Astrid is a portable, capability-secure operating system for composable software.
This report presents the forensic synthetic code analysis of astrid-runtime/astrid, a Rust project with 10,273 GitHub stars. SynthScan v2.0 examined 467,002 lines of code across 1317 source files, recording 2018 pattern matches distributed across 14 syntactic categories. The overall adjusted score of 5.6 places this repository in the Low AI signal band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 2018 distinct pattern matches across 14 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | Cargo.toml | 81 | # `astrid-gateway` (and `astrid-integration-tests` for the gateway | COMMENT |
| LOW | Cargo.toml | 161 | metrics = "0.24" | COMMENT |
| LOW | Cargo.toml | 181 | # contention. | COMMENT |
| LOW | Cargo.toml | 221 | thiserror = "2.0" | COMMENT |
| LOW | crates/astrid-capsule-types/src/memory_ledger.rs | 1 | //! Shared per-principal peak-memory accounting ledger. | COMMENT |
| LOW | crates/astrid-capsule-types/src/memory_ledger.rs | 21 | //! linear memory a *prior* leaseholder allocated. The peak is thus an upper | COMMENT |
| LOW | crates/astrid-capsule-types/src/memory_ledger.rs | 41 | COMMENT | |
| LOW | crates/astrid-capsule-types/src/memory_ledger.rs | 81 | // strictly above it. Evicting a bigger user to record a smaller one | COMMENT |
| LOW | crates/astrid-capsule-types/src/limits.rs | 1 | //! Host-derived runtime concurrency limits for the WASM capsule engine. | COMMENT |
| LOW | crates/astrid-capsule-types/src/limits.rs | 41 | /// concurrency ceiling for a capsule's interceptor invocations). | COMMENT |
| LOW | crates/astrid-capsule-types/src/limits.rs | 61 | /// Maximum redirect hops the host follows by default, and the caller ceiling a | COMMENT |
| LOW | crates/astrid-capsule-types/src/limits.rs | 81 | #[must_use] | COMMENT |
| LOW | crates/astrid-capsule-types/src/limits.rs | 101 | pub fn host_io_concurrency_default() -> usize { | COMMENT |
| LOW | crates/astrid-capsule-types/src/limits.rs | 141 | } | COMMENT |
| LOW | crates/astrid-capsule-types/src/limits.rs | 201 | } | COMMENT |
| LOW | crates/astrid-capsule-types/src/limits.rs | 221 | /// caller sets no corresponding `*-ms`. An explicit caller value OVERRIDES the | COMMENT |
| LOW | crates/astrid-capsule-types/src/limits.rs | 241 | /// `connect-ms` (a default, not a ceiling). Host const default: 30s. | COMMENT |
| LOW | crates/astrid-capsule-types/src/limits.rs | 361 | COMMENT | |
| LOW | crates/astrid-capsule-types/src/fuel_ledger.rs | 1 | //! Shared per-principal CPU accounting ledger. | COMMENT |
| LOW | crates/astrid-capsule-types/src/fuel_ledger.rs | 21 | //! ledger had to become cross-capsule first). The run-loop CPU bound remains | COMMENT |
| LOW | crates/astrid-capsule-types/src/fuel_ledger.rs | 41 | use std::time::Duration; | COMMENT |
| LOW | crates/astrid-capsule-types/src/fuel_ledger.rs | 81 | pub struct FuelLedger { | COMMENT |
| LOW | crates/astrid-capsule-types/src/fuel_ledger.rs | 121 | Some(v.saturating_add(fuel)) | COMMENT |
| LOW | crates/astrid-capsule-types/src/fuel_ledger.rs | 141 | } | COMMENT |
| LOW | crates/astrid-capsule-types/src/fuel_ledger.rs | 161 | COMMENT | |
| LOW | crates/astrid-capsule-types/src/fuel_ledger.rs | 181 | /// interceptor consults *before* admitting a call. [`record`]( | COMMENT |
| LOW | crates/astrid-capsule-types/src/fuel_ledger.rs | 201 | /// stale, so a flood of ephemeral sub-agent principals cannot grow it without | COMMENT |
| LOW | crates/astrid-capsule-types/src/fuel_ledger.rs | 281 | /// - a *cold* principal with no window yet — first call is always admitted, | COMMENT |
| LOW | crates/astrid-capsule-types/src/fuel_ledger.rs | 301 | // entry creation is `record`'s job, on the post-hoc feed. | COMMENT |
| LOW | crates/astrid-capsule-types/src/fuel_ledger.rs | 441 | /// Lazily drop principals whose window has gone stale, bounding map growth. | COMMENT |
| LOW | …es/astrid-capsule-types/src/capability_presentation.rs | 1 | //! Human-facing presentation for capsule capability grants. | COMMENT |
| LOW | crates/astrid-capsule-types/src/manifest/mod.rs | 21 | /// | COMMENT |
| LOW | crates/astrid-capsule-types/src/manifest/mod.rs | 41 | #[serde(default, deserialize_with = "deserialize_imports_map")] | COMMENT |
| LOW | crates/astrid-capsule-types/src/manifest/mod.rs | 61 | /// Same shape as `publishes`. An entry with a `handler = "..."` field (and | COMMENT |
| LOW | crates/astrid-capsule-types/src/manifest/mod.rs | 81 | #[serde(default, rename = "context_file")] | COMMENT |
| LOW | crates/astrid-capsule-types/src/manifest/mod.rs | 161 | /// carries a `handler` binds that topic to a `#[astrid::interceptor]` | COMMENT |
| LOW | crates/astrid-capsule-types/src/manifest/mod.rs | 201 | D: serde::Deserializer<'de>, | COMMENT |
| LOW | crates/astrid-capsule-types/src/manifest/mod.rs | 341 | /// Optional description of the capsule. | COMMENT |
| LOW | crates/astrid-capsule-types/src/manifest/mod.rs | 381 | /// Unique identifier for this component within the capsule. | COMMENT |
| LOW | crates/astrid-capsule-types/src/manifest/mod.rs | 401 | /// | COMMENT |
| LOW | crates/astrid-capsule-types/src/manifest/mod.rs | 421 | pub description: Option<String>, | COMMENT |
| LOW | crates/astrid-capsule-types/src/manifest/mod.rs | 441 | /// sibling `enum_values` field; the kebab `options-from` form is | COMMENT |
| LOW | crates/astrid-capsule-types/src/manifest/mod.rs | 461 | /// `Shared` and pull host-wide values into its sandbox. The kernel | COMMENT |
| LOW | crates/astrid-capsule-types/src/manifest/mod.rs | 481 | /// Template placeholders use `{key}` syntax, where `key` is the name of | COMMENT |
| LOW | crates/astrid-capsule-types/src/manifest/mod.rs | 501 | /// resolves to a non-empty value after trimming. | COMMENT |
| LOW | crates/astrid-capsule-types/src/manifest/mod.rs | 521 | COMMENT | |
| LOW | crates/astrid-capsule-types/src/manifest/mod.rs | 541 | /// through. The fail-closed default — appropriate for anything an | COMMENT |
| LOW | crates/astrid-capsule-types/src/manifest/mod.rs | 581 | /// Path to the declarative command TOML (if static). | COMMENT |
| LOW | crates/astrid-capsule-types/src/manifest/mod.rs | 601 | COMMENT | |
| LOW | crates/astrid-capsule-types/src/manifest/mod.rs | 621 | /// This type has no manifest or runtime semantics. It remains public only so | COMMENT |
| LOW | crates/astrid-capsule-types/src/manifest/mod.rs | 641 | pub platform: String, | COMMENT |
| LOW | crates/astrid-capsule-types/src/manifest/mod.rs | 661 | /// `[subscribe]` entry's `handler` (must match an | COMMENT |
| LOW | …ates/astrid-capsule-types/src/manifest/capabilities.rs | 1 | //! The `[capabilities]` block — what a capsule asks for from the OS. | COMMENT |
| LOW | …ates/astrid-capsule-types/src/manifest/capabilities.rs | 21 | /// is present for future cross-capsule KV request declarations. | COMMENT |
| LOW | …ates/astrid-capsule-types/src/manifest/capabilities.rs | 41 | /// child, so persistence is an additional operator-reviewed opt-in on top | COMMENT |
| LOW | …ates/astrid-capsule-types/src/manifest/capabilities.rs | 61 | /// literal DNS name or `*` (universal — see security review note | COMMENT |
| LOW | …ates/astrid-capsule-types/src/manifest/capabilities.rs | 81 | /// | COMMENT |
| LOW | …ates/astrid-capsule-types/src/manifest/capabilities.rs | 101 | COMMENT | |
| LOW | …ates/astrid-capsule-types/src/manifest/capabilities.rs | 161 | COMMENT | |
| LOW | crates/astrid-capsule-types/src/manifest/topics.rs | 1 | //! Cargo-shaped `[publish]` / `[subscribe]` tables. | COMMENT |
| 1366 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | crates/astrid-capsule-types/src/fuel_ledger.rs | 564 | // ── FuelRateLimiter (PR2: the deny side) ───────────────────────────── | COMMENT |
| MEDIUM | crates/astrid-capabilities/src/policy.rs | 666 | // ── Device-scope attenuation ────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/astrid-gateway/tests/router.rs | 896 | // ── Device-scoped bearer: key_id extraction + per-key revocation ────── | COMMENT |
| MEDIUM | crates/astrid-gateway/src/routes/distribution.rs | 118 | // ── parsing helpers ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/astrid-gateway/src/routes/principals.rs | 340 | // ── /api/sys/capabilities ──────────────────────────────────────── | COMMENT |
| MEDIUM | crates/astrid-gateway/src/routes/principals.rs | 431 | // ── Device management ──────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/astrid-gateway/src/routes/principals.rs | 549 | // ── Helpers ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/astrid-gateway/src/routes/env.rs | 244 | // ── helpers ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/astrid-gateway/src/routes/capsules.rs | 521 | // ── helpers (kernel client error mapping) ──────────────────────── | COMMENT |
| MEDIUM⚡ | crates/astrid-config/src/defaults.toml | 48 | # ============================================================================ | COMMENT |
| MEDIUM⚡ | crates/astrid-config/src/defaults.toml | 50 | # ============================================================================ | COMMENT |
| MEDIUM | crates/astrid-config/src/defaults.toml | 13 | # ============================================================================ | COMMENT |
| MEDIUM | crates/astrid-config/src/defaults.toml | 15 | # ============================================================================ | COMMENT |
| MEDIUM | crates/astrid-config/src/defaults.toml | 68 | # ============================================================================ | COMMENT |
| MEDIUM | crates/astrid-config/src/defaults.toml | 70 | # ============================================================================ | COMMENT |
| MEDIUM | crates/astrid-config/src/defaults.toml | 96 | # ============================================================================ | COMMENT |
| MEDIUM | crates/astrid-config/src/defaults.toml | 98 | # ============================================================================ | COMMENT |
| MEDIUM | crates/astrid-config/src/defaults.toml | 142 | # ============================================================================ | COMMENT |
| MEDIUM | crates/astrid-config/src/defaults.toml | 144 | # ============================================================================ | COMMENT |
| MEDIUM | crates/astrid-config/src/defaults.toml | 157 | # ============================================================================ | COMMENT |
| MEDIUM | crates/astrid-config/src/defaults.toml | 159 | # ============================================================================ | COMMENT |
| MEDIUM | crates/astrid-config/src/defaults.toml | 179 | # ============================================================================ | COMMENT |
| MEDIUM | crates/astrid-config/src/defaults.toml | 181 | # ============================================================================ | COMMENT |
| MEDIUM | crates/astrid-config/src/defaults.toml | 214 | # ============================================================================ | COMMENT |
| MEDIUM | crates/astrid-config/src/defaults.toml | 216 | # ============================================================================ | COMMENT |
| MEDIUM | crates/astrid-config/src/defaults.toml | 240 | # ============================================================================ | COMMENT |
| MEDIUM | crates/astrid-config/src/defaults.toml | 242 | # ============================================================================ | COMMENT |
| MEDIUM | crates/astrid-config/src/defaults.toml | 254 | # ============================================================================ | COMMENT |
| MEDIUM | crates/astrid-config/src/defaults.toml | 256 | # ============================================================================ | COMMENT |
| MEDIUM | crates/astrid-config/src/defaults.toml | 290 | # ============================================================================ | COMMENT |
| MEDIUM | crates/astrid-config/src/defaults.toml | 292 | # ============================================================================ | COMMENT |
| MEDIUM | crates/astrid-config/src/defaults.toml | 308 | # ============================================================================ | COMMENT |
| MEDIUM | crates/astrid-config/src/defaults.toml | 310 | # ============================================================================ | COMMENT |
| MEDIUM | crates/astrid-config/src/defaults.toml | 338 | # ============================================================================ | COMMENT |
| MEDIUM | crates/astrid-config/src/defaults.toml | 340 | # ============================================================================ | COMMENT |
| MEDIUM | crates/astrid-config/src/defaults.toml | 359 | # ============================================================================ | COMMENT |
| MEDIUM | crates/astrid-config/src/defaults.toml | 361 | # ============================================================================ | COMMENT |
| MEDIUM | crates/astrid-config/src/defaults.toml | 384 | # ============================================================================ | COMMENT |
| MEDIUM | crates/astrid-config/src/defaults.toml | 386 | # ============================================================================ | COMMENT |
| MEDIUM | crates/astrid-config/src/defaults.toml | 416 | # ============================================================================ | COMMENT |
| MEDIUM | crates/astrid-config/src/defaults.toml | 418 | # ============================================================================ | COMMENT |
| MEDIUM | crates/astrid-config/src/defaults.toml | 436 | # ============================================================================ | COMMENT |
| MEDIUM | crates/astrid-config/src/defaults.toml | 438 | # ============================================================================ | COMMENT |
| MEDIUM | crates/astrid-config/src/defaults.toml | 451 | # ============================================================================ | COMMENT |
| MEDIUM | crates/astrid-config/src/defaults.toml | 453 | # ============================================================================ | COMMENT |
| MEDIUM | crates/astrid-config/src/defaults.toml | 477 | # ============================================================================ | COMMENT |
| MEDIUM | crates/astrid-config/src/defaults.toml | 479 | # ============================================================================ | COMMENT |
| MEDIUM | crates/astrid-config/src/defaults.toml | 503 | # ============================================================================ | COMMENT |
| MEDIUM | crates/astrid-config/src/defaults.toml | 505 | # ============================================================================ | COMMENT |
| MEDIUM | …integration-tests/tests/management_api_admin_topics.rs | 39 | // ── Fixtures ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …integration-tests/tests/management_api_admin_topics.rs | 135 | // ── Full cross-tenant matrix ───────────────────────────────────────── | COMMENT |
| MEDIUM | …integration-tests/tests/management_api_admin_topics.rs | 198 | // ── Self-scope resolves from target principal ──────────────────────── | COMMENT |
| MEDIUM | …integration-tests/tests/management_api_admin_topics.rs | 223 | // ── Agent built-in caps explicitly list self-admin entries ────────── | COMMENT |
| MEDIUM | …integration-tests/tests/management_api_admin_topics.rs | 244 | // ── Audit method labels ────────────────────────────────────────────── | COMMENT |
| MEDIUM | …integration-tests/tests/management_api_admin_topics.rs | 284 | // ── Wire-format round trips ───────────────────────────────────────── | COMMENT |
| MEDIUM | …integration-tests/tests/management_api_admin_topics.rs | 383 | // ── ArcSwap hot-reload viewed from outside the kernel crate ───────── | COMMENT |
| MEDIUM | …integration-tests/tests/management_api_admin_topics.rs | 466 | // ── Built-in group write protection ───────────────────────────────── | COMMENT |
| MEDIUM | crates/astrid-integration-tests/tests/gateway_e2e.rs | 574 | // ── Kernel boot artefacts on disk ─────────────────────────── | COMMENT |
| MEDIUM | crates/astrid-integration-tests/tests/gateway_e2e.rs | 588 | // ── Gateway state shares the same home ────────────────────── | COMMENT |
| MEDIUM | crates/astrid-integration-tests/tests/gateway_e2e.rs | 621 | // ── Unauthenticated routes against the live state ──────────── | COMMENT |
| 228 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | scripts/test_oci_arm64_container_contract.py | 37 | def test_uses_arch_specific_digest_pinned_ubuntu_base(self) -> None: | CODE |
| LOW⚡ | scripts/test_oci_arm64_container_contract.py | 45 | def test_is_non_root_distro_neutral_and_exposes_no_ports(self) -> None: | CODE |
| LOW⚡ | scripts/test_oci_arm64_container_contract.py | 51 | def test_reuses_the_reviewed_entrypoint_contract(self) -> None: | CODE |
| LOW | scripts/test_oci_arm64_container_contract.py | 81 | def test_derived_images_alias_and_cleanup_the_bound_local_base(self) -> None: | CODE |
| LOW⚡ | scripts/test_oci_arm64_container_contract.py | 93 | def test_restricted_runtime_is_rootless_read_only_and_unprivileged(self) -> None: | CODE |
| LOW⚡ | scripts/test_oci_arm64_container_contract.py | 101 | def test_real_daemon_readiness_and_authenticated_status_are_required(self) -> None: | CODE |
| LOW⚡ | scripts/test_oci_arm64_container_contract.py | 106 | def test_entrypoint_stages_and_reauthenticates_signed_distro(self) -> None: | CODE |
| LOW⚡ | scripts/test_oci_arm64_container_contract.py | 116 | def test_foreground_daemon_allowlist_cannot_enable_ephemeral_mode(self) -> None: | CODE |
| LOW | scripts/test_oci_arm64_container_contract.py | 182 | def test_scan_sbom_and_per_export_blob_evidence_are_required(self) -> None: | CODE |
| LOW | scripts/test_oci_arm64_container_contract.py | 255 | def test_path_filters_and_test_lane_include_shared_binding_contract(self) -> None: | CODE |
| LOW | scripts/test_oci_arm64_container_contract.py | 260 | def test_oidc_signing_requires_manual_protected_main_and_environment(self) -> None: | CODE |
| LOW | scripts/test_oci_arm64_container_contract.py | 271 | def test_workflow_never_invokes_registry_publication_tools(self) -> None: | CODE |
| LOW | scripts/test_oci_arm64_container_contract.py | 288 | def test_workflow_never_uses_mutable_or_canonical_image_tags(self) -> None: | CODE |
| LOW | scripts/test_oci_arm64_container_contract.py | 301 | def test_workflow_cannot_enable_emulation_or_multi_platform_builds(self) -> None: | CODE |
| LOW | scripts/test_macos_release_packaging.py | 51 | def test_package_is_deterministic_and_validates(self) -> None: | CODE |
| LOW | scripts/test_macos_release_packaging.py | 65 | def test_packaging_rejects_redirects(self) -> None: | CODE |
| LOW | scripts/test_macos_release_packaging.py | 77 | def test_packaging_rejects_output_inside_the_release_root(self) -> None: | CODE |
| LOW | scripts/test_macos_release_packaging.py | 86 | def test_validation_rejects_noncanonical_modes(self) -> None: | CODE |
| LOW | scripts/test_macos_release_packaging.py | 105 | def test_validation_requires_every_common_executable(self) -> None: | CODE |
| LOW⚡ | scripts/test_musl_release_manifest.py | 71 | def test_round_trip_is_deterministic_and_bound_to_legacy_release(self) -> None: | CODE |
| LOW⚡ | scripts/test_musl_release_manifest.py | 80 | def test_accepts_exactly_the_two_supported_musl_targets(self) -> None: | CODE |
| LOW⚡ | scripts/test_musl_release_manifest.py | 88 | def test_rejects_missing_duplicate_and_unexpected_targets(self) -> None: | CODE |
| LOW | scripts/test_musl_release_manifest.py | 104 | def test_rejects_every_release_identity_mismatch(self) -> None: | CODE |
| LOW | scripts/test_musl_release_manifest.py | 123 | def test_rejects_a_different_legacy_manifest_digest_or_asset(self) -> None: | CODE |
| LOW | scripts/test_musl_release_manifest.py | 134 | def test_rejects_partial_combined_checksums(self) -> None: | CODE |
| LOW | scripts/test_musl_release_manifest.py | 140 | def test_validate_command_requires_and_checks_the_legacy_manifest(self) -> None: | CODE |
| LOW | scripts/runatal_v1_volume.py | 61 | def physically_valid_record_at(data, offset): | CODE |
| LOW | scripts/runatal_v1_volume.py | 97 | def has_physically_valid_record_after(data, start): | CODE |
| LOW | scripts/runatal_v1_volume.py | 106 | def volume_metadata_mutations(payload): | CODE |
| LOW | scripts/runatal_v1_reader.py | 304 | def validate_content_boundary(left_object, left, right_prefix, profile, memo): | CODE |
| LOW | scripts/runatal_v1_reader.py | 395 | def verify_content_summary_vectors(): | CODE |
| LOW | scripts/runatal_v1_reader.py | 523 | def validate_derivation_invocation(record): | CODE |
| LOW | scripts/runatal_v1_reader.py | 566 | def validate_derivation_evidence(record): | CODE |
| LOW⚡ | scripts/test_changelog.py | 34 | def test_code_without_fragment_fails(self): | STRING |
| LOW⚡ | scripts/test_changelog.py | 43 | def test_code_with_fragment_passes(self): | STRING |
| LOW⚡ | scripts/test_changelog.py | 53 | def test_skip_label_passes_without_fragment(self): | STRING |
| LOW⚡ | scripts/test_changelog.py | 63 | def test_docs_only_passes_without_fragment(self): | STRING |
| LOW⚡ | scripts/test_changelog.py | 73 | def test_cargo_lock_requires_fragment(self): | STRING |
| LOW⚡ | scripts/test_changelog.py | 77 | def test_invalid_fragment_name_fails(self): | STRING |
| LOW⚡ | scripts/test_changelog.py | 86 | def test_changelog_md_edit_is_not_enough_for_code(self): | STRING |
| LOW⚡ | scripts/test_changelog.py | 94 | def test_code_plus_changelog_and_fragment_still_fails(self): | STRING |
| LOW⚡ | scripts/test_changelog.py | 103 | def test_release_skip_allows_changelog_and_cargo(self): | STRING |
| LOW | scripts/test_changelog.py | 114 | def test_empty_fragment_body_fails(self): | STRING |
| LOW | scripts/test_changelog.py | 129 | def test_entry_wraps_prose_as_bullet(self): | STRING |
| LOW | scripts/test_changelog.py | 135 | def test_roll_moves_unreleased_and_fragments_without_touching_history(self): | STRING |
| LOW | scripts/test_changelog.py | 153 | def test_notes_match_awk_style_section_body(self): | STRING |
| LOW | scripts/test_changelog.py | 162 | def test_roll_command_deletes_fragments(self): | STRING |
| LOW | scripts/test_changelog.py | 191 | def test_notes_require_rolled_fails_on_pending_fragment(self): | STRING |
| LOW | scripts/test_validate_release_archive.py | 38 | def test_linux_and_windows_inventories_validate(self) -> None: | CODE |
| LOW | scripts/test_validate_release_archive.py | 48 | def test_missing_provider_is_rejected(self) -> None: | CODE |
| LOW | scripts/test_validate_release_archive.py | 60 | def test_redirecting_member_is_rejected(self) -> None: | CODE |
| LOW⚡ | scripts/test_windows_release_manifest.py | 64 | def test_round_trip_is_deterministic_and_bound_to_legacy_release(self) -> None: | CODE |
| LOW⚡ | scripts/test_windows_release_manifest.py | 73 | def test_shared_python_rust_schema_fixture_is_accepted(self) -> None: | CODE |
| LOW⚡ | scripts/test_windows_release_manifest.py | 79 | def test_accepts_only_the_windows_target(self) -> None: | CODE |
| LOW⚡ | scripts/test_windows_release_manifest.py | 87 | def test_rejects_missing_duplicate_and_unexpected_targets(self) -> None: | CODE |
| LOW | scripts/test_windows_release_manifest.py | 103 | def test_rejects_release_identity_and_legacy_binding_mismatches(self) -> None: | CODE |
| LOW | scripts/test_windows_release_manifest.py | 122 | def test_rejects_partial_seven_archive_checksums(self) -> None: | CODE |
| LOW | scripts/test_channel_metadata.py | 92 | def test_round_trip_is_deterministic(self) -> None: | CODE |
| LOW | scripts/test_channel_metadata.py | 104 | def test_all_three_channels_are_accepted(self) -> None: | CODE |
| LOW | scripts/test_channel_metadata.py | 109 | def test_stable_rejects_prerelease_version(self) -> None: | CODE |
| 134 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | CHANGELOG.md | 1278 | - **Capsule access is now per-principal, enforced kernel-side at dispatch — closing the gap where the capsule tool surfa | CODE |
| MEDIUM | CHANGELOG.md | 1343 | - **`astrid capsule new <name>` scaffolds a complete, first-try-compiling tool capsule — with a toolchain preflight and | CODE |
| MEDIUM | CHANGELOG.md | 1409 | - **Per-capsule WASM instance pool: principals' interceptors now run concurrently instead of serialising through one `St | CODE |
| MEDIUM | CHANGELOG.md | 1539 | - **Per-capsule WASM instance pool: principals' interceptors now run concurrently instead of serialising through one `St | CODE |
| MEDIUM | CHANGELOG.md | 1618 | - **Per-domain WIT review fixups (PR #752).** A multi-agent review surfaced fixes addressed in-branch before merge: | CODE |
| MEDIUM | README.md | 221 | astrid capsule new my-capsule # scaffold Capsule.toml, Cargo.toml, src/lib.rs, .cargo/config.toml | CODE |
| MEDIUM⚡ | crates/astrid-config/src/defaults.toml | 54 | # Maximum context window size in tokens (soft limit for summarization) | COMMENT |
| MEDIUM | crates/astrid-cli/src/commands/capsule/new.rs | 1 | //! `astrid capsule new <name>` — scaffold a complete, first-try-compiling | COMMENT |
| MEDIUM | crates/astrid-cli/src/commands/capsule/new.rs | 112 | /// Every check is fail-FRIENDLY: nothing here aborts the scaffold. A capsule | COMMENT |
| MEDIUM | crates/astrid-cli/src/commands/capsule/new.rs | 130 | // the caller scaffold). | COMMENT |
| MEDIUM | crates/astrid-cli/src/commands/capsule/new.rs | 358 | /// Print the friendly next-steps message after a successful scaffold. | COMMENT |
| MEDIUM | crates/astrid-capsule/src/engine/wasm/mod.rs | 3621 | // cross-principal race that #813 collapsed the orchestration cliff | COMMENT |
| MEDIUM | crates/astrid-capsule/src/engine/wasm/pool.rs | 6 | //! `astrid#813` orchestration cliff (one LLM turn every ~3s, invariant to | COMMENT |
| MEDIUM | crates/astrid-mcp/src/registry.rs | 5 | //! The runtime's agentic loop uses the registry instead of knowing about | COMMENT |
| MEDIUM | …es/astrid-kernel/src/principal_home_migration/tests.rs | 28 | // source root. Normal v2 boot must not scaffold `home/` at all. | COMMENT |
| MEDIUM | docs/config.md | 61 | # context_window = 200000 # Optional: override provider's context window size | COMMENT |
| MEDIUM | docs/astrid-tensor-logic-composition.md | 624 | ### 9.2 Why scaffold now | COMMENT |
| MEDIUM | docs/metrics.md | 292 | ### 4.3 Capsule lifecycle & WASM sandbox (`astrid-capsule`, `astrid-capsule-install`, kernel orchestration) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | Cargo.toml | 168 | # Oracle-only dependency for the pre-release chunker evidence harness. Persistent | COMMENT |
| MEDIUM | crates/astrid-cli/src/commands/daemon_control.rs | 26 | //! The identity check is also robust to an in-place upgrade replacing the | COMMENT |
| MEDIUM | crates/astrid-capsule/src/engine/wasm/mod.rs | 133 | /// upward, there is no robust primitive for "contains a repo below", and the | COMMENT |
| MEDIUM | crates/astrid-capsule/src/engine/wasm/mod.rs | 6304 | /// the trap's `Display` string — robust across wasmtime point releases and | COMMENT |
| MEDIUM | scripts/e2e/runtime-harness.sh | 346 | # the harness's published/runtime IDs remain `astrid-capsule-*`. Prefer the | COMMENT |
| MEDIUM | scripts/e2e/runtime-multi-home-smoke.sh | 107 | # Match the primary harness' non-interactive declared-config install so | COMMENT |
| MEDIUM | scripts/e2e/runtime-multi-home-smoke.sh | 139 | # the harness-owned process so cleanup cannot leave an untracked second home. | COMMENT |
| MEDIUM | .github/workflows/runtime-e2e.yml | 65 | # Runtime budget: the harness has bounded daemon startup, curl/SSE, fake LLM, | COMMENT |
| MEDIUM | .github/workflows/runtime-e2e.yml | 98 | # Install it up front so the runtime harness cannot trigger an | COMMENT |
| MEDIUM | e2e/first-party-capsule-scenarios.toml | 8 | # family. status = "covered" means the current runtime harness executes it. | COMMENT |
| MEDIUM | e2e/capability-scenarios.toml | 7 | # - status = "covered": the current runtime harness asserts allow/deny behavior | COMMENT |
| MEDIUM | e2e/cli-scenarios.toml | 8 | # status = "covered" means the current runtime harness executes an assertion for | COMMENT |
| MEDIUM | e2e/http-scenarios.toml | 8 | # status = "covered" means the current runtime harness executes an assertion for | COMMENT |
| MEDIUM | e2e/runtime-scenario-specs.toml | 6 | # evidence the harness must assert. Drift tests reject mappings to scenarios | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/test_oci_arm64_container_contract.py | 4 | CODE | |
| LOW | scripts/check_static_elf.py | 4 | CODE | |
| LOW | scripts/nightly_version.py | 4 | CODE | |
| LOW | scripts/test_macos_release_packaging.py | 3 | CODE | |
| LOW | scripts/package_release_archive.py | 4 | CODE | |
| LOW | scripts/test_musl_release_manifest.py | 3 | CODE | |
| LOW | scripts/test_validate_release_archive.py | 3 | CODE | |
| LOW | scripts/test_windows_release_manifest.py | 3 | CODE | |
| LOW | scripts/test_channel_metadata.py | 3 | CODE | |
| LOW | scripts/test_crate_publication.py | 3 | CODE | |
| LOW | scripts/check_dco.py | 4 | CODE | |
| LOW | scripts/test_release_draft_recovery.py | 3 | CODE | |
| LOW | scripts/validate_macos_release.py | 4 | CODE | |
| LOW | scripts/release_manifest.py | 4 | CODE | |
| LOW | scripts/oci_export_binding.py | 4 | CODE | |
| LOW | scripts/test_check_glibc.py | 3 | CODE | |
| LOW | scripts/runatal_v1_physical.py | 11 | CODE | |
| LOW | scripts/runatal_v1_physical.py | 11 | CODE | |
| LOW | scripts/runatal_v1_physical.py | 11 | CODE | |
| LOW | scripts/changelog.py | 4 | CODE | |
| LOW | scripts/channel_publication.py | 4 | CODE | |
| LOW | scripts/test_release_publication.py | 3 | CODE | |
| LOW | scripts/create_oci_test_shuttle.py | 4 | CODE | |
| LOW | scripts/test_nightly_version.py | 3 | CODE | |
| LOW | scripts/test_oci_export_binding.py | 4 | CODE | |
| LOW | scripts/test_release_manifest.py | 3 | CODE | |
| LOW | scripts/oci_release.py | 4 | CODE | |
| LOW | scripts/crate_publication.py | 4 | CODE | |
| LOW | scripts/release_publication.py | 4 | CODE | |
| LOW | scripts/check_glibc.py | 4 | CODE | |
| LOW | scripts/test_check_static_elf.py | 3 | CODE | |
| LOW | scripts/test_channel_publication.py | 3 | CODE | |
| LOW | scripts/musl_release_manifest.py | 4 | CODE | |
| LOW | scripts/validate_release_archive.py | 4 | CODE | |
| LOW | scripts/windows_release_manifest.py | 4 | CODE | |
| LOW | scripts/release_draft_recovery.py | 4 | CODE | |
| LOW | scripts/test_oci_container_contract.py | 4 | CODE | |
| LOW | scripts/test_oci_release.py | 4 | CODE | |
| LOW | scripts/channel_metadata.py | 4 | CODE | |
| LOW | scripts/e2e/check-first-party-capsule-commands.py | 4 | CODE | |
| LOW | scripts/e2e/fake-openai-compat.py | 15 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/test_macos_release_packaging.py | 86 | CODE | |
| LOW | scripts/package_release_archive.py | 42 | CODE | |
| LOW | scripts/runatal_v1_volume.py | 135 | CODE | |
| LOW | scripts/runatal_v1_reader.py | 482 | CODE | |
| LOW | scripts/runatal_v1_reader.py | 523 | CODE | |
| LOW | scripts/runatal_v1_reader.py | 566 | CODE | |
| LOW | scripts/runatal_v1_reader.py | 609 | CODE | |
| LOW | scripts/runatal_v1_reader.py | 837 | CODE | |
| LOW | scripts/release_manifest.py | 202 | CODE | |
| LOW | scripts/release_manifest.py | 377 | CODE | |
| LOW | scripts/runatal_v1_sketch.py | 124 | CODE | |
| LOW | scripts/runatal_v1_kv.py | 137 | CODE | |
| LOW | scripts/runatal_v1_kv.py | 237 | CODE | |
| LOW | scripts/runatal_v1_physical.py | 246 | CODE | |
| LOW | scripts/runatal_v1_physical.py | 294 | CODE | |
| LOW | scripts/runatal_v1_physical.py | 365 | CODE | |
| LOW | scripts/runatal_v1_physical.py | 450 | CODE | |
| LOW | scripts/runatal_v1_physical.py | 670 | CODE | |
| LOW | scripts/test_release_publication.py | 136 | CODE | |
| LOW | scripts/test_release_publication.py | 160 | CODE | |
| LOW | scripts/create_oci_test_shuttle.py | 34 | CODE | |
| LOW | scripts/musl_release_manifest.py | 116 | CODE | |
| LOW | scripts/channel_metadata.py | 356 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | crates/astrid-capsule/src/security/mod.rs | 124 | /// NOTE: This method currently takes no socket path argument because the | COMMENT |
| LOW | crates/astrid-approval/src/manager.rs | 217 | // Step 1: Check if an existing allowance covers this action (atomic find + consume). | COMMENT |
| LOW⚡ | crates/astrid-approval/src/manager.rs | 230 | // Step 2: No allowance — we need user approval | COMMENT |
| LOW⚡ | crates/astrid-approval/src/manager.rs | 233 | // Step 3: Check if handler is available | COMMENT |
| LOW | crates/astrid-approval/src/manager.rs | 252 | // Step 4: Send request to handler with timeout | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | crates/astrid-approval/src/manager.rs | 217 | // Step 1: Check if an existing allowance covers this action (atomic find + consume). | COMMENT |
| LOW⚡ | crates/astrid-approval/src/manager.rs | 230 | // Step 2: No allowance — we need user approval | COMMENT |
| LOW⚡ | crates/astrid-approval/src/manager.rs | 233 | // Step 3: Check if handler is available | COMMENT |
| LOW | crates/astrid-approval/src/manager.rs | 252 | // Step 4: Send request to handler with timeout | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | scripts/e2e/fake-openai-compat.py | 175 | b'"delta":{"content":"still "},"finish_reason":null}]}\n\n' | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | container/amd64/test.sh | 87 | # Create a test-only local alias from the verified digest for the two derived | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | crates/astrid-hooks/src/handler/agent.rs | 16 | /// TODO: implement real agent handler. For now, it returns a stub response. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | crates/astrid-gateway/src/routes/env.rs | 454 | .get("placeholder") | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | e2e/concurrency.sh | 51 | except Exception as e: # noqa: BLE001 - reported, not raised | CODE |