3.0

Adjusted Signal

3.0

Raw Pattern Score

100%

Time Factor

2026-10-30

Last Push

8.7K

Stars

JavaScript

Language

120.4K

Lines of Code

462

Files

333

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 13.1/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 322 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.9/100 · LOW

Are imports declared and package/API names verified? 11 finding(s).

Agent Over-Engineering Ratio 3.6/100 · LOW

Are wrappers, guards, and repeated structures necessary? 86 finding(s).

PR Review Velocity Impact 13.8/100 · LOW

Which changes need focused human review? 333 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 1HIGH 0MEDIUM 8LOW 324

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 333 distinct pattern matches across 9 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block221 hits · 218 pts

Severity	File	Line	Snippet	Context
LOW	index.js	221		COMMENT
LOW	index.js	241	// Step 1: load .env from process.cwd() before any internal require.	COMMENT
LOW	index.js	561	const {	COMMENT
LOW	index.js	581	// target path fails atomically with EEXIST if the target already	COMMENT
LOW	index.js	641	uid: typeof process.getuid === 'function' ? process.getuid() : null,	COMMENT
LOW	index.js	701	// Round-9: a lease-aware daemon has not refreshed this lock's mtime	COMMENT
LOW	index.js	721	console.warn(`[Singleton] Lock owned by PID ${payload.pid} (different user). Refusing to take over. ` +	COMMENT
LOW	index.js	781	if (fs.existsSync(lockFile)) {	COMMENT
LOW	index.js	801	// valid secret in ~/.evomap/node_secret, so the right thing for the CLI	COMMENT
LOW	index.js	861	// run IS a Mad Dog loop) but hard-cuts the network + ATP, snapshots the	COMMENT
LOW	index.js	961	// crash / PID reuse via stale mtime instead of trusting kill(0).	COMMENT
LOW	index.js	1001		COMMENT
LOW	index.js	1081	}	COMMENT
LOW	index.js	1141	try { require('./src/gep/a2aProtocol').stopEventDelivery(); } catch (e) {}	COMMENT
LOW	index.js	1161	// the undici pool, poke the heartbeat, and restart the SSE stream, which	COMMENT
LOW	index.js	1201	a2aForSd2._sdNotify('READY=1');	COMMENT
LOW	index.js	1221	// (a2aProtocol) interrupt the outer evolve sleepMs and poke the	COMMENT
LOW	index.js	1261	// seconds. We add a liveness gate so an actively-recovering	COMMENT
LOW	index.js	1281	// module load failed on this turn.	COMMENT
LOW	index.js	3301	// after a manual web reset (https://evomap.ai/account -> Reset Secret)	COMMENT
LOW	test/execBridgeSpawnNpmShim.test.js	1	'use strict';	COMMENT
LOW	test/lifecycleForceUpdateTrigger.test.js	1	'use strict';	COMMENT
LOW	test/heartbeatResilienceRound6.test.js	1	// Regression coverage for the round-6 audit (2026-05-28) heartbeat	COMMENT
LOW	test/heartbeatResilienceRound6.test.js	21	// validator dormant, outer evolve sleepMs sitting out the	COMMENT
LOW	test/forceUpdateConcurrencyGuard.test.js	1	// Tests for the concurrency guard added to src/forceUpdate.js (PR #188 fix).	COMMENT
LOW	test/forceUpdateConcurrencyGuard.test.js	101	const stub = function () {	COMMENT
LOW	test/forceUpdateConcurrencyGuard.test.js	221		COMMENT
LOW	test/forceUpdateLastUpdateReport.test.js	661	// ForceUpdate warns. The threshold-fire moment must bypass that	COMMENT
LOW	test/forceUpdateLastUpdateReport.test.js	721	console.warn = originalWarn;	COMMENT
LOW	test/forceUpdateLastUpdateReport.test.js	1001	finished_at: Date.now(),	COMMENT
LOW	test/evolveGuardsCooperativeYield.test.js	1	'use strict';	COMMENT
LOW	test/hubUrlTlsEnforcementConsistency.test.js	1	// Multi-module TLS-enforcement consistency.	COMMENT
LOW	test/hubUrlTlsEnforcementConsistency.test.js	181	}	COMMENT
LOW	test/proxyPublishValidation.test.js	1	'use strict';	COMMENT
LOW	test/adaptersSyntax.test.js	1	// test/adaptersSyntax.test.js	COMMENT
LOW	test/trajectoryMarkedSessionGate.test.js	1	'use strict';	COMMENT
LOW	test/heartbeatResilienceRound5.test.js	1	// Regression coverage for the round-5 audit (2026-05-28) heartbeat	COMMENT
LOW	test/heartbeatResilienceRound5.test.js	21	// so the cache has time to refresh.	COMMENT
LOW	test/heartbeatResilienceRound5.test.js	121	// detector lives in an internal setInterval (a2aProtocol.js around	COMMENT
LOW	test/sync-dedup.test.js	1	// End-to-end test for `node index.js sync` dedup logic.	COMMENT
LOW	test/forceUpdateMidCopyWedge.test.js	1	const { describe, it, before, after, beforeEach } = require('node:test');	COMMENT
LOW	test/paths.test.js	541	// large enough cap recovers cwd	COMMENT
LOW	test/idleSchedulerLinuxFallbacks.test.js	1	'use strict';	COMMENT
LOW	test/lifecycleStaleNodeSecret.test.js	1	'use strict';	COMMENT
LOW	test/heartbeatResilienceRound4.test.js	1	// Regression coverage for the round-4 audit (2026-05-28) heartbeat	COMMENT
LOW	test/heartbeatResilienceRound4.test.js	21	// same payload. Wrap in try/catch so a sync throw never breaks the	COMMENT
LOW	test/heartbeatResilienceRound4.test.js	161	});	COMMENT
LOW	test/heartbeatResilienceRound4.test.js	261	if (origAllow === undefined) delete process.env.EVOMAP_HUB_ALLOW_INSECURE;	COMMENT
LOW	test/lifecycleNodeIdLegacyFallback.test.js	1	'use strict';	COMMENT
LOW	test/lifecycleNodeIdUnification.test.js	1	'use strict';	COMMENT
LOW	test/lifecycleNodeIdUnification.test.js	21	//	COMMENT
LOW	test/lifecycleNodeIdUnification.test.js	721	// (only getNodeId() sets it, proxy never calls getNodeId), and the legacy	COMMENT
LOW	test/savingsCoreConformance.test.js	1	'use strict';	COMMENT
LOW	test/hubFetch.test.js	1	// Tests for src/gep/hubFetch.js	COMMENT
LOW	test/heartbeatResilienceRound8.test.js	1	// Regression coverage for the round-8 audit (2026-05-28) heartbeat	COMMENT
LOW	test/heartbeatResilienceRound8.test.js	21	// clause defeated every caller of the hook, because all callers	COMMENT
LOW	test/heartbeatResilienceRound8.test.js	261	// detector body around it), then observe that test-utility	COMMENT
LOW	test/prompt.test.js	101	//	COMMENT
LOW	test/heartbeatResilienceRound9.test.js	1	'use strict';	COMMENT
LOW	test/spawnReplacementProcess.test.js	1	// Issue #528: Windows-friendly spawn-replacement policy.	COMMENT
161 more matches not shown…

Hyper-Verbose Identifiers86 hits · 88 pts

Severity	File	Line	Snippet	Context
LOW	index.js	506	function logTimedOutEvolveRejection(error, logFn) {	CODE
LOW	index.js	516	function observeTimedOutEvolvePromise(evolvePromise, logFn = console.error) {	CODE
LOW	index.js	531	async function waitForTimedOutEvolvePromise(evolvePromise, logFn = console.error) {	CODE
LOW	index.js	810	function refuseHelloIfDaemonRunning(toolLabel) {	CODE
LOW	index.js	2829	function skipUnverifiedListIdCollision(stage) {	CODE
LOW	cli-options.js	54	function prepareProxyCliEnvironment(argv, env = process.env, dotenv = require('dotenv')) {	CODE
LOW	test/forceUpdateKeepList.test.js	52	function makeDegitWithLocalStateFiles(version) {	CODE
LOW	test/forceUpdateKeepList.test.js	76	function makeNpxMissingThenTarballSuccess(version) {	CODE
LOW	test/forceUpdateKeepList.test.js	127	function makeDegitFailureThenTarballSuccess(version, degitError) {	CODE
LOW	test/forceUpdateKeepList.test.js	168	function assertPrivateArchiveDownload(execStub) {	CODE
LOW	test/forceUpdateMidCopyWedge.test.js	54	function makeSuccessfulDegitWithIndex(version, indexContent) {	CODE
LOW	test/lifecycleStaleNodeSecret.test.js	92	function assertNoRawHubResponseSecrets(logText, raw) {	CODE
LOW	test/identityTupleSync.test.js	125	function assertUsesSameNodeMailboxTuple(requests) {	CODE
LOW	test/a2aProtocol.test.js	58	function assertNoRawHubResponseSecrets(logText, raw) {	CODE
LOW	test/evolveHub.test.js	101	async function withCleanGeneDirectiveEnv(fn) {	CODE
LOW	test/spawnReplacementProcess.test.js	19	function loadSpawnReplacementProcess() {	CODE
LOW	test/canonicalIdentityLock.test.js	190	fs.rmdirSync = function injectReleaseCleanupFailure(dir, options) {	CODE
LOW	test/syncEngineLoopResilience.test.js	105	function assertNoRawHubBodySecrets(text, raw) {	CODE
LOW	test/forceUpdateFailureCodes.test.js	52	function writeStrongEvolverMarkers() {	CODE
LOW	test/forceUpdateFailureCodes.test.js	143	function makeDegitFailureThenTarballSuccess(version) {	CODE
LOW	scripts/check-changelog.js	65	function listReleasedVersionHeadings(text) {	CODE
LOW	scripts/harness-governance-check.js	52	function changedFilesTouchGovernanceSurface(files) {	CODE
LOW	src/canonicalIdentityLock.js	40	function readLinuxProcessStartIdentity(pid) {	CODE
LOW	src/canonicalIdentityLock.js	76	function readDarwinProcessStartIdentity(pid) {	CODE
LOW	src/canonicalIdentityLock.js	197	function currentAbandonedSnapshotMatches(lockDir, expected) {	CODE
LOW	src/canonicalIdentityLock.js	326	function releaseCanonicalIdentityLock(lockDir, ownerFile, token) {	CODE
LOW	src/canonicalIdentityLock.js	348	function acquireCanonicalIdentityLock(nodeIdFile) {	CODE
LOW	src/canonicalIdentityLock.js	425	function withCanonicalIdentityLock(nodeIdFile, operation) {	CODE
LOW⚡	src/forceUpdate.js	681	function isNumericPrereleaseIdentifier(value) {	CODE
LOW⚡	src/forceUpdate.js	685	function compareNumericIdentifierStrings(left, right) {	CODE
LOW⚡	src/forceUpdate.js	692	function comparePrereleaseIdentifiers(left, right) {	CODE
LOW	src/proxy/index.js	53	function canonicalCompatibleBaseUrl(raw) {	CODE
LOW	src/proxy/index.js	82	function allowedCompatibleBaseUrls() {	CODE
LOW	src/proxy/clientSettings.js	36	function isValidReusableProxyToken(value) {	CODE
LOW	src/proxy/clientSettings.js	80	function resolveClaudeSettingsFile(opts = {}, env = process.env) {	CODE
LOW	src/proxy/clientSettings.js	147	function isManagedProxyClientSettings(settings, cfg, opts = {}) {	CODE
LOW	src/proxy/clientSettings.js	151	function isManagedProxyUpstreamResidual(settings, cfg, baseValue, tokenValue, apiKeyValue) {	CODE
LOW	src/proxy/clientSettings.js	162	function safeStoredUpstreamBaseUrl(settings, cfg, value, opts = {}) {	CODE
LOW	src/proxy/clientSettings.js	175	function readReusableClientProxyToken(opts = {}) {	CODE
LOW	src/proxy/mailbox/state.js	88	function isHubRotatedNodeSecretState(state) {	CODE
LOW	src/proxy/mailbox/state.js	100	function isFullNodeSecretTupleUpdate(updatedSet) {	CODE
LOW	src/proxy/mailbox/state.js	104	function canApplyPartialNodeSecretTupleWrite(key, disk, next) {	CODE
LOW	src/proxy/mailbox/state.js	190	function writeMergedMailboxStateFile(stateFile, nextState, updatedKeys) {	CODE
LOW	src/proxy/mailbox/state.js	212	function updateMergedMailboxStateFile(stateFile, buildUpdate) {	CODE
LOW	src/proxy/lifecycle/manager.js	635	function matchSecretDivergenceReason(value) {	CODE
LOW	src/proxy/lifecycle/manager.js	641	function extractSecretDivergenceReason(data) {	CODE
LOW	src/proxy/lifecycle/manager.js	674	function normalizeNodeSecretEnvSuppression(value) {	CODE
LOW	src/proxy/sync/outbound.js	39	function resolveHardOutboundBodyBytes(env = process.env) {	CODE
LOW	src/proxy/sync/outbound.js	47	function resolveMaxOutboundBodyBytes(env = process.env, store = null) {	CODE
LOW	src/proxy/router/responses_route.js	12	function hasOpenAIUpstreamCredential() {	CODE
LOW	src/proxy/router/responses_route.js	22	function safeOpenAIConfigDiagnostic(err) {	CODE
LOW	src/proxy/router/responses_route.js	56	function copyOpenAIResponseHeaders(headers = {}) {	CODE
LOW	src/proxy/router/responses_route.js	160	function buildChatCompletionsHandler(opts = {}) {	CODE
LOW	src/proxy/router/gemini_route.js	18	function hasGeminiUpstreamCredential() {	CODE
LOW	src/proxy/router/gemini_route.js	51	function copyGeminiResponseHeaders(headers = {}) {	CODE
LOW	src/adapters/opencode.js	102	function isEvolverManagedPluginFile(filePath) {	CODE
LOW	src/adapters/scripts/evolver-session-start.js	299	function readRecentWorkspaceEntries(filePath, currentId, currentDir, n) {	CODE
LOW	src/ops/lifecycle.js	259	function clientSettingsExpectProxy(env) {	CODE
LOW	src/ops/lifecycle.js	491	function commandUsesCurrentRepoRelativeIndex(cmd, cwd) {	CODE
LOW	src/gep/idleScheduler.js	317	function getScheduleRecommendation() {	CODE
26 more matches not shown…

Fake / Example Data10 hits · 12 pts

Severity	File	Line	Snippet	Context
LOW	test/solidifyIntegration.test.js	63	execSync('git config user.email "test@test.com"', { cwd: tmpDir, stdio: 'ignore' });	CODE
LOW	test/trajectoryExport.test.js	3156	authorization: 'placeholder',	CODE
LOW	test/trajectoryExport.test.js	3162	headers: { 'set-cookie': 'placeholder', 'x-trace-id': 'trace-1' },	CODE
LOW⚡	test/trajectoryExport.test.js	3210	metadata: { source: 'raw-fixture', authorization: 'placeholder' },	CODE
LOW⚡	test/trajectoryExport.test.js	3215	source_record: { authorization: 'placeholder', raw: 'source' },	CODE
LOW⚡	test/trajectoryExport.test.js	3216	raw_row: { cookie: 'placeholder', raw: 'row' },	CODE
LOW⚡	test/trajectoryExport.test.js	3217	headers: { 'set-cookie': 'placeholder', 'x-upstream': 'ok' },	CODE
LOW	test/sanitize.test.js	16	assert.strictEqual(redactString('user@example.com'), REDACTED);	CODE
LOW	test/proxyOutboundSync.test.js	400	const fakeToken = 'fake-token-413-abcdefghijklmnopqrstuvwxyz';	CODE
LOW	test/proxyOutboundSync.test.js	443	const fakeToken = 'fake-token-retry-abcdefghijklmnopqrstuvwxyz';	CODE

AI Slop Vocabulary4 hits · 12 pts

Severity	File	Line	Snippet	Context
MEDIUM	test/rollbackSafety.test.js	96	// Reading the source directly is robust and unambiguous about what the	COMMENT
MEDIUM	src/proxy/lifecycle/manager.js	540	// keeps this robust against partial test mocks of forceUpdate that stub	COMMENT
MEDIUM	src/adapters/scripts/_runtimePaths.js	359	// secret file paths.js uses, so installing the package later is seamless.	COMMENT
MEDIUM	src/gep/validator/sandboxExecutor.js	137	// Reject shell metacharacters that would give injection leverage even with	COMMENT

Modern AI Meta-Vocabulary4 hits · 12 pts

Severity	File	Line	Snippet	Context
MEDIUM	test/webuiServer.test.js	96	// Cursor agentic security review (HIGH): matchPath used to call	COMMENT
MEDIUM	test/webuiObserver.test.js	179	// Cursor agentic security review (MEDIUM): /webui/status used to	COMMENT
MEDIUM	test/webuiObserver.test.js	205	// Cursor agentic security review (HIGH): the original SECRET_TEXT_RE	COMMENT
MEDIUM	src/gep/skill2gepAudit.js	34	// Generic English / Python / benchmark-scaffold stopwords. NOT domain-specific.	COMMENT

Hallucination Indicators1 hit · 10 pts

Severity	File	Line	Snippet	Context
CRITICAL	test/experimentComparison.test.js	273	assert.ok(res.data.arms.baseline.resultText.includes('[REDACTED]'));	CODE

Verbosity Indicators3 hits · 4 pts

Severity	File	Line	Snippet	Context
LOW	index.js	241	// Step 1: load .env from process.cwd() before any internal require.	COMMENT
LOW	test/forceUpdateLastUpdateReport.test.js	318	// Step 1: persist the FIRST outcome and start a heartbeat that captures	COMMENT
LOW	test/forceUpdateLastUpdateReport.test.js	330	// Step 2: while the hub call is "in flight" (before our fetchResponder	COMMENT

Structural Annotation Overuse3 hits · 4 pts

Severity	File	Line	Snippet	Context
LOW	index.js	241	// Step 1: load .env from process.cwd() before any internal require.	COMMENT
LOW	test/forceUpdateLastUpdateReport.test.js	318	// Step 1: persist the FIRST outcome and start a heartbeat that captures	COMMENT
LOW	test/forceUpdateLastUpdateReport.test.js	330	// Step 2: while the hub call is "in flight" (before our fetchResponder	COMMENT

TODO Padding1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	test/signalDetect.test.js	63	const input = 'The system failed because:\n// TODO: Handle error cases\n// Need to catch exceptions\nActual error: con	CODE

EvoMap/evolver

Open-Source Code Quality, Security and Technical Debt Review