Maintainability Report

Generated 2026-09-19T22:05:42+00:00 · commit 6c609930bbd17283882e7953c90fe97634f12bbb · branch main · root /Users/marshallguillory/repos/maintainability-agent · standard ISO/IEC 25010 maintainability-inspired 0-5 scale, rate-based

Coverage

12 of 17 tools contributed — concerns all, depth heavy, license policy copyleft-any. Plus 8 built-in detectors.

declarations measured by analyzers, completed by built-in detectors: no analyzer supplies cognitive_complexity for C, C#, C++, Fortran, Go, Java, JavaScript, PHP, Ruby, Rust, Swift, TypeScript, so the built-in scanner supplied it for those declarations and the analyzers supplied the rest; the criterion set is complete per declaration, which is what makes the rate comparable to the rubric's.

Nothing examined: testing.

These concerns are unmeasured, not clean. Install a tool that covers them, or widen analyzers.depth, to have them reported.

Analyzer children are not network-isolated. 12 external tools ran as local child processes. This agent does not transmit the audited source and opens no socket of its own, but it does not sandbox what it spawns: a third-party analyzer that reaches the network is outside what this run controls or observes. Determinism and no upload are the promise; a kernel air-gap is not.

Recorded scans

Estimate over recorded scans

Pillars over time (condition)

Practice level over time (maturity — a separate series)

Categories, this scan

Trend

61 separate series; scans either side of a break were produced by different instruments and are reported apart. The current series is given in full, the earlier ones summarized.

This series begins at a break: the tool version changed, so scans before this point were produced by a different instrument and cannot be joined to those after it.

Current series — 1 scan, 2026-09-19T22:09:11Z to 2026-09-19T22:09:11Z.

• Direction: unknown.
• Debt velocity: 0 introduced, 0 cleared.
• Growth: unknown.
• Never cleared in this window: 0 findings.

Earlier series (60 series)

Every figure describes scans that happened; nothing forecasts.

Economic Context (scenario)

0 – 0 USD over 12 months (base 0 USD), across 0 work-order item(s).

This is a scenario, not a prediction.

Assumptions:

• each bound = affected changes/year × incremental hours/change × loaded labor rate × horizon/12
• no usable history; assumed one change per work-order item per year
• incremental hours/change of 0.25-2.0 (base 1.0) — a stated default unless configured
• loaded labor rate 130.0-275.0 USD/hour (base 165.0), as configured
• planning horizon of 12 months
• a scenario computed from these assumptions; change them and the range moves with them

TDD-shaped tests

TDD-shaped tests: detected beside 128 of 154 production source files (path pairing). Constructs: pytest in 260 file(s), unittest in 1 file(s), describe_it in 18 file(s), parametrize in 90 file(s), given_when_then in 2 file(s).

Chronology is not measured. Effectiveness is unscored unless the operator opted into suite execution.

Test Suite

The operator opted in to running the repository's test command; it failed (exit 1).

Command: pytest -n auto --cov=maintainability_audit --cov-report=xml:coverage.xml -q

Coverage: 96.0% line coverage

Pillars

Practice level 4 of 5 — CI holds a numeric quality gate.

Not measured here, and why:

• efficiency — requires profiling, load testing and runtime telemetry, none of which a static pass produces; permanently out of scope rather than temporarily unmeasured

Enforcement found: linter-config, recorded-decisions, lint-in-ci, types-in-ci, duplication-in-ci, coverage-gate.

ISO/IEC 25010 Maintainability Score

Aspect Scores

Not Scored — no measurement exists

Largest Files

Function Hotspots

Security Work Order

Written by secure-code-agent 0.12.8 and reproduced as it wrote it. It is that tool's work order, not this one's: its findings are not re-ranked or merged into the maintainability work order above.

68 to fix · 0 to review · 5226 suppression candidates.

Fix

Defects the scanner is confident about.

69             )
70     return ElementTree.fromstring(payload)  # noqa: S314 - declarations refused above

55     request.add_header("Authorization", f"Basic {basic}")
56     with urllib.request.urlopen(request, timeout=30) as response:  # noqa: S310 - fixed host
57         body = response.read().decode()

108     request.add_header("Authorization", f"Basic {basic}")
109     with urllib.request.urlopen(request, timeout=30) as response:  # noqa: S310 - fixed host
110         found = json.loads(response.read().decode()).get("issues") or []

28 
29 import subprocess
30 from pathlib import Path

50     try:
51         result = subprocess.run(  # noqa: S603 - argv list, never a shell
52             # D71: this spawn is not `run_git`, and the sweep that was
53             # meant to hold that rule only read `git_tools.py` -- so
54             # the one git command in this package that lives
55             # somewhere else went uncovered. `commits_in_range` runs
56             # `rev-list` here before any worktree exists, which is
57             # exactly the read that can schedule housekeeping.
58             # `_attr_tree_config` as well as `READ_ONLY_GIT_CONFIG`. The
59             # fixed `-c` list cannot name the per-driver filter/textconv
60             # keys a tree selects in `.gitattributes`, so attribute-driven
61             # code execution is cut off by reading attributes from an empty
62             # tree instead -- and backfill's `worktree add` re-hashes
63             # content, which is exactly what runs a `clean` filter. `run_git`
64             # got this; this spawner, living outside `git_tools`, did not
65             # (audit of `e88b429`; the D92 sweep only read `git_tools.py`).
66             ["git", *READ_ONLY_GIT_CONFIG, *_attr_tree_config(root),
67              "-C", str(root), *args],
68             capture_output=True, text=True, check=False,
69             timeout=GIT_TIMEOUT_SECONDS, env=git_env())
70     except subprocess.TimeoutExpired as expired:

50     try:
51         result = subprocess.run(  # noqa: S603 - argv list, never a shell
52             # D71: this spawn is not `run_git`, and the sweep that was
53             # meant to hold that rule only read `git_tools.py` -- so
54             # the one git command in this package that lives
55             # somewhere else went uncovered. `commits_in_range` runs
56             # `rev-list` here before any worktree exists, which is
57             # exactly the read that can schedule housekeeping.
58             # `_attr_tree_config` as well as `READ_ONLY_GIT_CONFIG`. The
59             # fixed `-c` list cannot name the per-driver filter/textconv
60             # keys a tree selects in `.gitattributes`, so attribute-driven
61             # code execution is cut off by reading attributes from an empty
62             # tree instead -- and backfill's `worktree add` re-hashes
63             # content, which is exactly what runs a `clean` filter. `run_git`
64             # got this; this spawner, living outside `git_tools`, did not
65             # (audit of `e88b429`; the D92 sweep only read `git_tools.py`).
66             ["git", *READ_ONLY_GIT_CONFIG, *_attr_tree_config(root),
67              "-C", str(root), *args],
68             capture_output=True, text=True, check=False,
69             timeout=GIT_TIMEOUT_SECONDS, env=git_env())
70     except subprocess.TimeoutExpired as expired:

20 from typing import Any
21 from xml.etree import ElementTree
22

32 import shutil
33 import subprocess
34 import sys

254     try:
255         completed = subprocess.run(  # noqa: S603 - argv list, never a shell
256             [npm, "config", "get", "registry"],
257             cwd=neutral, capture_output=True, text=True, timeout=30,
258             env={k: v for k, v in os.environ.items() if k not in _CODE_LOADING_VARS},
259             check=False,
260         )
261     except (OSError, subprocess.SubprocessError):

430     try:
431         completed = subprocess.run(  # noqa: S603 - argv is built by adapters, never a shell string
432             argv,
433             cwd=str(cwd or invocation.cwd) if (cwd or invocation.cwd) else None,
434             capture_output=True,
435             text=True,
436             timeout=timeout_seconds,
437             env={**analyzer_env(), **(invocation.env or {})},
438             check=False,
439         )
440     except subprocess.TimeoutExpired:

29 from typing import Any
30 from xml.etree import ElementTree
31

20 import re
21 import subprocess
22 from pathlib import Path

56 more not shown.

Semantic findings

TypeScript semantic coverage: unknown — no recorded type analysis and no local type checker: semantic coverage for TypeScript is unknown. Absence of analysis is not absence of findings.