Maintainability Report

Generated 2026-10-30T23:33:52+00:00 · commit cf1e958ac373be65ef7938f2facef2c81ffb4d1f · branch example-report-5.1.2 · root /private/tmp/ma512/maintainability-agent · standard ISO/IEC 25010 maintainability-inspired 0-5 scale, rate-based

Coverage

14 of 17 tools contributed — concerns all, depth heavy, license policy copyleft-any. Plus 8 built-in detectors.

declarations measured by analyzers, completed by built-in detectors: no analyzer supplies cognitive_complexity for C, C#, C++, Fortran, Go, Java, JavaScript, Kotlin, PHP, Ruby, Rust, Swift, TypeScript, so the built-in scanner supplied it for those declarations and the analyzers supplied the rest; the criterion set is complete per declaration, which is what makes the rate comparable to the rubric's.

jscpd reported 151 duplication findings; they are listed and their count does not move the grade: the duplication dimension is scored from the built-in detectors only.

Nothing examined: testing.

These concerns are unmeasured, not clean. Install a tool that covers them, widen analyzers.depth, or declare the SARIF your own build or pipeline already writes in analyzers.pipeline_results to have them reported.

Analyzer children are not network-isolated. 14 external tools ran as local child processes. This agent does not transmit the audited source and opens no socket of its own, but it does not sandbox what it spawns: a third-party analyzer that reaches the network is outside what this run controls or observes. Determinism and no upload are the promise; a kernel air-gap is not.

Recorded scans

Estimate over recorded scans

Pillars over time (condition)

Practice level over time (maturity — a separate series)

Categories, this scan

Trend

90 separate series; scans either side of a break were produced by different instruments and are reported apart. The current series is given in full, the earlier ones summarized.

This series begins at a break: the tool version, which analyzers contributed changed, so scans before this point were produced by a different instrument and cannot be joined to those after it.

Current series — 1 scan, 2026-10-30T23:34:45Z to 2026-10-30T23:34:45Z.

• Direction: unknown.
• Debt velocity: 0 introduced, 0 cleared.
• Growth: unknown.
• Never cleared in this window: 0 findings.

Earlier series (89 series)

Every figure describes scans that happened; nothing forecasts.

Economic Context (scenario)

0 – 0 USD over 12 months (base 0 USD), across 0 work-order item(s).

This is a scenario, not a prediction.

Assumptions:

• each bound = affected changes/year × incremental hours/change × loaded labor rate × horizon/12
• no usable history; assumed one change per work-order item per year
• incremental hours/change of 0.25-2.0 (base 1.0) — a stated default unless configured
• loaded labor rate 130.0-275.0 USD/hour (base 165.0), as configured
• planning horizon of 12 months
• a scenario computed from these assumptions; change them and the range moves with them

TDD-shaped tests

TDD-shaped tests: detected beside 136 of 171 production source files (path pairing). Constructs: pytest in 337 file(s), unittest in 5 file(s), describe_it in 25 file(s), parametrize in 107 file(s), given_when_then in 3 file(s).

Chronology is not measured. Effectiveness is unscored unless the operator opted into suite execution.

Test Suite

The operator opted in to running the repository's test command; it did not run (exit None).

Command: pytest -n auto --cov=maintainability_audit --cov-report=xml:coverage.xml -q

Coverage: no coverage reported by the run

Detail: the test command you consented to was recorded for another repository, and consent is per repository, so it is not run here. Reconfigure this repository to consent to its own command

Pillars

Practice level 4 of 5 — CI holds a numeric quality gate.

Not measured here, and why:

• efficiency — requires profiling, load testing and runtime telemetry, none of which a static pass produces; permanently out of scope rather than temporarily unmeasured

Enforcement found: linter-config, recorded-decisions, lint-in-ci, types-in-ci, duplication-in-ci, coverage-gate.

ISO/IEC 25010 Maintainability Score

Aspect Scores

Not Scored — no measurement exists

Largest Files

Function Hotspots

Security Work Order

Written by secure-code-agent 0.12.11 and reproduced as it wrote it. It is that tool's work order, not this one's: its findings are not re-ranked or merged into the maintainability work order above.

0 to fix · 0 to review · 6144 suppression candidates.

Semantic findings

TypeScript semantic coverage: unknown — no recorded type analysis and no local type checker: semantic coverage for TypeScript is unknown. Absence of analysis is not absence of findings.

Test honesty

After Ken Pugh's AlignThree Spectables (https://alignthree.com): a test that is not written, or not run, never counts as passing, and a test that computes its own expected value is testing itself.

Read 1 .spectable file(s). Spectables, by Ken Pugh, writes and runs these specifications. Unknown types are not checked.