Tranvuongduy2003/archived-EventHub

What it measures: How tangled the control flow is — methods with many branches are hard to test and change.

Method: Cyclomatic complexity per method (1 + decision points), computed exhaustively across production source; test projects separated by convention. Deterministic.

Maturity: Documented → Verified → Prevented · effective 9.3 / 10 · rule-coverage 100% · ceiling Prevented

4 method(s) exceeded the cyclomatic complexity threshold of 15; the worst was GetCreatedEventsByUserIdQueryHandler.Handle at 21.

✓ On the Gold path — maintain.

Detailed fixes: d1_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: How hard the code is for a person to follow, beyond raw branching.

Method: Cognitive complexity per method (Sonar-style nesting-penalized score), computed exhaustively over production code, excluding test projects. Deterministic.

Maturity: Documented → Verified → Prevented · effective 9.3 / 10 · rule-coverage 100% · ceiling Prevented

2 method(s) exceeded the cognitive complexity threshold of 15; the worst was PagingHelper.QueryPaginate at 25.

✓ On the Gold path — maintain.

Detailed fixes: d2_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: Over-large classes that try to do too much ("god classes").

Method: God-class detection by line and method-count thresholds per logical type (partial classes unified), filtered for generated code and registration/contract false positives. Deterministic.

Maturity: Documented → Verified → Prevented · effective 9.8 / 10 · rule-coverage 100% · ceiling Prevented

2 god class(es) detected.

✓ On the Gold path — maintain.

Detailed fixes: d3_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: Copy-pasted code that should be shared instead.

Method: Code duplication via token-stream sliding windows with type-aware normalization (locals masked, type names preserved), density-scored per KLoC of production code. Deterministic.

Maturity: Documented → Verified → Prevented · effective 9.9 / 10 · rule-coverage 100% · ceiling Verified

6 duplicated block group(s) detected.

✓ On the Gold path — maintain.

Detailed fixes: d4_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: Whether volatile projects sit underneath others that depend on them (so their churn ripples upward), and whether project dependencies form cycles. A widely-depended-on but stable shared/kernel project is healthy, not penalised.

Method: Dependency cycles via elementary-DFS over real .csproj references, plus Martin instability (afferent/efferent) per project. Exhaustive over the reference graph, deterministic.

Coverage: Exhaustive · type-level: afferent/efferent coupling + cycles computed over every production type — the population is all types, not a name convention.

Maturity: Documented → Verified → Prevented · effective 10.0 / 10 · rule-coverage 100% · ceiling Prevented

6 projects, 0 dependency cycle(s), 0 unstable depended-on project(s).

✓ On the Gold path — maintain.

Detailed fixes: d5_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: Whether a class's methods are focused on a single responsibility.

Method: LCOM4 cohesion per production class with at least two methods: connected components of methods sharing state or calls, computed syntactically. Deterministic, not a proxy.

Coverage: Exhaustive · type-level: LCOM4 cohesion computed over every production class — the population is all types, not a name convention.

Maturity: Documented → Verified → Prevented · effective 10.0 / 10 · rule-coverage 100% · ceiling Verified

0 of 29 classes have LCOM4 above 3.

✓ On the Gold path — maintain.

Detailed fixes: d6_recommendation.md.

What it measures: How much of the code is actually exercised by tests.

Method: Coverage from coverlet runs or committed reports (Cobertura/OpenCover/lcov), computed per-file with structured exclusions for generated, trivial, and glue code. When the suite can't be built/run in-image AND no report is committed, coverage is reported NOT-MEASURED (excluded from the score) with the precondition to make it measurable — never a LoC-ratio proxy folded in as if measured. Deterministic.

Maturity: Documented → Verified → Prevented · effective 0.0 / 10 · rule-coverage 100% · ceiling Verified

No automated tests — no test code was found in this repository.

What to do

1. Resolve the 1 No automated tests finding(s) in Code Coverage. — One of this dimension's main actionable groups (1 issue-level).
2. Enforce Code Coverage in CI to reach Verified (currently Documented). — Hardens enforcement from Documented toward Verified — provenance only; does not change the score.

Detailed fixes: d8_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: Whether the test suite has a healthy mix of unit / integration / end-to-end tests.

Method: Test projects classified (Unit/Integration/BDD/E2E) from compiled metadata; test methods counted exhaustively across projects with placement-agnostic disk fallback. Deterministic.

Maturity: Documented → Verified → Prevented · effective 0.0 / 10 · rule-coverage 100% · ceiling Documented

No test suite found.

What to do

1. Resolve the 1 No tests found finding(s) in Test Distribution. — One of this dimension's main actionable groups (1 recommendation-level).

Detailed fixes: d9_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: Whether dependencies are current, secure, and not bloated.

Method: Manifest scan via dotnet list package across all projects; worst-signal-per-package deduction (saturating for vulnerabilities, capped-linear for deprecation/outdated) per KLoC. Exhaustive, deterministic.

Maturity: Documented → Verified → Prevented · effective 0.0 / 10 · rule-coverage 100% · ceiling Verified

52 outdated, 3 vulnerable, 7 deprecated packages.

What to do

1. Resolve the 7 Deprecated finding(s) in Dependency Hygiene. — One of this dimension's main actionable groups (7 warning-level).
2. Resolve the 3 Vulnerable finding(s) in Dependency Hygiene. — One of this dimension's main actionable groups (3 issue-level).
3. Enforce Dependency Hygiene in CI to reach Verified (currently Documented). — Hardens enforcement from Documented toward Verified — provenance only; does not change the score.

Detailed fixes: d12_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: Whether any secrets (keys, tokens, passwords) have leaked into the code.

Method: In-process native secret scanner (entropy plus signature patterns) across all tracked files; no external tool. A clean result is a measured 10, not no-data zero. Deterministic.

Maturity: Documented → Verified → Prevented · effective 10.0 / 10 · rule-coverage 100% · ceiling Prevented

Secret scan ran and found no leaked secrets.

✓ On the Gold path — maintain.

Detailed fixes: d13_recommendation.md.

What it measures: Whether the licenses of third-party packages are compatible with your policy.

Method: Third-party package licenses resolved from declared package metadata and checked against the configured policy (allow/deny/copyleft). Deterministic; clean = no incompatible license found at metadata depth.

Maturity: Documented → Verified → Prevented · effective 10.0 / 10 · rule-coverage 100% · ceiling Verified

0 of 57 packages use a banned license.

✓ On the Gold path — maintain.

Detailed fixes: d14_recommendation.md.

What it measures: Files that change often and are also complex — the riskiest hotspots.

Method: Per production file churn times cyclomatic complexity over a rolling window, computed from git and Roslyn/JS/Razor analysis. Exhaustive, deterministic per commit date.

Maturity: Documented → Verified → Prevented · effective 10.0 / 10 · rule-coverage 100% · ceiling Documented

No churn × complexity hotspots in the window.

✓ On the Gold path — maintain.

Detailed fixes: d15_recommendation.md.

What it measures: Whether knowledge is concentrated in too few people (the "bus factor").

Method: Living knowledge per author via time-decayed commit attribution (6-month half-life, focus weighting) across largest source files. Deterministic, avoids blame's mechanical-refactor false positives.

Maturity: Documented → Verified → Prevented · effective 8.9 / 10 · rule-coverage 100% · ceiling Documented

13 source file(s) have their living knowledge concentrated in one author (≥90% of recent, decayed contribution). The largest is source/EventHub.Presentation/Controllers/UsersController.cs.

What to do

1. Resolve the 1 Off-boarding risk finding(s) in Bus Factor. — One of this dimension's main actionable groups (1 recommendation-level).

Detailed fixes: d16_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: Acknowledged debt left in the code — TODOs, dead code, suppressed warnings.

Method: Roslyn syntactic debt markers (suppressions/TODO/FIXME/HACK/empty-catch/commented-code/Obsolete) plus SymbolFinder dead-code analysis; weighted-debt-per-KLoC density deducted 2.0x per unit. Deterministic, exhaustive.

Maturity: Documented → Verified → Prevented · effective 10.0 / 10 · rule-coverage 100% · ceiling Prevented

0 deducted debt markers + 0 dead symbols across 20701 LoC (0.0/KLoC) → score 10.0.

✓ On the Gold path — maintain.

Detailed fixes: d17_recommendation.md.

What it measures: Whether the solution is laid out in a sensible, conventional structure.

Method: Solution structure: project count, decomposition, shell-project detection, build success (confirmed failures cap the score); traced to actual .sln files and binaries. Deterministic.

Maturity: Documented → Verified → Prevented · effective 10.0 / 10 · rule-coverage 100% · ceiling Documented

6 projects, 649 source files, 20701 hand-written lines of code (20701 production / 0 test), plus 51632 generated (machine-written code — designer, scaffolded and tool-emitted files — excluded from quality), 15 inter-project edges.

✓ On the Gold path — maintain.

Detailed fixes: d18_recommendation.md.

What it measures: Whether the project's documentation is clear, complete, and useful.

Method: Judged by language model at low temperature (0.0-0.1) on a deterministic doc sample (READMEs plus first 25 architecture docs), with two-pass stability filtering. Advisory, sampled.

Maturity: Documented → Verified → Prevented · effective Weak / 10 · rule-coverage 100% · ceiling Documented

The README is a thin single-file guide for an eventhub project that describes the folder structure and gives a brief star-giving note but does not cover architecture/design patterns, Clean Architecture, or run-setup steps. The document clips mid-Explanation of Folders at 'EventHub.Infrastructure.SignalR' before covering the outlined topics such as Applied Architecture and Design Patterns, Unit of Work Pattern, Domain-Driven Design (DDD), CQRS, Transactional Outbox, Idempotency, CI/CD, and how to run the application. The visible content is sparse and lacks a clear table of contents.

What to do

1. Improve Documentation Quality — currently 4.0/10. — The README is a thin single-file guide for an eventhub project that describes the folder structure and gives a brief star-giving note but does not cover architecture/design patterns, Clean Architecture, or run-setup steps. The document clips mid-Explanation of Folders at 'EventHub.Infrastructure.SignalR' before covering the outlined topics such as Applied Architecture and Design Patterns, Unit of Work Pattern, Domain-Driven Design (DDD), CQRS, Transactional Outbox, Idempotency, CI/CD, and how to run the application. The visible content is sparse and lacks a clear table of contents.

Detailed fixes: d19_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: Whether architecture decisions are recorded well (context, decision, consequences).

Method: Per-ADR judgment by language model at low temperature with two-pass stability; confidence is share of ADRs evaluated; enforcement-field presence detected deterministically. Advisory.

Maturity: Documented → Verified → Prevented · effective Critical / 10 · rule-coverage 100% · ceiling Documented

No architecture decision records were found.

What to do

1. Resolve the 1 No ADRs found finding(s) in ADR Quality. — One of this dimension's main actionable groups (1 recommendation-level).

Detailed fixes: d20_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: Whether names — types, methods, variables — are clear and consistent.

Method: Judged by language model at low temperature (0.0-0.1) on a deterministic random symbol sample (fixed size, not exhaustive), with disclosed confidence band. Advisory, sampled.

Maturity: Documented → Verified → Prevented · effective Exemplary / 10 · rule-coverage 100% · ceiling Verified

0 naming inconsistencies across 200 sampled symbols.

✓ On the Gold path — maintain.

Detailed fixes: d21_recommendation.md.

What it measures: Whether comments are worth it — explaining WHY (valuable) rather than WHAT (redundant).

Method: Judged by language model at low temperature (0.0-0.1) on deterministically sampled inline comments with surrounding code; findings verified back to sampled comments by substring match. Advisory, sampled.

Maturity: Documented → Verified → Prevented · effective Adequate / 10 · rule-coverage 100% · ceiling Documented

6 valuable / 2 redundant across 90 sampled comments; 2 shown with locations.

What to do

1. Resolve the 2 redundant comment finding(s) in Comment Value — start with ApplicationConfiguration.cs, PagingHelper.cs. — One of this dimension's main actionable groups (2 recommendation-level).

Detailed fixes: d24_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: Whether each project is a focused, coherent unit rather than an oversized grab-bag.

Method: Project size overshoot penalties (LoC / public-type count / namespace count, 2-of-3 flag) weighted by log magnitude. Exhaustive across projects, deterministic, LLM-independent.

Maturity: Documented → Verified → Prevented · effective 6.7 / 10 · rule-coverage 100% · ceiling Documented

1 of 6 projects flagged as possibly oversized/incoherent.

What to do

1. Resolve the 1 Split EventHub.Application finding(s) in Project Cohesion. — One of this dimension's main actionable groups (1 recommendation-level).

Detailed fixes: d26_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: How far you must trace to follow a call — low indirection and co-located slices read easier.

Method: Call indirection (interface hops, cross-namespace calls, slice-locality scaled) over a sampled set of method invocations, size-aware baseline. Sampled; confidence discounted by symbol-resolution gaps.

Coverage: Slice locality from the first namespace segments, SAMPLED (≤400 methods) — not exhaustive.

Maturity: Documented → Verified → Prevented · effective 10.0 / 10 · rule-coverage 100% · ceiling Documented

100 % of calls cross a namespace and 0 % go through an interface, but 100 % of collaborators are co-located — so a call's collaborators sit together and tracing stays easy. Baseline: medium — clean/modular boundaries expected.

✓ On the Gold path — maintain.

Detailed fixes: d27_recommendation.md.

What it measures: Whether any secrets were ever committed — scanned across the full git history, not just now.

Method: Git-history secret scan via gitleaks detect over full history in an isolated checkout; each match flagged High. Exhaustive; degrades cleanly when tool absent.

Maturity: Documented → Verified → Prevented · effective 4.0 / 10 · rule-coverage 100% · ceiling Documented

6 finding(s): 0 critical, 6 high, 0 medium, 0 low. Remediation for historically-committed secrets is credential rotation — they remain in history regardless of later deletion.

What to do

1. Resolve the 2 Secret finding(s) in Secrets (history) — start with appsettings.json (2). — One of this dimension's main actionable groups (2 issue-level).
2. Resolve the 1 Rotate the exposed credentials finding(s) in Secrets (history). — One of this dimension's main actionable groups (1 recommendation-level).

Detailed fixes: d28_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: Real static-analysis (SAST) findings — likely security bugs in the code, any language.

Method: Polyglot static analysis via semgrep across the repo using the pinned, image-baked p/security-audit + p/owasp-top-ten rulesets (no scan-time registry fetch); severity rules (ERROR/WARNING/INFO) map to a full-band severity-weighted score. Exhaustive, deterministic; degrades on parse failure.

Coverage: semgrep pattern rules over all files — exhaustive for the rule set, blind to classes of bug without a rule (clean = no rule matched).

Maturity: Documented → Verified → Prevented · effective 9.7 / 10 · rule-coverage 100% · ceiling Documented

2 finding(s): 0 critical, 0 high, 0 medium, 2 low.

✓ On the Gold path — maintain.

Detailed fixes: d29_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: Whether Dockerfiles / Terraform / Kubernetes config follow security best practices.

Method: IaC/container misconfiguration scan via trivy config (Dockerfile/Terraform/K8s/Helm/CloudFormation); severity rules to 0-10 moderate normalizer. NotApplicable without manifests. Exhaustive, deterministic.

Maturity: Documented → Verified → Prevented · effective 9.6 / 10 · rule-coverage 100% · ceiling Documented

2 finding(s): 0 critical, 1 high, 0 medium, 1 low.

✓ On the Gold path — maintain.

Detailed fixes: d31_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: Whether anyone still has living knowledge of each file, or it has been orphaned — last understood long ago by someone now gone quiet. The sibling of the bus factor: D16 asks who owns it, D34 asks whether anyone still knows it.

Method: File orphaning as total living-knowledge decay below one focused-commit's worth within a year, computed per-file from the D16 decay model. Exhaustive, deterministic over fixed history.

Maturity: Documented → Verified → Prevented · effective 3.1 / 10 · rule-coverage 100% · ceiling Documented

54 of 74 significant source file(s) are orphaned — their living knowledge has decayed to nothing, so no one currently understands them. The largest is source/EventHub.Infrastructure.Persistence/Data/ApplicationDbContextSeed.cs.

What to do

1. Resolve the 1 Concentrated knowledge decay finding(s) in Knowledge Freshness. — One of this dimension's main actionable groups (1 recommendation-level).
2. Resolve the 1 Largest orphaned file finding(s) in Knowledge Freshness — start with ApplicationDbContextSeed.cs. — One of this dimension's main actionable groups (1 recommendation-level).

Detailed fixes: d34_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: Whether files that change together actually belong together — pairs that repeatedly co-change in git history despite having no explicit code dependency, surfacing the hidden/logical coupling (and boundaries in the wrong place) a static scan can't see.

Method: Pairwise co-occurrence over the per-commit file sets in git history (production source only — tests and generated dropped): Degree-of-Coupling = shared ÷ min individual revisions, reported above noise floors (each file ≥10 revisions, ≥5 shared commits, ≥50% strength); sweeping commits excluded. Deterministic over fixed history.

Coverage: Population: PRODUCTION source files only — test and generated files are dropped before pairing, so a class co-changing with its own test (trivially ~100%) can't drown the real production↔production coupling. Pairs ranked by Degree-of-Coupling; coupling through a build step, config, or non-source file isn't seen.

Maturity: Documented → Verified → Prevented · effective 10.0 / 10 · rule-coverage 100% · ceiling Documented

No strong hidden change-coupling between production files.

✓ On the Gold path — maintain.

Detailed fixes: d35_recommendation.md.

What it measures: Whether the build pipeline provides supply-chain integrity — generated provenance/attestation, signed artifacts (cosign/sigstore), an SBOM, and pinned build actions. Presence of the configuration, not a runtime guarantee.

Method: Supply-chain provenance/signing read deterministically from CI/build config (.github/workflows, .gitlab-ci.yml, azure-pipelines, Jenkinsfile, .circleci) + the release surface: four signals — generated provenance/attestation (SLSA/in-toto/actions-attest), artifact signing (cosign/sigstore/gitsign), an SBOM (syft/sbom-action/*.spdx.json/*.cdx.json), and SHA-pinned build actions — scored 10·present/denom. NotApplicable without a build pipeline. Detects configuration presence, not runtime enforcement.

Maturity: Documented → Verified → Prevented · effective 0.0 / 10 · rule-coverage 100% · ceiling Documented

0/3 supply-chain integrity signals present (provenance, signing, SBOM).

What to do

1. Resolve the 1 No build provenance finding(s) in Supply-chain Provenance & Signing. — One of this dimension's main actionable groups (1 recommendation-level).
2. Resolve the 1 No artifact signing finding(s) in Supply-chain Provenance & Signing. — One of this dimension's main actionable groups (1 recommendation-level).
3. Resolve the 1 No SBOM finding(s) in Supply-chain Provenance & Signing. — One of this dimension's main actionable groups (1 recommendation-level).

Detailed fixes: d36_recommendation.md · top locations in Appendix A, every location in findings.md.

Other · Architecture — Whether any singleton service captures a scoped/transient dependency — a silent lifetime/threading bug.

Method: Roslyn scan: DI registrations parsed from AddSingleton/Scoped/Transient; each singleton checked for captured shorter-lifetime dependencies. Exhaustive, deterministic.

Other · Architecture — How the codebase splits by code ROLE — domain, application, infrastructure, test, generated. The significance map behind the knowledge/coupling weighting, and a DDD signal in its own right: a thin domain core under fat infrastructure is the anemic-domain smell, quantified.

Method: Roslyn line-count by code ROLE: every source file classified Domain/Application/Infrastructure/Test/Generated by namespace + path convention (the shared CodeRoleClassifier), then significant lines summed per role. Deterministic; the advisory score is the business-logic (domain+application) share of production code.

Coverage: Population: ALL source files, each bucketed into ONE of five roles (Domain/Application/Infrastructure/Test/Generated) by namespace + path convention — a file whose layer isn't named in the convention falls to Application (the neutral default), and the split is line-count, not semantic depth or business value.

Other · Architecture — Whether singleton services avoid mutable shared instance state that concurrent callers would race on.

Method: Roslyn scan: singleton field mutations unguarded by lock or Interlocked, per type; syntax-based guard detection. Deterministic, traceable per field.

Other · Architecture — Whether the project-reference graph is acyclic (cycles block independent build/deploy and signal eroding boundaries).

Method: Project reference cycles via elementary-DFS over real .csproj references, using the engine shared with D5/D7; cyclic versus acyclic. Exhaustive, deterministic.

Other · Architecture — Whether dependencies point inward (Domain ← Application ← Infrastructure/Web) — the clean-architecture dependency rule, checked across the project graph.

Method: Layer violations by name-segment inference (Domain/Core to Application to Infrastructure/Web) over the project-reference graph. Exhaustive over all projects, deterministic.

Other · Architecture — Whether the codebase has a recognisable, scale-appropriate structure (a named architectural style, or modular enough for its size) rather than being an ad-hoc ball of mud.

Method: Roslyn plus csproj analysis: architecture style detection (DDD, clean, vertical-slice, CQRS) and structure fitness for repo size. Deterministic.

Other · Architecture — Whether interfaces stay focused rather than fat — the Interface-Segregation principle (SOLID 'I').

Method: Roslyn scan: public interface member counts; fat-interface threshold (over 15 members) flagged per type. Deterministic, type-level.

• `IRepositoryBase<T>` declares 21 members. A wide interface forces every implementer and caller to depend on methods they don't use (the Interface-Segregation 'I' in SOLID). Split it into focused role-interfaces. — IRepositoryBase.cs:16
• `IUnitOfWork` declares 33 members. A wide interface forces every implementer and caller to depend on methods they don't use (the Interface-Segregation 'I' in SOLID). Split it into focused role-interfaces. — IUnitOfWork.cs:15

What to do

• Split fat interfaces into focused role-interfaces so clients depend only on what they use.

Other · Architecture — Whether read (query) handlers stay side-effect-free — a query that writes persistent state or raises events breaks CQS and makes reads unsafe to retry, cache, or route to a read replica.

Method: Roslyn scan: CQRS handlers classified query-vs-command by interface (IQueryHandler/ICommandHandler/IRequestHandler<TQuery,TResult>) and name convention (*Query/Get*/Find* vs *Command); each query handler's body checked for persistent-state writes (SaveChanges/repository Add-Update) or event publishes by resolved invocation. Deterministic, type-level, exhaustive over the detected handlers.

Coverage: Population: CQRS handlers identified by IQueryHandler/ICommandHandler/IRequestHandler interface + *Query/Get*/Find*/*Command NAME convention; query purity then checked exhaustively within that set — a query handler using neither convention is invisible, and mutation is a resolved persistence/publish CALL, not full dataflow.

Other · Security — Whether sensitive data is encrypted at rest and in transit and keys are vaulted.

Method: Roslyn plus filesystem scan: encryption presence (EF ColumnEncryption, key-vault references, HTTPS enforcement) and key-derivation KDF detection. Deterministic.

• No data-protection or encryption usage (ASP.NET Data Protection, AES, column encryption, PBKDF2) was found — sensitive data at rest may be unprotected. If TDE/KMS/vault is delegated to infrastructure, ignore.

What to do

• Encrypt sensitive data at rest (ASP.NET Core Data Protection / column encryption) and manage keys in a vault. Skip if delegated to infra (Postgres TDE, KMS, etc.).

Other · Security — Whether access is authorized by default — a framework authorization attribute/decorator or policy, or imperative guard methods (throw-on-violation) called from handlers.

Method: Roslyn scan: [Authorize] usage and authorization policies, plus imperative throw-on-violation guard methods detected via syntax. Deterministic.

• Only 1 imperative guard call site(s) — too few to demonstrate default-deny across handlers.

What to do

• Enforce authorization at every handler — call the guard method (throw-on-violation) from each one, or adopt [Authorize] so protected-by-default is demonstrable.

Other · Security — Whether changes to sensitive data are recorded (who, what, when) for compliance + incident response.

Method: Roslyn scan: audit-trail mechanism graded (SaveChanges interceptor/immutable AuditLog/[Audited] strong; bare IAuditable/AddAuditing weak). Deterministic.

• An audit mechanism is present, but the trail is not yet complete — missing: an immutable audit-log / audit-trail type to write to, [Audited] per-entity coverage.

What to do

• Back the audit convention with a structural mechanism: an EF SaveChanges interceptor (or equivalent) writing every sensitive change to an immutable audit log, and apply [Audited] to the entities that need a who-changed-what trail.

Other · Domain Modelling — Whether aggregates reference each other by identity (id) rather than by direct object reference — the core DDD consistency-boundary rule.

Method: Roslyn (DDD-gated): aggregate roots identified by convention; each aggregate field checked for direct references to other aggregates versus id-only. Deterministic, DDD-native.

Coverage: Population: aggregate roots identified by AggregateRoot/IAggregateRoot base/interface NAME convention; reference-by-identity then checked exhaustively within that set — a root not using those names is invisible.

• `Conversation` references the aggregate root `Event` directly (via `Event`) — hold its `EventId` instead. — Conversation.cs:26
• `Conversation` references the aggregate root `User` directly (via `Host`) — hold its `UserId` instead. — Conversation.cs:30
• `Conversation` references the aggregate root `User` directly (via `User`) — hold its `UserId` instead. — Conversation.cs:34
• `Coupon` references the aggregate root `User` directly (via `Author`) — hold its `UserId` instead. — Coupon.cs:45
• `Coupon` references the aggregate root `Payment` directly (via `Payments`) — hold its `PaymentId` instead. — Coupon.cs:51
• `Event` references the aggregate root `User` directly (via `Author`) — hold its `UserId` instead. — Event.cs:76
• `Event` references the aggregate root `Category` directly (via `Categories`) — hold its `CategoryId` instead. — Event.cs:84
• `Event` references the aggregate root `Payment` directly (via `Payments`) — hold its `PaymentId` instead. — Event.cs:94
• `Event` references the aggregate root `Conversation` directly (via `Conversations`) — hold its `ConversationId` instead. — Event.cs:98
• `Event` references the aggregate root `Ticket` directly (via `Tickets`) — hold its `TicketId` instead. — Event.cs:102
• `Notification` references the aggregate root `User` directly (via `TargetUser`) — hold its `UserId` instead. — Notification.cs:43
• `Notification` references the aggregate root `Payment` directly (via `Payment`) — hold its `PaymentId` instead. — Notification.cs:51
• `Payment` references the aggregate root `User` directly (via `Author`) — hold its `UserId` instead. — Payment.cs:66
• `Payment` references the aggregate root `Event` directly (via `Event`) — hold its `EventId` instead. — Payment.cs:70
• `Payment` references the aggregate root `Coupon` directly (via `Coupon`) — hold its `CouponId` instead. — Payment.cs:74
• `Payment` references the aggregate root `Ticket` directly (via `Tickets`) — hold its `TicketId` instead. — Payment.cs:78
• `Ticket` references the aggregate root `Event` directly (via `Event`) — hold its `EventId` instead. — Ticket.cs:53
• `Ticket` references the aggregate root `User` directly (via `User`) — hold its `UserId` instead. — Ticket.cs:57
• `Ticket` references the aggregate root `Payment` directly (via `Payment`) — hold its `PaymentId` instead. — Ticket.cs:61
• `User` references the aggregate root `Event` directly (via `Events`) — hold its `EventId` instead. — User.cs:74
• `User` references the aggregate root `Payment` directly (via `Payments`) — hold its `PaymentId` instead. — User.cs:76
• `User` references the aggregate root `Conversation` directly (via `UserConversations`) — hold its `ConversationId` instead. — User.cs:82
• `User` references the aggregate root `Conversation` directly (via `HostConversations`) — hold its `ConversationId` instead. — User.cs:83
• `User` references the aggregate root `Ticket` directly (via `Tickets`) — hold its `TicketId` instead. — User.cs:87
• `User` references the aggregate root `Notification` directly (via `Notifications`) — hold its `NotificationId` instead. — User.cs:89

What to do

• Reference other aggregates by their strongly-typed id, never by object reference, so each aggregate stays an independent consistency boundary.

Other · Domain Modelling — How much of the domain uses strongly-typed ids vs raw Guid/string/int — adoption curve, not all-or-nothing.

Method: Roslyn (DDD-gated): strongly-typed id adoption on domain entities/events; raw Guid/int/string ids counted versus wrapped types. Deterministic, adoption percentage.

Coverage: Population: id-like members by *Id/*Key NAME suffix; strongly-typed-ID shape then checked semantically — non-suffixed identifiers are not seen.

• `Conversation.EventId` is a raw `Guid` — give it a strongly-typed id: a dedicated single-field type wrapping the `Guid`, in whatever form your language spells that. — Conversation.cs:18
• `Conversation.HostId` is a raw `Guid` — give it a strongly-typed id: a dedicated single-field type wrapping the `Guid`, in whatever form your language spells that. — Conversation.cs:20
• `Conversation.UserId` is a raw `Guid` — give it a strongly-typed id: a dedicated single-field type wrapping the `Guid`, in whatever form your language spells that. — Conversation.cs:22
• `Conversation.LastMessageId` is a raw `Guid` — give it a strongly-typed id: a dedicated single-field type wrapping the `Guid`, in whatever form your language spells that. — Conversation.cs:24
• `Message.ReceiverId` is a raw `Guid` — give it a strongly-typed id: a dedicated single-field type wrapping the `Guid`, in whatever form your language spells that. — Message.cs:42
• `Message.EventId` is a raw `Guid` — give it a strongly-typed id: a dedicated single-field type wrapping the `Guid`, in whatever form your language spells that. — Message.cs:49
• `Message.ConversationId` is a raw `Guid` — give it a strongly-typed id: a dedicated single-field type wrapping the `Guid`, in whatever form your language spells that. — Message.cs:52
• `Coupon.AuthorId` is a raw `Guid` — give it a strongly-typed id: a dedicated single-field type wrapping the `Guid`, in whatever form your language spells that. — Coupon.cs:43
• `Event.AuthorId` is a raw `Guid` — give it a strongly-typed id: a dedicated single-field type wrapping the `Guid`, in whatever form your language spells that. — Event.cs:72
• `EmailContent.EventId` is a raw `Guid` — give it a strongly-typed id: a dedicated single-field type wrapping the `Guid`, in whatever form your language spells that. — EmailContent.cs:21
• `EventSubImage.EventId` is a raw `Guid` — give it a strongly-typed id: a dedicated single-field type wrapping the `Guid`, in whatever form your language spells that. — EventSubImage.cs:15
• `Expense.EventId` is a raw `Guid` — give it a strongly-typed id: a dedicated single-field type wrapping the `Guid`, in whatever form your language spells that. — Expense.cs:16
• `Reason.EventId` is a raw `Guid` — give it a strongly-typed id: a dedicated single-field type wrapping the `Guid`, in whatever form your language spells that. — Reason.cs:15
• `Review.AuthorId` is a raw `Guid` — give it a strongly-typed id: a dedicated single-field type wrapping the `Guid`, in whatever form your language spells that. — Review.cs:17
• `Review.EventId` is a raw `Guid` — give it a strongly-typed id: a dedicated single-field type wrapping the `Guid`, in whatever form your language spells that. — Review.cs:20
• `TicketType.EventId` is a raw `Guid` — give it a strongly-typed id: a dedicated single-field type wrapping the `Guid`, in whatever form your language spells that. — TicketType.cs:18
• `EmailAttachment.EmailContentId` is a raw `Guid` — give it a strongly-typed id: a dedicated single-field type wrapping the `Guid`, in whatever form your language spells that. — EmailAttachment.cs:16
• `SubExpense.ExpenseId` is a raw `Guid` — give it a strongly-typed id: a dedicated single-field type wrapping the `Guid`, in whatever form your language spells that. — SubExpense.cs:16
• `Notification.TargetUserId` is a raw `Guid` — give it a strongly-typed id: a dedicated single-field type wrapping the `Guid`, in whatever form your language spells that. — Notification.cs:31
• `Notification.InvitationId` is a raw `Guid` — give it a strongly-typed id: a dedicated single-field type wrapping the `Guid`, in whatever form your language spells that. — Notification.cs:35
• `Notification.PaymentId` is a raw `Guid` — give it a strongly-typed id: a dedicated single-field type wrapping the `Guid`, in whatever form your language spells that. — Notification.cs:37
• `Notification.UserFollowerId` is a raw `Guid` — give it a strongly-typed id: a dedicated single-field type wrapping the `Guid`, in whatever form your language spells that. — Notification.cs:39
• `Payment.PaymentIntentId` is a raw `String` — give it a strongly-typed id: a dedicated single-field type wrapping the `String`, in whatever form your language spells that. — Payment.cs:54
• `Payment.SessionId` is a raw `String` — give it a strongly-typed id: a dedicated single-field type wrapping the `String`, in whatever form your language spells that. — Payment.cs:56
• `Payment.EventId` is a raw `Guid` — give it a strongly-typed id: a dedicated single-field type wrapping the `Guid`, in whatever form your language spells that. — Payment.cs:58
• `Payment.AuthorId` is a raw `Guid` — give it a strongly-typed id: a dedicated single-field type wrapping the `Guid`, in whatever form your language spells that. — Payment.cs:61
• `Payment.CouponId` is a raw `Guid` — give it a strongly-typed id: a dedicated single-field type wrapping the `Guid`, in whatever form your language spells that. — Payment.cs:64
• `PaymentItem.TicketTypeId` is a raw `Guid` — give it a strongly-typed id: a dedicated single-field type wrapping the `Guid`, in whatever form your language spells that. — PaymentItem.cs:17
• `PaymentItem.EventId` is a raw `Guid` — give it a strongly-typed id: a dedicated single-field type wrapping the `Guid`, in whatever form your language spells that. — PaymentItem.cs:20
• `PaymentItem.PaymentId` is a raw `Guid` — give it a strongly-typed id: a dedicated single-field type wrapping the `Guid`, in whatever form your language spells that. — PaymentItem.cs:23
• `Ticket.TicketTypeId` is a raw `Guid` — give it a strongly-typed id: a dedicated single-field type wrapping the `Guid`, in whatever form your language spells that. — Ticket.cs:38
• `Ticket.EventId` is a raw `Guid` — give it a strongly-typed id: a dedicated single-field type wrapping the `Guid`, in whatever form your language spells that. — Ticket.cs:40
• `Ticket.AuthorId` is a raw `Guid` — give it a strongly-typed id: a dedicated single-field type wrapping the `Guid`, in whatever form your language spells that. — Ticket.cs:42
• `Ticket.PaymentId` is a raw `Guid` — give it a strongly-typed id: a dedicated single-field type wrapping the `Guid`, in whatever form your language spells that. — Ticket.cs:44
• `Function.ParentId` is a raw `String` — give it a strongly-typed id: a dedicated single-field type wrapping the `String`, in whatever form your language spells that. — Function.cs:28
• `Invitation.InviterId` is a raw `Guid` — give it a strongly-typed id: a dedicated single-field type wrapping the `Guid`, in whatever form your language spells that. — Invitation.cs:16
• `Invitation.InvitedId` is a raw `Guid` — give it a strongly-typed id: a dedicated single-field type wrapping the `Guid`, in whatever form your language spells that. — Invitation.cs:19
• `Invitation.EventId` is a raw `Guid` — give it a strongly-typed id: a dedicated single-field type wrapping the `Guid`, in whatever form your language spells that. — Invitation.cs:22
• `Permission.FunctionId` is a raw `String` — give it a strongly-typed id: a dedicated single-field type wrapping the `String`, in whatever form your language spells that. — Permission.cs:13
• `Permission.RoleId` is a raw `Guid` — give it a strongly-typed id: a dedicated single-field type wrapping the `Guid`, in whatever form your language spells that. — Permission.cs:16
• 4 further occurrence(s) are not listed individually; the score already reflects all 44.

What to do

• Adopt strongly-typed ids across the domain — finish the migration or document the boundary; primitive ids invite transposed-argument bugs.

Other · Domain Modelling — Whether aggregates/entities carry the behaviour that protects their invariants, rather than being data bags driven by external services.

Method: Roslyn (DDD-gated): entity method BODIES classified mutator-vs-query — only methods that mutate the entity's own declared state count as invariant-protecting behaviour, so a getter/passthrough doesn't rescue an anemic class. Deterministic, exhaustive over domain-layer entities.

Coverage: Population: entities by name/base convention; rich-vs-anemic judged by classifying each method body mutator-vs-query — logic-bearing domain types outside the convention are invisible.

• `Conversation` is an aggregate/entity with 10 data propert(ies) but no state-changing behaviour (only data and queries) — the business logic lives in a service. — Conversation.cs:11
• `Message` is an aggregate/entity with 14 data propert(ies) but no state-changing behaviour (only data and queries) — the business logic lives in a service. — Message.cs:10
• `Coupon` is an aggregate/entity with 14 data propert(ies) but no state-changing behaviour (only data and queries) — the business logic lives in a service. — Coupon.cs:12
• `Category` is an aggregate/entity with 6 data propert(ies) but no state-changing behaviour (only data and queries) — the business logic lives in a service. — Category.cs:8
• `EmailContent` is an aggregate/entity with 5 data propert(ies) but no state-changing behaviour (only data and queries) — the business logic lives in a service. — EmailContent.cs:9
• `EventSubImage` is an aggregate/entity with 5 data propert(ies) but no state-changing behaviour (only data and queries) — the business logic lives in a service. — EventSubImage.cs:8
• `Expense` is an aggregate/entity with 6 data propert(ies) but no state-changing behaviour (only data and queries) — the business logic lives in a service. — Expense.cs:9
• `Reason` is an aggregate/entity with 4 data propert(ies) but no state-changing behaviour (only data and queries) — the business logic lives in a service. — Reason.cs:8
• `Review` is an aggregate/entity with 9 data propert(ies) but no state-changing behaviour (only data and queries) — the business logic lives in a service. — Review.cs:10
• `TicketType` is an aggregate/entity with 9 data propert(ies) but no state-changing behaviour (only data and queries) — the business logic lives in a service. — TicketType.cs:11
• `EmailAttachment` is an aggregate/entity with 5 data propert(ies) but no state-changing behaviour (only data and queries) — the business logic lives in a service. — EmailAttachment.cs:9
• `SubExpense` is an aggregate/entity with 5 data propert(ies) but no state-changing behaviour (only data and queries) — the business logic lives in a service. — SubExpense.cs:9
• `Notification` is an aggregate/entity with 15 data propert(ies) but no state-changing behaviour (only data and queries) — the business logic lives in a service. — Notification.cs:13
• `Payment` is an aggregate/entity with 19 data propert(ies) but no state-changing behaviour (only data and queries) — the business logic lives in a service. — Payment.cs:16
• `PaymentItem` is an aggregate/entity with 11 data propert(ies) but no state-changing behaviour (only data and queries) — the business logic lives in a service. — PaymentItem.cs:10
• `Ticket` is an aggregate/entity with 14 data propert(ies) but no state-changing behaviour (only data and queries) — the business logic lives in a service. — Ticket.cs:14
• `User` is an aggregate/entity with 30 data propert(ies) but no state-changing behaviour (only data and queries) — the business logic lives in a service. — User.cs:23
• `Command` is an aggregate/entity with 4 data propert(ies) but no state-changing behaviour (only data and queries) — the business logic lives in a service. — Command.cs:8
• `Function` is an aggregate/entity with 8 data propert(ies) but no state-changing behaviour (only data and queries) — the business logic lives in a service. — Function.cs:9
• `Invitation` is an aggregate/entity with 7 data propert(ies) but no state-changing behaviour (only data and queries) — the business logic lives in a service. — Invitation.cs:9
• `Permission` is an aggregate/entity with 6 data propert(ies) but no state-changing behaviour (only data and queries) — the business logic lives in a service. — Permission.cs:9
• `UserFollower` is an aggregate/entity with 5 data propert(ies) but no state-changing behaviour (only data and queries) — the business logic lives in a service. — UserFollower.cs:8

What to do

• Move business rules onto the aggregates/entities they govern so invariants are enforced at the source, not in anemic services.

Other · Domain Modelling — Whether entities protect their state (private/init-only setters) instead of exposing public setters that bypass invariants. Softened when a rehydration framework (Marten/EF) is present.

Method: Roslyn (DDD-gated): public setters on entities detected; score softened when Marten/EF rehydration frameworks present. Deterministic, framework-aware.

Coverage: Population: entities by convention; encapsulation (setter shape) checked exhaustively within the set.

• `Conversation` exposes publicly writable state (Id, EventId, HostId, UserId, LastMessageId, Event, …). — Conversation.cs:11
• `Message` exposes publicly writable state (Id, Content, ImageUrl, ImageFileName, VideoUrl, VideoFileName, …). — Message.cs:10
• `Coupon` exposes publicly writable state (Id, Name, Description, Quantity, MinPrice, PercentValue, …). — Coupon.cs:12
• `Event` exposes publicly writable state (Id, CoverImageFileName, CoverImageUrl, Name, Description, Location, …). — Event.cs:22
• `Category` exposes publicly writable state (Id, Name, IconImageUrl, IconImageFileName, Color, EventCategories). — Category.cs:8
• `EmailContent` exposes publicly writable state (Id, Content, EventId, Event, EmailAttachments). — EmailContent.cs:9
• `EventSubImage` exposes publicly writable state (Id, EventId, ImageUrl, ImageFileName, Event). — EventSubImage.cs:8
• `Expense` exposes publicly writable state (Id, EventId, Title, Total, Event, SubExpenses). — Expense.cs:9
• `Reason` exposes publicly writable state (Id, EventId, Name, Event). — Reason.cs:8
• `Review` exposes publicly writable state (Id, AuthorId, EventId, Content, IsPositive, SentimentPercentage, …). — Review.cs:10
• `TicketType` exposes publicly writable state (Id, EventId, Name, Quantity, Price, NumberOfSoldTickets, …). — TicketType.cs:11
• `EmailAttachment` exposes publicly writable state (Id, EmailContentId, AttachmentFileName, AttachmentUrl, EmailContent). — EmailAttachment.cs:9
• `SubExpense` exposes publicly writable state (Id, ExpenseId, Name, Price, Expense). — SubExpense.cs:9
• `Notification` exposes publicly writable state (Id, Title, Message, Type, Timestamp, TargetUserId, …). — Notification.cs:13
• `Payment` exposes publicly writable state (Id, TicketQuantity, CustomerName, CustomerPhone, CustomerEmail, TotalPrice, …). — Payment.cs:16
• `PaymentItem` exposes publicly writable state (Id, TicketTypeId, EventId, PaymentId, Name, Quantity, …). — PaymentItem.cs:10
• `Ticket` exposes publicly writable state (Id, TicketNo, CustomerName, CustomerPhone, CustomerEmail, TicketTypeId, …). — Ticket.cs:14
• `User` exposes publicly writable state (FullName, Dob, Gender, Bio, AvatarUrl, AvatarFileName, …). — User.cs:23
• `Command` exposes publicly writable state (Id, Name, CommandInFunctions, Permissions). — Command.cs:8
• `Function` exposes publicly writable state (Id, Name, Url, SortOrder, ParentId, Parent, …). — Function.cs:9
• `Invitation` exposes publicly writable state (Id, InviterId, InvitedId, EventId, Inviter, Invited, …). — Invitation.cs:9
• `Permission` exposes publicly writable state (FunctionId, RoleId, CommandId, Function, Role, Command). — Permission.cs:9
• `UserFollower` exposes publicly writable state (Id, FollowerId, FollowedId, Follower, Followed). — UserFollower.cs:8

What to do

• Make entity setters private/init-only; change state only through methods that enforce the invariants (Marten/EF can bind via constructor or private setters).

Other · Domain Modelling — Whether the domain layer stays free of infrastructure dependencies (EF/Marten/HTTP/ASP.NET) — the clean-architecture dependency rule.

Method: Roslyn (DDD-gated): domain-layer types scanned for infrastructure usage in member SIGNATURES and inside method/accessor BODIES — resolved calls and object-creations into EF/Marten/HTTP/Mongo/Redis/message-bus types (not just a namespace allowlist). Deterministic, symbol-resolved, exhaustive over domain-layer bodies, DDD-native.

Coverage: Domain layer identified by NAMESPACE heuristic; infrastructure then resolved by symbol in member SIGNATURES and method/accessor BODIES — rename the layer and the check evaporates.

• `IUnitOfWork` (domain layer) references `Microsoft.EntityFrameworkCore.Storage` — an infrastructure concern (persistence/HTTP/web). — IUnitOfWork.cs:15
• `CalculatePositivePercentageOfReviewDomainEventHandler` (domain layer) references `System.Net.Http` — an infrastructure concern (persistence/HTTP/web). — CalculatePositivePercentageOfReviewDomainEventHandler.cs:9

What to do

• Invert domain→infrastructure dependencies: declare interfaces in the domain, implement them in infrastructure (Dependency Inversion).

Other · Domain Modelling — Whether repositories are per aggregate root (not per child entity) so the root's invariants can't be bypassed.

Method: Roslyn (DDD-gated): repository abstraction detection; repositories over non-aggregate-root entities flagged. Deterministic, DDD-native.

Coverage: Population: repositories + aggregate roots by NAME convention; per-root repository rule checked within the set.

• `CachedCategoriesRepository` is a repository over `Category`, which is an entity but not an aggregate root. Repositories should be per aggregate ROOT — loading/saving a child entity independently lets callers bypass the root's invariants. Access `Category` through its owning aggregate instead. — CachedCategoriesRepository.cs:10
• `CachedEventsRepository` is a repository over `Event`, which is an entity but not an aggregate root. Repositories should be per aggregate ROOT — loading/saving a child entity independently lets callers bypass the root's invariants. Access `Event` through its owning aggregate instead. — CachedEventsRepository.cs:12
• `CachedReviewsRepository` is a repository over `Review`, which is an entity but not an aggregate root. Repositories should be per aggregate ROOT — loading/saving a child entity independently lets callers bypass the root's invariants. Access `Review` through its owning aggregate instead. — CachedReviewsRepository.cs:10
• `CategoriesRepository` is a repository over `Category`, which is an entity but not an aggregate root. Repositories should be per aggregate ROOT — loading/saving a child entity independently lets callers bypass the root's invariants. Access `Category` through its owning aggregate instead. — CategoriesRepository.cs:8
• `CommandsRepository` is a repository over `Command`, which is an entity but not an aggregate root. Repositories should be per aggregate ROOT — loading/saving a child entity independently lets callers bypass the root's invariants. Access `Command` through its owning aggregate instead. — CommandsRepository.cs:10
• `ConversationsRepository` is a repository over `Conversation`, which is an entity but not an aggregate root. Repositories should be per aggregate ROOT — loading/saving a child entity independently lets callers bypass the root's invariants. Access `Conversation` through its owning aggregate instead. — ConversationsRepository.cs:8
• `CouponsRepository` is a repository over `Coupon`, which is an entity but not an aggregate root. Repositories should be per aggregate ROOT — loading/saving a child entity independently lets callers bypass the root's invariants. Access `Coupon` through its owning aggregate instead. — CouponsRepository.cs:8
• `EmailAttachmentsRepository` is a repository over `EmailAttachment`, which is an entity but not an aggregate root. Repositories should be per aggregate ROOT — loading/saving a child entity independently lets callers bypass the root's invariants. Access `EmailAttachment` through its owning aggregate instead. — EmailAttachmentsRepository.cs:9
• `EmailContentsRepository` is a repository over `EmailContent`, which is an entity but not an aggregate root. Repositories should be per aggregate ROOT — loading/saving a child entity independently lets callers bypass the root's invariants. Access `EmailContent` through its owning aggregate instead. — EmailContentsRepository.cs:9
• `EventsRepository` is a repository over `Event`, which is an entity but not an aggregate root. Repositories should be per aggregate ROOT — loading/saving a child entity independently lets callers bypass the root's invariants. Access `Event` through its owning aggregate instead. — EventsRepository.cs:12
• `EventSubImagesRepository` is a repository over `EventSubImage`, which is an entity but not an aggregate root. Repositories should be per aggregate ROOT — loading/saving a child entity independently lets callers bypass the root's invariants. Access `EventSubImage` through its owning aggregate instead. — EventSubImagesRepository.cs:9
• `ExpensesRepository` is a repository over `Expense`, which is an entity but not an aggregate root. Repositories should be per aggregate ROOT — loading/saving a child entity independently lets callers bypass the root's invariants. Access `Expense` through its owning aggregate instead. — ExpensesRepository.cs:8
• `FunctionsRepository` is a repository over `Function`, which is an entity but not an aggregate root. Repositories should be per aggregate ROOT — loading/saving a child entity independently lets callers bypass the root's invariants. Access `Function` through its owning aggregate instead. — FunctionsRepository.cs:10
• `InvitationsRepository` is a repository over `Invitation`, which is an entity but not an aggregate root. Repositories should be per aggregate ROOT — loading/saving a child entity independently lets callers bypass the root's invariants. Access `Invitation` through its owning aggregate instead. — InvitationsRepository.cs:9
• `MessagesRepository` is a repository over `Message`, which is an entity but not an aggregate root. Repositories should be per aggregate ROOT — loading/saving a child entity independently lets callers bypass the root's invariants. Access `Message` through its owning aggregate instead. — MessagesRepository.cs:9
• `NotificationsRepository` is a repository over `Notification`, which is an entity but not an aggregate root. Repositories should be per aggregate ROOT — loading/saving a child entity independently lets callers bypass the root's invariants. Access `Notification` through its owning aggregate instead. — NotificationsRepository.cs:8
• `PaymentItemsRepository` is a repository over `PaymentItem`, which is an entity but not an aggregate root. Repositories should be per aggregate ROOT — loading/saving a child entity independently lets callers bypass the root's invariants. Access `PaymentItem` through its owning aggregate instead. — PaymentItemsRepository.cs:9
• `PaymentsRepository` is a repository over `Payment`, which is an entity but not an aggregate root. Repositories should be per aggregate ROOT — loading/saving a child entity independently lets callers bypass the root's invariants. Access `Payment` through its owning aggregate instead. — PaymentsRepository.cs:8
• `PermissionsRepository` is a repository over `Permission`, which is an entity but not an aggregate root. Repositories should be per aggregate ROOT — loading/saving a child entity independently lets callers bypass the root's invariants. Access `Permission` through its owning aggregate instead. — PermissionsRepository.cs:8
• `ReasonsRepository` is a repository over `Reason`, which is an entity but not an aggregate root. Repositories should be per aggregate ROOT — loading/saving a child entity independently lets callers bypass the root's invariants. Access `Reason` through its owning aggregate instead. — ReasonsRepository.cs:9
• `ReviewsRepository` is a repository over `Review`, which is an entity but not an aggregate root. Repositories should be per aggregate ROOT — loading/saving a child entity independently lets callers bypass the root's invariants. Access `Review` through its owning aggregate instead. — ReviewsRepository.cs:8
• `SubExpensesRepository` is a repository over `SubExpense`, which is an entity but not an aggregate root. Repositories should be per aggregate ROOT — loading/saving a child entity independently lets callers bypass the root's invariants. Access `SubExpense` through its owning aggregate instead. — SubExpensesRepository.cs:8
• `TicketsRepository` is a repository over `Ticket`, which is an entity but not an aggregate root. Repositories should be per aggregate ROOT — loading/saving a child entity independently lets callers bypass the root's invariants. Access `Ticket` through its owning aggregate instead. — TicketsRepository.cs:8
• `TicketTypesRepository` is a repository over `TicketType`, which is an entity but not an aggregate root. Repositories should be per aggregate ROOT — loading/saving a child entity independently lets callers bypass the root's invariants. Access `TicketType` through its owning aggregate instead. — TicketTypesRepository.cs:9
• `UserFollowersRepository` is a repository over `UserFollower`, which is an entity but not an aggregate root. Repositories should be per aggregate ROOT — loading/saving a child entity independently lets callers bypass the root's invariants. Access `UserFollower` through its owning aggregate instead. — UserFollowersRepository.cs:9
• `ICachedReviewsRepository` is a repository over `Review`, which is an entity but not an aggregate root. Repositories should be per aggregate ROOT — loading/saving a child entity independently lets callers bypass the root's invariants. Access `Review` through its owning aggregate instead. — ICachedReviewsRepository.cs:6
• `ICommandsRepository` is a repository over `Command`, which is an entity but not an aggregate root. Repositories should be per aggregate ROOT — loading/saving a child entity independently lets callers bypass the root's invariants. Access `Command` through its owning aggregate instead. — ICommandsRepository.cs:7
• `IEmailAttachmentsRepository` is a repository over `EmailAttachment`, which is an entity but not an aggregate root. Repositories should be per aggregate ROOT — loading/saving a child entity independently lets callers bypass the root's invariants. Access `EmailAttachment` through its owning aggregate instead. — IEmailAttachmentsRepository.cs:7
• `IEmailContentsRepository` is a repository over `EmailContent`, which is an entity but not an aggregate root. Repositories should be per aggregate ROOT — loading/saving a child entity independently lets callers bypass the root's invariants. Access `EmailContent` through its owning aggregate instead. — IEmailContentsRepository.cs:7
• `IEventSubImagesRepository` is a repository over `EventSubImage`, which is an entity but not an aggregate root. Repositories should be per aggregate ROOT — loading/saving a child entity independently lets callers bypass the root's invariants. Access `EventSubImage` through its owning aggregate instead. — IEventSubImagesRepository.cs:7
• `IExpensesRepository` is a repository over `Expense`, which is an entity but not an aggregate root. Repositories should be per aggregate ROOT — loading/saving a child entity independently lets callers bypass the root's invariants. Access `Expense` through its owning aggregate instead. — IExpensesRepository.cs:6
• `IFunctionsRepository` is a repository over `Function`, which is an entity but not an aggregate root. Repositories should be per aggregate ROOT — loading/saving a child entity independently lets callers bypass the root's invariants. Access `Function` through its owning aggregate instead. — IFunctionsRepository.cs:7
• `IInvitationsRepository` is a repository over `Invitation`, which is an entity but not an aggregate root. Repositories should be per aggregate ROOT — loading/saving a child entity independently lets callers bypass the root's invariants. Access `Invitation` through its owning aggregate instead. — IInvitationsRepository.cs:7
• `IMessagesRepository` is a repository over `Message`, which is an entity but not an aggregate root. Repositories should be per aggregate ROOT — loading/saving a child entity independently lets callers bypass the root's invariants. Access `Message` through its owning aggregate instead. — IMessagesRepository.cs:7
• `IPaymentItemsRepository` is a repository over `PaymentItem`, which is an entity but not an aggregate root. Repositories should be per aggregate ROOT — loading/saving a child entity independently lets callers bypass the root's invariants. Access `PaymentItem` through its owning aggregate instead. — IPaymentItemsRepository.cs:7
• `IReasonsRepository` is a repository over `Reason`, which is an entity but not an aggregate root. Repositories should be per aggregate ROOT — loading/saving a child entity independently lets callers bypass the root's invariants. Access `Reason` through its owning aggregate instead. — IReasonsRepository.cs:7
• `IReviewsRepository` is a repository over `Review`, which is an entity but not an aggregate root. Repositories should be per aggregate ROOT — loading/saving a child entity independently lets callers bypass the root's invariants. Access `Review` through its owning aggregate instead. — IReviewsRepository.cs:6
• `ISubExpensesRepository` is a repository over `SubExpense`, which is an entity but not an aggregate root. Repositories should be per aggregate ROOT — loading/saving a child entity independently lets callers bypass the root's invariants. Access `SubExpense` through its owning aggregate instead. — ISubExpensesRepository.cs:6
• `ITicketTypesRepository` is a repository over `TicketType`, which is an entity but not an aggregate root. Repositories should be per aggregate ROOT — loading/saving a child entity independently lets callers bypass the root's invariants. Access `TicketType` through its owning aggregate instead. — ITicketTypesRepository.cs:7
• `IUserFollowersRepository` is a repository over `UserFollower`, which is an entity but not an aggregate root. Repositories should be per aggregate ROOT — loading/saving a child entity independently lets callers bypass the root's invariants. Access `UserFollower` through its owning aggregate instead. — IUserFollowersRepository.cs:7

What to do

• Define repositories per aggregate root; reach child entities through their root so invariants can't be bypassed.

Other · Domain Modelling — Whether clusters of primitives that travel together (a missing value object) are extracted — a low-weight suggestion, LLM-confirmed when configured.

Method: Roslyn (DDD-gated): primitive parameter clusters recurring three or more times across signatures extracted, then confirmed by language model when configured. Advisory, low-weight.

Other · Event-Driven — Whether event handlers stay asynchronous (no blocking remote HTTP/gRPC calls awaited inside a handler).

Method: Roslyn semantic scan (event-driven gated): event-handler bodies scanned for HTTP/gRPC invocations by resolved symbol type, not substring. Deterministic, semantic-resolved.

• `CalculatePositivePercentageOfReviewDomainEventHandler.Handle` makes a synchronous remote call (an HTTP call) while handling an event. The handler now depends, in real time, on another service being up and fast — the opposite of why you went event-driven. Publish a follow-up message (or use the outbox) instead of calling out and awaiting a response inside the handler. — CalculatePositivePercentageOfReviewDomainEventHandler.cs:20

What to do

• Remove synchronous remote calls from message handlers — react by publishing further messages, so services stay temporally decoupled.

Other · Event-Driven — Whether commands have a single handler (one owner of the decision) and fan-out is modelled with events.

Method: Roslyn scan (event-driven gated): command-shaped messages identified by convention; handler count per command checked for the exactly-one rule. Deterministic, hard fact.

Other · Event-Driven — Whether events are named in the past tense (a clarity nudge — low weight).

Method: Roslyn scan (event-driven gated): domain and integration events checked for past-tense naming (-ed/-en suffix or irregular set). Naming nudge, low-weight advisory.

• `CalculatePositivePercentageOfReviewDomainEvent` reads as an instruction, not a fact that happened. Events describe something that already occurred — name them in the past tense (e.g. `OrderPlaced`, `PaymentCaptured`) so the ubiquitous language stays clear. — CalculatePositivePercentageOfReviewDomainEvent.cs:5
• `DomainEvent` reads as an instruction, not a fact that happened. Events describe something that already occurred — name them in the past tense (e.g. `OrderPlaced`, `PaymentCaptured`) so the ubiquitous language stays clear. — DomainEvent.cs:14
• `IDomainEvent` reads as an instruction, not a fact that happened. Events describe something that already occurred — name them in the past tense (e.g. `OrderPlaced`, `PaymentCaptured`) so the ubiquitous language stays clear. — IDomainEvent.cs:13

What to do

• Name events in the past tense — they record facts that already happened.

Other · Event-Driven — Whether state changes and message publishes are atomic (a transactional outbox) rather than a crash-unsafe dual write.

Method: Roslyn semantic scan (event-driven gated): event-handler methods scanned for DB-save plus bus-publish without a transactional outbox reference. Deterministic, semantic-resolved.

Other · Readiness — Whether retry-prone mutations (command handlers + message/event consumers) are idempotent so an at-least-once redelivery or client retry doesn't double-apply the effect — heuristic at-risk detection confirmed by language model, advisory.

Method: Roslyn heuristic (any mutation, ungated): command handlers and message/event consumers that mutate persistent state without a visible idempotency guard (exists/dedup check, upsert, idempotency-key/inbox, conditional/versioned write, fixed-value set) flagged as at-risk; each at-risk candidate then confirmed or cleared by a language model as genuinely non-idempotent versus naturally-idempotent. Advisory without a model (heuristic-only, degraded), per-candidate judged with one.

Coverage: Population: retry-prone mutations — command handlers (CQRS write side) + message/event consumers (IConsumer/I*EventHandler) — that mutate persistent state; runs on any repo with mutations, not only event-driven ones. The at-risk subset (no obvious guard) is a HEURISTIC candidate set, each then LLM-JUDGED non-idempotent vs safe; a handler outside those conventions, or a guard the LLM can't confirm, is bounded by the sample. Degrades to heuristic-only when no model is configured.

• `CreateSubExpense.CreateSubExpenseCommandHandler.Handle` mutates persistent state (a repository write) with no idempotency guard, and the model confirms a re-run would double-apply it. A retry or at-least-once redelivery means it can run twice — add an exists/dedup check, an upsert, an idempotency-key/inbox, or a versioned write. — CreateSubExpenseCommandHandler.cs:19

What to do

• Make retry-prone mutations idempotent — guard each write with an exists/dedup check, an upsert, an idempotency-key/inbox, or a versioned write, so a re-run doesn't double-apply.

Other · Code Health — Unreviewed-generation residue: shipped members still throwing NotImplementedException, and placeholder string literals left in non-test, non-generated code. Scored as a quality signature, never as a claim about authorship.

Method: Roslyn syntax scan: NotImplementedException throws and placeholder string literals in non-test, non-generated shipped code. Deterministic, code-shape signature.

Other · Code Health — Unfinished work detected by code SHAPE, not keywords: members that only throw a "not implemented" exception, methods that take inputs and return a constant, async methods that never await, dead `if (false)` / `#if false` branches, and skeleton types most of whose members are holes. A real, objective slice of technical debt.

Method: Roslyn syntax scan: incompleteness by code shape (constant-returning methods, async-never-await, #if false branches, skeleton types), not keyword-gated. Deterministic, code-shape heuristic.

Maturity · Maturity — Whether the repo and its projects have a README, and whether it's substantive and current.

Method: Filesystem scan: README presence, word count, and headings for depth; git history for staleness. Exhaustive across root and project dirs, deterministic.

What to do

• Add a 'Testing' section to the root README — how to run the test suite.
• Add a README to the 6 of 6 project(s) that lack one — worth up to 2 pts.

Maturity · Maturity — Whether key decisions (ADRs) and the high-level shape (C4/diagrams) are written down.

Method: Filesystem scan: ADR folder/naming conventions or content, plus Mermaid/PlantUML/C4/architecture.md discovery. Exhaustive, deterministic.

• No Architecture Decision Records found — decisions aren't captured for future maintainers.

What to do

• Start an ADR log (docs/adr/) recording significant decisions and their rationale.

Maturity · Maturity — Whether the repo is organised deliberately — src/test separation and consistent project naming.

Method: Filesystem scan: src/test folder separation and namespace-prefix consistency (majority RootNamespace agreement). Exhaustive across projects, deterministic.

• Tests aren't grouped in a dedicated test folder — the test surface isn't separable from production code at a glance.

What to do

• Group tests in the folder your build system expects (tests/, test/, spec/, or your module's test source set) so the test surface is discoverable and CI can scope it.

Maturity · Maturity — Whether the README actually describes the code that exists (LLM-judged, advisory).

Method: Judged by language model at low temperature: README accuracy versus actual projects, within a disclosed tolerance. Advisory, not a measured number.

Readiness · Readiness — Whether an automated pipeline builds and tests every change.

Method: Filesystem scan: CI workflow files (.github/workflows, .gitlab-ci.yml, etc.) for build and test stages. Exhaustive, deterministic.

• A CI pipeline exists and the word "test" appears, but no explicit test-runner invocation (your stack's test command, or a test job) was matched — the gate may be running tests, or "test" may be incidental (a path, "latest", a reporter). Make the test step explicit so the gate is unambiguous.

What to do

• Run the test suite in CI via an explicit runner step for your stack, and gate merges on it.

Readiness · Readiness — Whether the code is diagnosable in production — structured logging, tracing/metrics, health checks.

Method: Filesystem/Roslyn scan: structured-logging frameworks (Serilog, NLog), OpenTelemetry, and health-check endpoint patterns. Exhaustive, deterministic.

• Only 3/5 service-like projects use logging (pure contract/DTO projects are excluded — they have nothing to log).

What to do

• Extend structured logging to the remaining service-like projects so the whole executable surface is diagnosable in production.
• Consider OpenTelemetry tracing/metrics and a health-check endpoint for operability.

Readiness · Readiness — Whether SAST, secret/dependency scanning and performance benchmarking are wired in (presence, not runtime).

Method: Filesystem scan: SAST configuration, dependency-update automation, secret scanning, and a benchmark harness or benchmark step — in this repository's own ecosystem. Exhaustive, deterministic.

What to do

• Enable Dependabot/Renovate or a dependency-review gate.
• Add gitleaks/trufflehog in CI to block PRs that introduce committed secrets.

Readiness · Readiness — Whether releases are automated and safely reversible (probes, rolling updates, approval gates) — from manifests/pipeline files, not the live environment.

Method: Filesystem scan: deployment manifests/IaC (K8s YAML, Helm, Terraform) for rolling updates, probes, approval gates, migration hooks. Exhaustive, deterministic.

• Deployment automation exists but no readiness/liveness probes, rolling-update strategy, lifecycle hooks or migration job were evidenced — a bad release is harder to detect and reverse.

What to do

• Add readiness/liveness probes and a rolling-update (or blue/green) strategy so a bad release is caught and rolled back automatically.
• Add an approval/environment gate (required reviewers / protection rules) before production promotion.

Readiness · Readiness — Whether disaster recovery is planned and codified — backups, geo-recovery, RTO/RPO, persistence guarantees — from IaC + container manifests + docs, never the live cloud.

Method: Filesystem scan: disaster recovery, backup, geo-recovery, RTO/RPO, persistence guarantees from IaC, manifests, and docs. Exhaustive, deterministic, never a live environment.

• A persistence guard (data volume / purge-protection) was found, but no backup, geo-recovery or RTO/RPO controls were evidenced — a volume that survives a container recreate is not a tested restore from catastrophic loss.

What to do

• Codify backups + geo-recovery in IaC and document RTO/RPO and the restore procedure — a persistence guard alone is not disaster recovery.

Readiness · Readiness — Whether outbound HTTP calls are wrapped in resilience (retry/timeout/circuit-breaker) so a failing dependency doesn't cascade.

Method: Roslyn scan: Polly resilience markers (Retry, CircuitBreaker, Timeout) on outbound HTTP invocations. Computed per type, deterministic.

• The app makes outbound HTTP calls but no resilience handler was detected (Polly / AddStandardResilienceHandler / circuit-breaker). A slow or failing dependency will cascade — add timeouts, retries with back-off, and a circuit breaker.

What to do

• Add `AddStandardResilienceHandler()` (or Polly policies) to your HttpClient registrations so a flaky dependency can't take the app down.

Readiness · Readiness — Whether EF Core schema changes go through versioned migrations rather than the un-evolvable EnsureCreated().

Method: Roslyn scan: EF Core DbContext for a versioned migrations directory versus bare EnsureCreated usage. Exhaustive per project, deterministic.

Other · Security — Transport security, security headers, secure cookies, input validation, middleware order and crypto hygiene (presence, not runtime).

Method: Roslyn plus filesystem scan: HSTS/security headers, secure cookies, input validation, middleware order, weak crypto (MD5/SHA1/DES); HTTPS-metadata context-aware. Deterministic.

• No Content-Security-Policy / X-Frame-Options / X-Content-Type-Options configuration found — defense in depth, even when a reverse proxy could set them. (−2.0 on this card.)

What to do

• Add security response headers (Content-Security-Policy, X-Frame-Options, X-Content-Type-Options) — defense in depth, even when a reverse proxy could set them.

Other · Code Health — Whether the code avoids sync-over-async (deadlock-prone blocking on tasks) and async void.

Method: Roslyn syntax scan: async methods scanned for .Wait()/.GetAwaiter().GetResult() and async-void outside event handlers. Deterministic, hard fact per invocation.

• Blocking on a Task with `.Wait()`/`.GetAwaiter().GetResult()` can deadlock (and wastes a thread). Make the caller `async` and `await` instead. (×10) — ApplicationExtensions.cs:70, CachedRepositoryBase.cs:47, CachedRepositoryBase.cs:73, …

What to do

• Sync-over-async (deadlock risk)

Other · Code Health — Whether async methods accept a CancellationToken so work can be cancelled (adoption curve).

Method: Roslyn scan: every async method (excluding framework-fixed overrides/Blazor handlers) checked for CancellationToken parameter presence. Deterministic, adoption percentage.

• Only 97/239 async methods accept a CancellationToken, so in-flight work can't be stopped early when the caller gives up — whatever ends it in your host (shutdown signal, timeout, abandoned request, user cancel). Thread a token through the call chain and honour it at each await and loop; where a method genuinely cannot be interrupted, omitting it is a deliberate choice — judge against your hosting model.
• No CancellationToken parameter — this work can't be stopped early once started. (×25) — AuthController.cs:40, AuthController.cs:66, AuthController.cs:92, …

What to do

• Thread a CancellationToken through async methods so work stops promptly on cancellation.

Other · Code Health — Whether exceptions are handled rather than silently swallowed or rethrown with lost stack traces.

Method: Roslyn syntax scan: every catch clause counted; empty catches and bare rethrows flagged. Population is all catch clauses, not estimated. Deterministic, hard fact.

Other · Code Health — Whether log calls use message templates (queryable) rather than interpolated strings.

Method: Roslyn syntax scan: every log call-site counted; interpolated-string first-argument violations flagged. Population is all log calls, not estimated. Deterministic.

Other · Code Health — Whether nullable reference types are enabled and not undermined by heavy `!` suppression.

Method: Roslyn compiler-options scan: NullableContextOptions per project; null-forgiving (!) suppression density per 1k syntax nodes. Deterministic, adoption plus suppression penalty.

• ~0.2 `!` suppressions per 1k syntax nodes — each one tells the compiler to trust you about null, suppressing the very safety NRTs provide.

What to do

• Enable <Nullable>enable</Nullable> across all projects and resolve warnings rather than suppressing with `!`.