Maintainability CI Report

• Generated: 2026-09-24T19:58:14+00:00
• Commit: 0c57062302db1b0e2f3bbef9eeb25356586ddea8 · Branch: feat/shell
• Root: .
• Standard: ISO/IEC 25010 maintainability-inspired 0-5 scale, rate-based

Summary

Shell is parsed but is not in the reference corpus, so a grade reported for code in it is provisional: the findings are as good as the parser, the rate they are compared against was measured on other languages.

Trend

66 separate series. Scans either side of a break were produced by different instruments and cannot be compared, so they are reported apart rather than joined into one line. The current series is given in full; the earlier ones are summarized, because a reader deciding what to do today is acting on the instrument in use today.

This series begins at a break: the tool version changed, so scans before this point were produced by a different instrument and cannot be joined to those after it.

Current series — 1 scan, 2026-09-24T20:02:45Z to 2026-09-24T20:02:45Z.

• Direction: unknown — not computable from these scans.
• Debt velocity: 0 introduced, 0 cleared (unchanged).
• Growth: unknown.
• Never cleared in this window: 0 findings.

Earlier series (65 series)

Every figure above describes scans that happened. This tool does not forecast, and no number here should be read as one.

Security Work Order

Written by secure-code-agent 0.12.9 and reproduced as it wrote it. It is that tool's work order, not this one's: its findings are not re-ranked or merged into the maintainability work order above.

Security work order

0 to fix · 0 to review · 5560 suppression candidates.

Work the tiers in order. Everything in §FIX is a defect the scanner is confident about; everything in §REVIEW needs your judgement before you touch it, and the reason is stated per finding. This is a constrained task, not a refactor.

Hard constraints — MUST NOT violate

1. Fix only the findings listed. Touch nothing else.
2. Do not change crypto algorithms, key derivation, IV/nonce, padding or random sources unless a finding names them.
3. Do not change auth flows, sessions, token lifetime, cookie attributes or authorization gates unless a finding names them.
4. Do not weaken validation, encoding, sanitization, bounds checks, regex strictness or rate limits to make tests pass.
5. Do not disable, delete or skip security tests, or remove @require_auth-style decorators.
6. Do not silence warnings: no # nosec, # noqa, # type: ignore, eslint-disable or equivalent.
7. Do not add dependencies. If one is genuinely required, stop and ask.
8. Preserve behaviour. If a finding proves current behaviour unsafe, name the input → old/new output.
9. Add one focused test per fix that FAILS before and PASSES after. No "TODO: add test later".
10. Keep the patch small. If you are rewriting a function rather than patching it, stop and report why.

Protocol

Per finding: quote the lines you will change, state the minimum change and the test you will add, apply it, then confirm the test fails on the pre-fix code and passes after. Do not re-run this tool; CI will.

Report per finding: id · files changed (file:line) · test added · behaviour change (yes/no, with input → old/new) · standards satisfied.

A false positive is a successful outcome: do not patch it. Emit a .scignore.yaml suppression candidate with the justification and a proposed expires date (90 days maximum) for the operator to review.

§ACCEPT — test tree and documentation

Findings outside the shipped source. A credential in a test fixture or a tutorial is usually deliberate, and these do not grade the code condition — but they are reported, because one of them may be a real key committed to the wrong place.

Do not patch these. Decide per group: a genuine secret to rotate and remove, or a fixture to record in .scignore.yaml with a reason and an expiry. Propose, do not apply.

Grouped by rule, because the decision is per rule and not per line.

A suppression covering one of these groups looks like:

- rule_id: B314
  paths: ["*/tests/*"]
  reason: "state why this is deliberate, and what you checked"
  expires: "YYYY-MM-DD"

End of findings. Apply the patch protocol above per finding. Report each one in the summary block format.

Economic Context (scenario)

0 – 0 USD over 12 months (base 0 USD), across 0 work-order item(s).

Assumptions:

• each bound = affected changes/year × incremental hours/change × loaded labor rate × horizon/12
• no usable history; assumed one change per work-order item per year
• incremental hours/change of 0.25-2.0 (base 1.0) — a stated default unless configured
• loaded labor rate 130.0-275.0 USD/hour (base 165.0), as configured
• planning horizon of 12 months
• a scenario computed from these assumptions; change them and the range moves with them

TDD-shaped tests

TDD-shaped tests: detected beside 131 of 162 production source files (path pairing). Constructs: pytest in 290 file(s), unittest in 1 file(s), describe_it in 20 file(s), parametrize in 93 file(s), given_when_then in 3 file(s). Chronology is not measured. Effectiveness is unscored unless the operator opted into suite execution.

Test Suite

• The operator opted in to running the repository's test command; it failed (exit 1).
• Command: pytest -n auto --cov=maintainability_audit --cov-report=xml:coverage.xml -q
• Program run: /Users/marshallguillory/Library/Python/3.11/bin/pytest
• Coverage: 71.7% line coverage

Semantic Findings (ADR 003)

TypeScript semantic coverage: unknown — no recorded type analysis and no local type checker: semantic coverage for TypeScript is unknown. Absence of analysis is not absence of findings.

Pillars

Practice level 4 of 5 — CI holds a numeric quality gate.

Not measured here, and why:

• efficiency — requires profiling, load testing and runtime telemetry, none of which a static pass produces; permanently out of scope rather than temporarily unmeasured

Enforcement found: linter-config, recorded-decisions, lint-in-ci, types-in-ci, duplication-in-ci, coverage-gate.

Source Not Read

21 of 480 source files were not opened by this scan. Their extensions are absent from paths.include_extensions, so nothing below describes them.

Add these to paths.include_extensions and re-run to audit them.

Analyzer Coverage

12 of 17 tools contributed — concerns all, depth heavy, license policy copyleft-any.

Plus 8 built-in detectors, which always run and whose measurements are single-source.

Coverage by language

The score is drawn from the scored languages only. Anything marked not read is listed under Source Not Read with its file count.

declarations measured by analyzers, completed by built-in detectors: no analyzer supplies cognitive_complexity for C, C#, C++, Fortran, Go, Java, JavaScript, Kotlin, PHP, Ruby, Rust, Swift, TypeScript, so the built-in scanner supplied it for those declarations and the analyzers supplied the rest; the criterion set is complete per declaration, which is what makes the rate comparable to the rubric's.

Nothing examined: testing.

These concerns are unmeasured, not clean. Install a tool that covers them, or widen analyzers.depth, to have them reported.

Analyzer children are not network-isolated. 12 external tools ran as local child processes. This agent does not transmit the audited source and opens no socket of its own, but it does not sandbox what it spawns: a third-party analyzer that reaches the network is outside what this run controls or observes. Determinism and no upload are the promise; a kernel air-gap is not.

Measurements

Where two tools measured the same thing, their disagreement is shown rather than averaged away — it is the uncertainty a single-tool number hides.

The maintainability estimate uses the analyzer readings for declarations (completed by built-in detectors) — external tools are the primary evidence there. Dimensions no analyzer measured kept the fallback tier. Where the two sources disagree the range widens to contain both; they are never averaged.

Analyzer Findings

510 findings from external analyzers — 6 dead-code, 263 documentation, 144 duplication, 97 style.

Showing 40 of 510. The complete list is in the JSON report under analyzer_findings.

Why the verified grade is not higher

• graded on the evidence floor 4.1 (point estimate 4.4, ceiling 4.7): unmeasured aspects price at 0 for the grade

ISO/IEC 25010 Maintainability Score

Aspect Scores

Not Scored — no measurement exists

Largest Files

Function Hotspots

Hotspots — churn x cognitive complexity (12 months ago)

Change Coupling — files that keep changing together