & labels
- This control has only a placeholder — a placeholder is not a label (it vanishes on input and many AT ignore it). Add a <label for>, a wrapping <label>, or aria-label. — chat.html:30
What to do
- Give every control a programmatic label (a <label for> / wrapping <label> / aria-label) and every button text — a placeholder is not a label.
Do you agree with this assessment?
AC3 · Page structure
- No <main> (or role="main") means no "skip to content" target and a weaker landmark map. Wrap the primary content in <main>. (×2) — admin.html:2, chat.html:2
What to do
- Declare <html lang>, a document <title> and a <main> landmark, keep headings in order, leave zoom enabled, title iframes and drop meta-refresh.
Do you agree with this assessment?
AC6 · Visual & motion safety
Do you agree with this assessment?
AC7 · A11y enforcement
- No accessibility enforcement found — no a11y linter (eslint-plugin-jsx-a11y / vuejs-accessibility) and no axe/pa11y/Lighthouse in tests or CI. Start with the linter to catch issues at author time.
What to do
- Enforce accessibility in the toolchain: add eslint-plugin-jsx-a11y (or vuejs-accessibility), assert with jest-axe / playwright-axe in tests, then gate axe/pa11y/Lighthouse in CI.
Do you agree with this assessment?
AX1 · Captive dependencies
Do you agree with this assessment?
AX10 · Code composition
What to do
- The domain core is a small share of production code — check that business logic isn't leaking into the application/infrastructure layers (a thin domain is the anemic-domain smell).
Do you agree with this assessment?
AX2 · Stateful singletons
Do you agree with this assessment?
AX3 · Project dependency cycles
Do you agree with this assessment?
AX5 · Architecture & structure
Do you agree with this assessment?
AX6 · Interface segregation
Do you agree with this assessment?
C2 · Access Controls
- Authorization machinery exists but no [Authorize] usage and no imperative guard calls were found at handlers.
What to do
- Enforce authorization at every handler — call the guard method (throw-on-violation) from each one, or adopt [Authorize] so protected-by-default is demonstrable.
Do you agree with this assessment?
GD1 · Unfinished & placeholder code
Do you agree with this assessment?
IC1 · Incompleteness & stubs
- `CompleteChatStreamAsync` is declared `async` but never awaits anything, so it runs synchronously while pretending to be asynchronous. Drop `async` or do the real async work. — OllamaChatService.cs:40
- `GenerateAnswerWithConfidenceAsync` is declared `async` but never awaits anything, so it runs synchronously while pretending to be asynchronous. Drop `async` or do the real async work. — BaseRAGService.cs:156
What to do
- Remove the dead code that still moves this score: delete dead if(false) / #if false branches and either do the real async work or drop the async keyword from fake-async methods.
Do you agree with this assessment?
M1 · Documentation (README)
What to do
- Add a 'Testing' section to the root README — how to run the test suite.
- Add a README to the 10 of 10 project(s) that lack one — worth up to 2 pts.
Do you agree with this assessment?
M2 · Architecture documentation
- No Architecture Decision Records found — decisions aren't captured for future maintainers.
What to do
- Start an ADR log (docs/adr/) recording significant decisions and their rationale.
Do you agree with this assessment?
M3 · Folder & project structure
- Test projects aren't grouped under a tests/ folder — the test surface isn't separable from production code at a glance.
- Only 1/10 projects share a common root namespace — the code's module identity is inconsistent.
What to do
- Group test projects under tests/ (or test/, spec/) so the test surface is discoverable and CI can scope it.
- Adopt a consistent root-namespace convention (a shared prefix, e.g. Acme.*); short project-file/directory names are fine as long as the RootNamespace is uniform.
Do you agree with this assessment?
P1 · CI/CD gates
- A CI pipeline exists and the word "test" appears, but no explicit test-runner invocation (dotnet test / npm test / pytest / a test job) was matched — the gate may be running tests, or "test" may be incidental (a path, "latest", a reporter). Make the test step explicit so the gate is unambiguous.
What to do
- Run the test suite in CI via an explicit runner step (e.g. `dotnet test`) and gate merges on it.
Do you agree with this assessment?
P2 · Observability
What to do
- Consider OpenTelemetry tracing/metrics and a health-check endpoint for operability.
Do you agree with this assessment?
P3 · Security & performance tooling
- No static application security testing (CodeQL / security analyzers / codehealth) detected.
What to do
- Add a SAST step (e.g. CodeQL) or a security analyzer package.
- Enable Dependabot/Renovate or a dependency-review gate.
- Add gitleaks/trufflehog in CI to block PRs that introduce committed secrets.
Do you agree with this assessment?
P4 · Deployment & Rollback
- Deployment automation exists but no readiness/liveness probes, rolling-update strategy, lifecycle hooks or migration job were evidenced — a bad release is harder to detect and reverse.
What to do
- Add readiness/liveness probes and a rolling-update (or blue/green) strategy so a bad release is caught and rolled back automatically.
- Add an approval/environment gate (required reviewers / protection rules) before production promotion.
Do you agree with this assessment?
P5 · DR & Backup
- A persistence guard (data volume / purge-protection) was found, but no backup, geo-recovery or RTO/RPO controls were evidenced — a volume that survives a container recreate is not a tested restore from catastrophic loss.
What to do
- Codify backups + geo-recovery in IaC and document RTO/RPO and the restore procedure — a persistence guard alone is not disaster recovery.
Do you agree with this assessment?
P7 · Outbound HTTP resilience
- The app makes outbound HTTP calls but no resilience handler was detected (Polly / AddStandardResilienceHandler / circuit-breaker). A slow or failing dependency will cascade — add timeouts, retries with back-off, and a circuit breaker.
What to do
- Add `AddStandardResilienceHandler()` (or Polly policies) to your HttpClient registrations so a flaky dependency can't take the app down.
Do you agree with this assessment?
P8 · Schema migrations
- EF Core is used but neither migrations nor EnsureCreated were detected — confirm how the production schema is created and evolved.
What to do
- Adopt EF migrations (dotnet ef migrations add + Migrate() on startup) as the explicit, versioned schema strategy — no migration mechanism was detected.
Do you agree with this assessment?
S1 · Web-Security Posture
- No Content-Security-Policy / X-Frame-Options / X-Content-Type-Options configuration found — defense in depth, even when a reverse proxy could set them. (−2.0 on this card.)
- No UseHttpsRedirection/UseHsts and no reverse-proxy signal — transport security is unverified at the app layer. (−2.0 on this card.)
- No CookieSecurePolicy/HttpOnly/SameSite configuration found. (−1.5 on this card; skip if the app sets no cookies.)
What to do
- Add security response headers (Content-Security-Policy, X-Frame-Options, X-Content-Type-Options) — defense in depth, even when a reverse proxy could set them.
- Enforce HTTPS at the app layer (UseHttpsRedirection / UseHsts) — only skip this if a reverse proxy demonstrably terminates TLS.
- Set secure cookie flags — CookieSecurePolicy.Always, HttpOnly, and SameSite (Strict/Lax) on auth/session cookies. Skip only if the app sets no cookies.
Do you agree with this assessment?
X1 · Async correctness
- Blocking on a Task with `.Wait()`/`.GetAwaiter().GetResult()` can deadlock (and wastes a thread). Make the caller `async` and `await` instead. — OllamaService.cs:33
What to do
- Sync-over-async (deadlock risk)
Do you agree with this assessment?
X2 · Cancellation propagation
- Only 0/58 async methods accept a CancellationToken, so requests can't be cancelled cleanly under load or on client disconnect. In Blazor Server circuits and other short-write hosts, omitting it can be an accepted convention — judge against your hosting model.
- No CancellationToken parameter — work can't be cancelled cleanly on disconnect/shutdown. (×25) — OllamaChatService.cs:40, OllamaChatService.cs:55, OllamaEmbeddingService.cs:42, …
What to do
- Thread a CancellationToken through async methods so work stops promptly on cancellation.
Do you agree with this assessment?
X3 · Exception handling
Do you agree with this assessment?
X4 · Structured logging
- Logging an interpolated string (`$"..."`) collapses the event to plain text — you lose the named, queryable properties structured logging exists for. Use a message template with placeholders: `LogInformation("User {UserId} did {Action}", id, action)`. (×23) — RabbitMQPublisher.cs:57, ChatResponseStreamConsumer.cs:48, ChatResponseStreamConsumer.cs:57, …
What to do
- Interpolated log message defeats structured logging
Do you agree with this assessment?
X5 · Nullable reference types
- ~0.1 `!` suppressions per 1k syntax nodes — each one tells the compiler to trust you about null, suppressing the very safety NRTs provide.
What to do
- Enable <Nullable>enable</Nullable> across all projects and resolve warnings rather than suppressing with `!`.
Do you agree with this assessment?
WCAG coverage — what static analysis assessed
| Dimension | WCAG 2.2 A/AA criteria | Coverage |
|---|---|---|
| AC2 · Forms & labels | 1.3.1, 3.3.2, 4.1.2 | Partial signal |
| AC3 · Page structure | 1.4.4, 2.2.1, 2.4.1, 2.4.2, 3.1.1, 4.1.2 | Partial signal |
| AC6 · Visual & motion safety | 1.4.3, 2.4.7 | Partial — literal CSS only |
| AC7 · A11y enforcement | enforcement — no page criterion | Enforcement posture (process) |
Reference — by lens
| Lens | Score | Rating | Impact |
|---|---|---|---|
| Code Health | 64% | Adequate | Acceptable, with room to improve. |
| Architecture | 96% | Exemplary | Strongest area. |
| Maturity | 51% | Adequate — gated by M2 | Capped at Fair by a Critical contributor — resolve it before relying on this lens. |
| Readiness | 22% | Critical — gated by D8, D9, P3, P5, P7 | Capped at Fair by a Critical contributor — resolve it before relying on this lens. |
| Security | 51% | Adequate — gated by C2 | Capped at Fair by a Critical contributor — resolve it before relying on this lens. |
| Accessibility | 55% | Adequate | Acceptable, with room to improve. |
Not included — 39 check(s) not relevant to this codebase
- AC1 Text alternatives — No image/media element found in the parsed markup — AC1 not applicable here.
- AC4 Keyboard semantics — No interactive element found in the parsed markup — AC4 not applicable here.
- AC5 ARIA correctness — No ARIA usage found in the parsed markup — AC5 not applicable here.
- AX4 Dependency direction — not applicable to a transaction-script/CRUD architecture (the inward-dependency rule is for layered/clean styles)
- AX7 Slice cohesion — not applicable — not a vertical-slice architecture
- AX8 Test isolation — no test/production split to check
- AX9 CQS / query purity — no CQRS query handlers detected — query purity is not applicable to this codebase
- C1 Data Protection — No personal data detected in the analyzed source — no PII-typed entity/column names (Email, FirstName, DateOfBirth, …), no ASP.NET Identity / user-account model, and no stored user credentials. GDPR data-protection controls are therefore N/A here. If this is intentional, record the no-PII posture in an ADR; if the app does process personal data, name those fields conventionally so this dimension activates.
- C3 Audit Trail — No personal data detected in the analyzed source — no PII-typed entity/column names (Email, FirstName, DateOfBirth, …), no ASP.NET Identity / user-account model, and no stored user credentials. GDPR data-protection controls are therefore N/A here. If this is intentional, record the no-PII posture in an ADR; if the app does process personal data, name those fields conventionally so this dimension activates.
- C4 Data Retention — No personal data detected in the analyzed source — no PII-typed entity/column names (Email, FirstName, DateOfBirth, …), no ASP.NET Identity / user-account model, and no stored user credentials. GDPR data-protection controls are therefore N/A here. If this is intentional, record the no-PII posture in an ADR; if the app does process personal data, name those fields conventionally so this dimension activates.
- C5 Data-Subject Rights — No personal data detected in the analyzed source — no PII-typed entity/column names (Email, FirstName, DateOfBirth, …), no ASP.NET Identity / user-account model, and no stored user credentials. GDPR data-protection controls are therefore N/A here. If this is intentional, record the no-PII posture in an ADR; if the app does process personal data, name those fields conventionally so this dimension activates.
- D10 Test Quality — No tests in the analyzed solution to assess for quality.
- D11 Test Reliability — Test reliability not included
- D16 Bus Factor — single-maintainer — knowledge-concentration (bus factor) risk
- D19 Documentation Quality — LLM dimension skipped
- D21 Naming Consistency — LLM dimension skipped
- D22 Internal API Consistency — LLM dimension skipped
- D23 Boundary Type-Coupling — small single-context codebase (4,393 production LoC) — bounded contexts are not needed at this size
- D24 Comment Value — LLM dimension skipped
- D25 ADR Conformance — no ADRs to check
- D32 Data Compliance (PII/GDPR) — Not applicable
- D33 JS/npm Dependency Vulnerabilities — Not applicable
- D36 Supply-chain Provenance & Signing — Not applicable
- D37 Vulnerability-disclosure Policy — Not applicable
- D38 OSV Dependency Vulnerabilities — Not applicable
- D7 Architectural Integrity — No checkable ADRs to assess
- DM1 Domain Modelling — not run — 0/3 markers found
- ED1 Event-Driven — applicable but skipped (2/3 markers — below the conservative bar): 9 event handler(s); a message-bus package
- ED5 Idempotency — no mutating command handlers or message consumers detected — idempotency check not applicable
- ES1 Event Sourcing — not run — 0/3 markers found
- M4 Documentation accuracy — LLM not available — accuracy is the Tier-2 layer and needs a reachable model.
- P12 CI test-gate honesty — no data
- P6 Release Hygiene — not evidenced — no changelog, version stamp or semver release tag in the repo
- P9 Domain vs controller coverage — no coverage report found on disk — run tests with `--collect:"XPlat Code Coverage"` (or in CI) to enable this cross-layer check
- PF1 Benchmark discipline — Performance is assessed only for perf-relevant repos — a packaged library, one that ships benchmarks, or one already using allocation-aware APIs. This repo isn't one, so the Performance lens is not applicable and is excluded from the score.
- PF2 Allocation hygiene — Performance is assessed only for perf-relevant repos — a packaged library, one that ships benchmarks, or one already using allocation-aware APIs. This repo isn't one, so the Performance lens is not applicable and is excluded from the score.
- PF3 Async & latency hygiene — Performance is assessed only for perf-relevant repos — a packaged library, one that ships benchmarks, or one already using allocation-aware APIs. This repo isn't one, so the Performance lens is not applicable and is excluded from the score.
- X6 Hand-rolled structured-format parsing — no data
- X7 Silent fallback defaults — no data
Appendix A — Findings (grouped)
Issue — 4 finding(s)
D31 · IaC & Container Security
- Critical IaC: DS-0010 .devcontainer/Dockerfile
- Critical IaC: DS-0010 .devcontainer/Dockerfile
D31 · IaC & Container Security
- High IaC: DS-0002 .devcontainer/Dockerfile
D8 · Code Coverage
- No automated tests
Warning — 19 finding(s)
D34 · Knowledge Freshness
- Orphaned knowledge src/Shared/Services/Cache/RedisService.cs
- Orphaned knowledge src/Shared/Services/AI/Language/SemanticQnAService.cs
- Orphaned knowledge src/Workers/ChunkerWorker/Services/DocumentChunker.cs
- Orphaned knowledge src/Workers/ParserWorker/Services/DocumentParser.cs
- Orphaned knowledge src/Shared/Services/RabbitMQPublisher.cs
- Orphaned knowledge src/Workers/DeleterWorker/Services/RabbitMQConsumer.cs
- Orphaned knowledge src/Shared/Interfaces/Cache/ICacheService.cs
- Orphaned knowledge src/Shared/Services/AI/Language/TextNormalizationService.cs
- Orphaned knowledge src/Workers/QnAWorker/Services/QnAProcessor.cs
- Orphaned knowledge src/Workers/DeleterWorker/Services/DocumentDeleter.cs
- Orphaned knowledge src/Shared/Services/AI/RAG/HyDEService.cs
D17 · Explicit Debt
- TodoComment src/Shared/Services/AI/Language/TextNormalizationService.cs:52
- TodoComment src/Shared/Services/Cache/RedisService.cs:37
- TodoComment src/Api/Controllers/ChatController.cs:39
D16 · Bus Factor
- single-maintainer — knowledge-concentration (bus factor) risk
D2 · Cognitive Complexity
- BaseRAG.GenerateAnswerWithConfidenceAsync (cognitive 18) src/Shared/Services/AI/RAG/BaseRAGService.cs:156
D4 · Code Duplication
- Duplicated block (18 lines × 4) src/Workers/ParserWorker/Services/RabbitMQConsumer.cs:66
D4 · Code Duplication
- Duplicated block (15 lines × 2) src/Workers/QnAWorker/Services/RabbitMQConsumerDelete.cs:42
D5 · Coupling
- Off the main sequence: Shared
Recommendation — 28 finding(s)
D39 · IL Efficiency
- Oversized method: ResponseWorker.Services.ChatBot/<CompleteChunkAsync>d__6.MoveNext
- Oversized method: IndexerWorker.Services.RabbitMQConsumer/<<StartConsumingAsync>b__3_0>d.MoveNext
- Oversized method: ResponseWorker.Services.RabbitMQConsumer/<<StartConsumingAsync>b__3_0>d.MoveNext
- Oversized method: ParserWorker.Services.RabbitMQConsumer/<<StartConsumingAsync>b__4_0>d.MoveNext
- Oversized method: Shared.Services.AI.RAG.BaseRAG/<GenerateAnswerAsync>d__9.MoveNext
- Oversized method: Shared.Services.AI.RAG.BaseRAG/<GenerateAnswerWithConfidenceAsync>d__13.MoveNext
- Oversized method: EmbedderWorker.Services.RabbitMQConsumer/<<StartConsumingAsync>b__3_0>d.MoveNext
- Oversized method: ChunkerWorker.Services.RabbitMQConsumer/<<StartConsumingAsync>b__3_0>d.MoveNext
- Oversized method: Api.Controllers.DocumentsController/<UploadDocuments>d__4.MoveNext
- Oversized method: ResponseWorker.Services.ChatBot/<CachePrompt>d__7.MoveNext
- Oversized method: DeleterWorker.Services.RabbitMQConsumer/<<StartConsumingAsync>b__3_0>d.MoveNext
- Oversized method: Shared.Services.AI.Language.SemanticQnAService/<ProcessQnAUploadAsync>d__10.MoveNext
D11 · Test Reliability
- Test reliability not included
D19 · Documentation Quality
- LLM dimension skipped
D20 · ADR Quality
- No ADRs found
D21 · Naming Consistency
- LLM dimension skipped
D22 · Internal API Consistency
- LLM dimension skipped
D23 · Boundary Type-Coupling
- small single-context codebase (4,393 production LoC) — bounded contexts are not needed at this size
D24 · Comment Value
- LLM dimension skipped
D25 · ADR Conformance
- no ADRs to check
D31 · IaC & Container Security
- Low IaC: DS-0026 .devcontainer/Dockerfile
D32 · Data Compliance (PII/GDPR)
- Not applicable
D33 · JS/npm Dependency Vulnerabilities
- Not applicable
D36 · Supply-chain Provenance & Signing
- Not applicable
D37 · Vulnerability-disclosure Policy
- Not applicable
D38 · OSV Dependency Vulnerabilities
- Not applicable
D7 · Architectural Integrity
- No checkable ADRs to assess
D9 · Test Distribution
- No tests found
Info — 44 finding(s)
D12 · Dependency Hygiene
- Outdated: CsvHelper
- Outdated: Microsoft.AspNetCore.Http.Abstractions
- Outdated: Microsoft.EntityFrameworkCore
- Outdated: Microsoft.Extensions.Configuration
- Outdated: Minio
- Outdated: OllamaSharp
- Outdated: Qdrant.Client
- Outdated: RabbitMQ.Client
- Outdated: StackExchange.Redis
- Outdated: Microsoft.AspNetCore.OpenApi
- Outdated: Microsoft.EntityFrameworkCore
- Outdated: Minio
- Outdated: Npgsql.EntityFrameworkCore.PostgreSQL
- Outdated: RabbitMQ.Client
- Outdated: Swashbuckle.AspNetCore
- Outdated: DocumentFormat.OpenXml
- Outdated: Microsoft.Extensions.Hosting
- Outdated: Minio
- Outdated: PdfPig
- Outdated: RabbitMQ.Client
- Outdated: Microsoft.Extensions.Hosting
- Outdated: Microsoft.Extensions.Hosting
- Outdated: Microsoft.Extensions.Hosting
- Outdated: Microsoft.Extensions.Hosting
- Outdated: Npgsql.EntityFrameworkCore.PostgreSQL
D14 · License Compliance
- Licenses scanned
D18 · Solution Shape
- Shared (Production) src/Shared/Shared.csproj
D18 · Solution Shape
- Api (Production) src/Api/Api.csproj
D18 · Solution Shape
- ParserWorker (Production) src/Workers/ParserWorker/ParserWorker.csproj
D18 · Solution Shape
- ChunkerWorker (Production) src/Workers/ChunkerWorker/ChunkerWorker.csproj
D18 · Solution Shape
- EmbedderWorker (Production) src/Workers/EmbedderWorker/EmbedderWorker.csproj
D18 · Solution Shape
- IndexerWorker (Production) src/Workers/IndexerWorker/IndexerWorker.csproj
D18 · Solution Shape
- StatusWorker (Production) src/Workers/StatusWorker/StatusWorker.csproj
D18 · Solution Shape
- DeleterWorker (Production) src/Workers/DeleterWorker/DeleterWorker.csproj
D18 · Solution Shape
- ResponseWorker (Production) src/Workers/ResponseWorker/ResponseWorker.csproj
D18 · Solution Shape
- QnAWorker (Production) src/Workers/QnAWorker/QnAWorker.csproj
D39 · IL Efficiency
- IL measured
Appendix B — Reproduction & audit trail
| Dimension | Tool | Version | Command | Findings | Raw output |
|---|---|---|---|---|---|
| D28 · Secrets (history) | gitleaks | — | gitleaks detect --no-banner --report-format json --report-path /dev/stdout --exit-code 0 --source . | 0 | artifacts/raw/gitleaks-history.json |
| D29 · Static Analysis (SAST) | semgrep | — | semgrep --config auto --json --quiet --timeout 0 --metrics off . | 0 | — |
| D30 · Dependency Vulnerabilities | dotnet | — | dotnet list workspaces.sln package --vulnerable --include-transitive --format json | 0 | artifacts/raw/dotnet-vulnerable.json |
| D31 · IaC & Container Security | trivy | — | trivy config --format json --quiet . | 4 | artifacts/raw/trivy-config.json |
| D32 · Data Compliance (PII/GDPR) | semgrep | — | semgrep: not applicable — No PII/GDPR-handling patterns detected (p/gdpr ruleset) — no data-compliance surface to assess. | 0 | — |
| D33 · JS/npm Dependency Vulnerabilities | trivy | — | trivy: not applicable — No JS/npm manifest or lockfile found outside bin/obj (package.json, package-lock.json, yarn.lock, pnpm-lock.yaml, bun.lockb); no JS dependencies to scan. | 0 | — |
| D36 · Supply-chain Provenance & Signing | provenance | — | provenance: not applicable — The CI pipeline builds and tests but publishes no released artifact — no package publish, container push, GitHub release or deployment step. Supply-chain provenance, signing and SBOM attest RELEASED artifacts, so there is nothing to attest here. Add them to the release pipeline when this repo starts shipping artifacts (a NuGet package, a container image, a GitHub release). | 0 | — |
| D37 · Vulnerability-disclosure Policy | disclosure | — | disclosure: not applicable — No vulnerability-disclosure policy file found (SECURITY.md, .github/SECURITY.md, docs/SECURITY.md, .well-known/security.txt). A coordinated-disclosure policy may live off-repo, so this is not evidenced rather than failed. | 0 | — |
| D38 · OSV Dependency Vulnerabilities | osv-scanner | — | osv-scanner: not applicable — No JS/npm lockfile found outside bin/obj (package-lock.json, yarn.lock, pnpm-lock.yaml, bun.lockb); nothing for OSV to scan. | 0 | — |