Home / astrid-runtime / astrid
AI Slop Code RIsk Monitor

astrid-runtime/astrid

Astrid is a portable, capability-secure operating system for composable software.

5.2 Moderate pattern signal View on GitHub

Maintenance and Governance Review

This report summarizes scanner evidence for astrid-runtime/astrid, a Rust project with 10,280 GitHub stars. SynthScan examined 555,805 lines of code across 1608 source files, recording 2256 pattern matches distributed across 16 syntactic categories. The legacy adjusted pattern signal is 5.2 (Moderate pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

5.2
Adjusted Signal
5.2
Raw Pattern Score
100%
Time Factor
2026-10-10
Last Push
10.3K
Stars
Rust
Language
555.8K
Lines of Code
1.6K
Files
2.3K
Pattern Hits
2026-10-12
Scan Date
0.00
HC Hit Rate

Risk Review · v3

Use each vector to guide manual verification of the underlying findings.

Cognitive Ownership Risk 16.1/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 1914 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.5/100 · LOW

Are imports declared and package/API names verified? 45 finding(s).

Agent Over-Engineering Ratio 10.0/100 · LOW

Are wrappers, guards, and repeated structures necessary? 562 finding(s).

PR Review Velocity Impact 23.2/100 · LOW

Which changes need focused human review? 2256 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 6MEDIUM 328LOW 1922

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 2256 distinct pattern matches across 16 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block1573 hits · 1506 pts
SeverityFileLineSnippetContext
LOWCargo.toml81# `astrid-gateway` (and `astrid-integration-tests` for the gatewayCOMMENT
LOWCargo.toml161# capsules to record into the same recorder the gateway exports —COMMENT
LOWCargo.toml181# topic, principal) routing demux so the synchronous `EventBus::publish`COMMENT
LOWCargo.toml221jsonwebtoken = { version = "10.3", default-features = false, features = ["aws_lc_rs", "use_pem"] }COMMENT
LOWCargo.toml241# `rt-multi-thread`).COMMENT
LOWcrates/astrid-capsule-types/src/memory_ledger.rs1//! Shared per-principal peak-memory accounting ledger.COMMENT
LOWcrates/astrid-capsule-types/src/memory_ledger.rs21//! linear memory a *prior* leaseholder allocated. The peak is thus an upperCOMMENT
LOWcrates/astrid-capsule-types/src/memory_ledger.rs41COMMENT
LOWcrates/astrid-capsule-types/src/memory_ledger.rs81 // strictly above it. Evicting a bigger user to record a smaller oneCOMMENT
LOWcrates/astrid-capsule-types/src/limits.rs1//! Host-derived runtime concurrency limits for the WASM capsule engine.COMMENT
LOWcrates/astrid-capsule-types/src/limits.rs41/// concurrency ceiling for a capsule's interceptor invocations).COMMENT
LOWcrates/astrid-capsule-types/src/limits.rs61/// Maximum redirect hops the host follows by default, and the caller ceiling aCOMMENT
LOWcrates/astrid-capsule-types/src/limits.rs81#[must_use]COMMENT
LOWcrates/astrid-capsule-types/src/limits.rs101pub fn host_io_concurrency_default() -> usize {COMMENT
LOWcrates/astrid-capsule-types/src/limits.rs141}COMMENT
LOWcrates/astrid-capsule-types/src/limits.rs201}COMMENT
LOWcrates/astrid-capsule-types/src/limits.rs221/// caller sets no corresponding `*-ms`. An explicit caller value OVERRIDES theCOMMENT
LOWcrates/astrid-capsule-types/src/limits.rs241 /// `connect-ms` (a default, not a ceiling). Host const default: 30s.COMMENT
LOWcrates/astrid-capsule-types/src/limits.rs361COMMENT
LOWcrates/astrid-capsule-types/src/fuel_ledger.rs1//! Shared per-principal CPU accounting ledger.COMMENT
LOWcrates/astrid-capsule-types/src/fuel_ledger.rs21//! ledger had to become cross-capsule first). The run-loop CPU bound remainsCOMMENT
LOWcrates/astrid-capsule-types/src/fuel_ledger.rs81/// Cloning is cheap (an `Arc` bump) and every clone observes the same map, soCOMMENT
LOWcrates/astrid-capsule-types/src/fuel_ledger.rs121 /// principal. The closure always returns `Some`, so `fetch_update` can neverCOMMENT
LOWcrates/astrid-capsule-types/src/fuel_ledger.rs141 pub fn total(&self, principal: &PrincipalId) -> u64 {COMMENT
LOWcrates/astrid-capsule-types/src/fuel_ledger.rs181/// Shared, cloneable per-principal CPU-**rate** limiter — the deny side of theCOMMENT
LOWcrates/astrid-capsule-types/src/fuel_ledger.rs201/// `Mutex`, so distinct principals never contend. This deliberately does notCOMMENT
LOWcrates/astrid-capsule-types/src/fuel_ledger.rs301 /// the in-window fuel. Pure helper over a held cell guard.COMMENT
LOWcrates/astrid-capsule-types/src/fuel_ledger.rs341COMMENT
LOWcrates/astrid-capsule-types/src/fuel_ledger.rs401 /// Attribute `fuel` to `principal`'s current 1-second window (post-hoc, fromCOMMENT
LOWcrates/astrid-capsule-types/src/fuel_ledger.rs461 });COMMENT
LOW…es/astrid-capsule-types/src/capability_presentation.rs1//! Human-facing presentation for capsule capability grants.COMMENT
LOWcrates/astrid-capsule-types/src/manifest/mod.rs21///COMMENT
LOWcrates/astrid-capsule-types/src/manifest/mod.rs41 #[serde(default, deserialize_with = "deserialize_imports_map")]COMMENT
LOWcrates/astrid-capsule-types/src/manifest/mod.rs61 /// Same shape as `publishes`. An entry with a `handler = "..."` field (andCOMMENT
LOWcrates/astrid-capsule-types/src/manifest/mod.rs81 #[serde(default, rename = "context_file")]COMMENT
LOWcrates/astrid-capsule-types/src/manifest/mod.rs161 /// carries a `handler` binds that topic to a `#[astrid::interceptor]`COMMENT
LOWcrates/astrid-capsule-types/src/manifest/mod.rs201 D: serde::Deserializer<'de>,COMMENT
LOWcrates/astrid-capsule-types/src/manifest/mod.rs341 /// Optional description of the capsule.COMMENT
LOWcrates/astrid-capsule-types/src/manifest/mod.rs381 /// Unique identifier for this component within the capsule.COMMENT
LOWcrates/astrid-capsule-types/src/manifest/mod.rs401///COMMENT
LOWcrates/astrid-capsule-types/src/manifest/mod.rs421 pub description: Option<String>,COMMENT
LOWcrates/astrid-capsule-types/src/manifest/mod.rs441 /// sibling `enum_values` field; the kebab `options-from` form isCOMMENT
LOWcrates/astrid-capsule-types/src/manifest/mod.rs461 /// `Shared` and pull host-wide values into its sandbox. The kernelCOMMENT
LOWcrates/astrid-capsule-types/src/manifest/mod.rs481/// Template placeholders use `{key}` syntax, where `key` is the name ofCOMMENT
LOWcrates/astrid-capsule-types/src/manifest/mod.rs501 /// resolves to a non-empty value after trimming.COMMENT
LOWcrates/astrid-capsule-types/src/manifest/mod.rs521COMMENT
LOWcrates/astrid-capsule-types/src/manifest/mod.rs541 /// through. The fail-closed default — appropriate for anything anCOMMENT
LOWcrates/astrid-capsule-types/src/manifest/mod.rs581 /// Path to the declarative command TOML (if static).COMMENT
LOWcrates/astrid-capsule-types/src/manifest/mod.rs601COMMENT
LOWcrates/astrid-capsule-types/src/manifest/mod.rs621/// This type has no manifest or runtime semantics. It remains public only soCOMMENT
LOWcrates/astrid-capsule-types/src/manifest/mod.rs641 pub platform: String,COMMENT
LOWcrates/astrid-capsule-types/src/manifest/mod.rs661 /// `[subscribe]` entry's `handler` (must match anCOMMENT
LOW…ates/astrid-capsule-types/src/manifest/capabilities.rs1//! The `[capabilities]` block — what a capsule asks for from the OS.COMMENT
LOW…ates/astrid-capsule-types/src/manifest/capabilities.rs21 /// is present for future cross-capsule KV request declarations.COMMENT
LOW…ates/astrid-capsule-types/src/manifest/capabilities.rs41 /// child, so persistence is an additional operator-reviewed opt-in on topCOMMENT
LOW…ates/astrid-capsule-types/src/manifest/capabilities.rs61 /// literal DNS name or `*` (universal — see security review noteCOMMENT
LOW…ates/astrid-capsule-types/src/manifest/capabilities.rs81 ///COMMENT
LOW…ates/astrid-capsule-types/src/manifest/capabilities.rs101COMMENT
LOW…ates/astrid-capsule-types/src/manifest/capabilities.rs161COMMENT
LOWcrates/astrid-capsule-types/src/manifest/topics.rs1//! Cargo-shaped `[publish]` / `[subscribe]` tables.COMMENT
1513 more matches not shown…
Decorative Section Separators292 hits · 858 pts
SeverityFileLineSnippetContext
MEDIUMcrates/astrid-capsule-types/src/fuel_ledger.rs599 // ── FuelRateLimiter (PR2: the deny side) ─────────────────────────────COMMENT
MEDIUMcrates/astrid-capabilities/src/policy.rs666 // ── Device-scope attenuation ──────────────────────────────────────────COMMENT
MEDIUMcrates/astrid-gateway/tests/router.rs896// ── Device-scoped bearer: key_id extraction + per-key revocation ──────COMMENT
MEDIUMcrates/astrid-gateway/src/routes/distribution.rs118// ── parsing helpers ────────────────────────────────────────────────COMMENT
MEDIUMcrates/astrid-gateway/src/routes/principals.rs340// ── /api/sys/capabilities ────────────────────────────────────────COMMENT
MEDIUMcrates/astrid-gateway/src/routes/principals.rs431// ── Device management ────────────────────────────────────────────COMMENT
MEDIUMcrates/astrid-gateway/src/routes/principals.rs582// ── Helpers ──────────────────────────────────────────────────────COMMENT
MEDIUMcrates/astrid-gateway/src/routes/env.rs244// ── helpers ──────────────────────────────────────────────────────COMMENT
MEDIUMcrates/astrid-gateway/src/routes/capsules.rs523// ── helpers (kernel client error mapping) ────────────────────────COMMENT
MEDIUMcrates/astrid-config/src/defaults.toml13# ============================================================================COMMENT
MEDIUMcrates/astrid-config/src/defaults.toml15# ============================================================================COMMENT
MEDIUMcrates/astrid-config/src/defaults.toml47# ============================================================================COMMENT
MEDIUMcrates/astrid-config/src/defaults.toml49# ============================================================================COMMENT
MEDIUMcrates/astrid-config/src/defaults.toml75# ============================================================================COMMENT
MEDIUMcrates/astrid-config/src/defaults.toml77# ============================================================================COMMENT
MEDIUMcrates/astrid-config/src/defaults.toml121# ============================================================================COMMENT
MEDIUMcrates/astrid-config/src/defaults.toml123# ============================================================================COMMENT
MEDIUMcrates/astrid-config/src/defaults.toml136# ============================================================================COMMENT
MEDIUMcrates/astrid-config/src/defaults.toml138# ============================================================================COMMENT
MEDIUMcrates/astrid-config/src/defaults.toml158# ============================================================================COMMENT
MEDIUMcrates/astrid-config/src/defaults.toml160# ============================================================================COMMENT
MEDIUMcrates/astrid-config/src/defaults.toml193# ============================================================================COMMENT
MEDIUMcrates/astrid-config/src/defaults.toml195# ============================================================================COMMENT
MEDIUMcrates/astrid-config/src/defaults.toml243# ============================================================================COMMENT
MEDIUMcrates/astrid-config/src/defaults.toml245# ============================================================================COMMENT
MEDIUMcrates/astrid-config/src/defaults.toml257# ============================================================================COMMENT
MEDIUMcrates/astrid-config/src/defaults.toml259# ============================================================================COMMENT
MEDIUMcrates/astrid-config/src/defaults.toml293# ============================================================================COMMENT
MEDIUMcrates/astrid-config/src/defaults.toml295# ============================================================================COMMENT
MEDIUMcrates/astrid-config/src/defaults.toml311# ============================================================================COMMENT
MEDIUMcrates/astrid-config/src/defaults.toml313# ============================================================================COMMENT
MEDIUMcrates/astrid-config/src/defaults.toml341# ============================================================================COMMENT
MEDIUMcrates/astrid-config/src/defaults.toml343# ============================================================================COMMENT
MEDIUMcrates/astrid-config/src/defaults.toml362# ============================================================================COMMENT
MEDIUMcrates/astrid-config/src/defaults.toml364# ============================================================================COMMENT
MEDIUMcrates/astrid-config/src/defaults.toml399# ============================================================================COMMENT
MEDIUMcrates/astrid-config/src/defaults.toml401# ============================================================================COMMENT
MEDIUMcrates/astrid-config/src/defaults.toml431# ============================================================================COMMENT
MEDIUMcrates/astrid-config/src/defaults.toml433# ============================================================================COMMENT
MEDIUMcrates/astrid-config/src/defaults.toml451# ============================================================================COMMENT
MEDIUMcrates/astrid-config/src/defaults.toml453# ============================================================================COMMENT
MEDIUMcrates/astrid-config/src/defaults.toml466# ============================================================================COMMENT
MEDIUMcrates/astrid-config/src/defaults.toml468# ============================================================================COMMENT
MEDIUMcrates/astrid-config/src/defaults.toml492# ============================================================================COMMENT
MEDIUMcrates/astrid-config/src/defaults.toml494# ============================================================================COMMENT
MEDIUMcrates/astrid-config/src/defaults.toml518# ============================================================================COMMENT
MEDIUMcrates/astrid-config/src/defaults.toml520# ============================================================================COMMENT
MEDIUM…integration-tests/tests/management_api_admin_topics.rs39// ── Fixtures ──────────────────────────────────────────────────────────COMMENT
MEDIUM…integration-tests/tests/management_api_admin_topics.rs139// ── Full cross-tenant matrix ─────────────────────────────────────────COMMENT
MEDIUM…integration-tests/tests/management_api_admin_topics.rs202// ── Self-scope resolves from target principal ────────────────────────COMMENT
MEDIUM…integration-tests/tests/management_api_admin_topics.rs227// ── Agent built-in caps explicitly list self-admin entries ──────────COMMENT
MEDIUM…integration-tests/tests/management_api_admin_topics.rs248// ── Audit method labels ──────────────────────────────────────────────COMMENT
MEDIUM…integration-tests/tests/management_api_admin_topics.rs288// ── Wire-format round trips ─────────────────────────────────────────COMMENT
MEDIUM…integration-tests/tests/management_api_admin_topics.rs388// ── ArcSwap hot-reload viewed from outside the kernel crate ─────────COMMENT
MEDIUM…integration-tests/tests/management_api_admin_topics.rs471// ── Built-in group write protection ─────────────────────────────────COMMENT
MEDIUMcrates/astrid-integration-tests/tests/gateway_e2e.rs574 // ── Kernel boot artefacts on disk ───────────────────────────COMMENT
MEDIUMcrates/astrid-integration-tests/tests/gateway_e2e.rs588 // ── Gateway state shares the same home ──────────────────────COMMENT
MEDIUMcrates/astrid-integration-tests/tests/gateway_e2e.rs621 // ── Unauthenticated routes against the live state ────────────COMMENT
MEDIUMcrates/astrid-integration-tests/tests/gateway_e2e.rs625 // ── Audit event bus round-trip ──────────────────────────────COMMENT
MEDIUMcrates/astrid-integration-tests/tests/gateway_e2e.rs643 // ── Cleanup ─────────────────────────────────────────────────COMMENT
232 more matches not shown…
Hyper-Verbose Identifiers264 hits · 290 pts
SeverityFileLineSnippetContext
LOW⚡scripts/test_oci_arm64_container_contract.py37 def test_uses_arch_specific_digest_pinned_ubuntu_base(self) -> None:CODE
LOW⚡scripts/test_oci_arm64_container_contract.py45 def test_is_non_root_distro_neutral_and_exposes_no_ports(self) -> None:CODE
LOW⚡scripts/test_oci_arm64_container_contract.py51 def test_reuses_the_reviewed_entrypoint_contract(self) -> None:CODE
LOWscripts/test_oci_arm64_container_contract.py81 def test_derived_images_alias_and_cleanup_the_bound_local_base(self) -> None:CODE
LOW⚡scripts/test_oci_arm64_container_contract.py93 def test_restricted_runtime_is_rootless_read_only_and_unprivileged(self) -> None:CODE
LOW⚡scripts/test_oci_arm64_container_contract.py101 def test_real_daemon_readiness_and_authenticated_status_are_required(self) -> None:CODE
LOW⚡scripts/test_oci_arm64_container_contract.py106 def test_entrypoint_stages_and_reauthenticates_signed_distro(self) -> None:CODE
LOW⚡scripts/test_oci_arm64_container_contract.py116 def test_foreground_daemon_allowlist_cannot_enable_ephemeral_mode(self) -> None:CODE
LOWscripts/test_oci_arm64_container_contract.py182 def test_scan_sbom_and_per_export_blob_evidence_are_required(self) -> None:CODE
LOWscripts/test_oci_arm64_container_contract.py255 def test_path_filters_and_test_lane_include_shared_binding_contract(self) -> None:CODE
LOWscripts/test_oci_arm64_container_contract.py260 def test_oidc_signing_requires_manual_protected_main_and_environment(self) -> None:CODE
LOWscripts/test_oci_arm64_container_contract.py271 def test_workflow_never_invokes_registry_publication_tools(self) -> None:CODE
LOWscripts/test_oci_arm64_container_contract.py288 def test_workflow_never_uses_mutable_or_canonical_image_tags(self) -> None:CODE
LOWscripts/test_oci_arm64_container_contract.py301 def test_workflow_cannot_enable_emulation_or_multi_platform_builds(self) -> None:CODE
LOWscripts/test_macos_release_packaging.py51 def test_package_is_deterministic_and_validates(self) -> None:CODE
LOWscripts/test_macos_release_packaging.py65 def test_packaging_rejects_redirects(self) -> None:CODE
LOWscripts/test_macos_release_packaging.py77 def test_packaging_rejects_output_inside_the_release_root(self) -> None:CODE
LOWscripts/test_macos_release_packaging.py86 def test_validation_rejects_noncanonical_modes(self) -> None:CODE
LOWscripts/test_macos_release_packaging.py105 def test_validation_requires_every_common_executable(self) -> None:CODE
LOW⚡scripts/test_musl_release_manifest.py71 def test_round_trip_is_deterministic_and_bound_to_legacy_release(self) -> None:CODE
LOW⚡scripts/test_musl_release_manifest.py80 def test_accepts_exactly_the_two_supported_musl_targets(self) -> None:CODE
LOW⚡scripts/test_musl_release_manifest.py88 def test_rejects_missing_duplicate_and_unexpected_targets(self) -> None:CODE
LOWscripts/test_musl_release_manifest.py104 def test_rejects_every_release_identity_mismatch(self) -> None:CODE
LOWscripts/test_musl_release_manifest.py123 def test_rejects_a_different_legacy_manifest_digest_or_asset(self) -> None:CODE
LOWscripts/test_musl_release_manifest.py134 def test_rejects_partial_combined_checksums(self) -> None:CODE
LOWscripts/test_musl_release_manifest.py140 def test_validate_command_requires_and_checks_the_legacy_manifest(self) -> None:CODE
LOWscripts/runatal_v1_volume.py61def physically_valid_record_at(data, offset):CODE
LOWscripts/runatal_v1_volume.py97def has_physically_valid_record_after(data, start):CODE
LOWscripts/runatal_v1_volume.py106def volume_metadata_mutations(payload):CODE
LOWscripts/runatal_v1_reader.py304def validate_content_boundary(left_object, left, right_prefix, profile, memo):CODE
LOWscripts/runatal_v1_reader.py395def verify_content_summary_vectors():CODE
LOWscripts/runatal_v1_reader.py523def validate_derivation_invocation(record):CODE
LOWscripts/runatal_v1_reader.py566def validate_derivation_evidence(record):CODE
LOW⚡scripts/test_changelog.py66 def test_parse_labels_accepts_github_escaped_newline(self):STRING
LOW⚡scripts/test_changelog.py72 def test_escaped_newline_does_not_create_partial_label_matches(self):STRING
LOW⚡scripts/test_changelog.py82 def test_github_multilabel_payload_skips_changelog_check(self):STRING
LOW⚡scripts/test_changelog.py92 def test_code_without_fragment_fails(self):STRING
LOW⚡scripts/test_changelog.py101 def test_code_with_fragment_passes(self):STRING
LOW⚡scripts/test_changelog.py111 def test_skip_label_passes_without_fragment(self):STRING
LOW⚡scripts/test_changelog.py121 def test_docs_only_passes_without_fragment(self):STRING
LOW⚡scripts/test_changelog.py131 def test_cargo_lock_requires_fragment(self):STRING
LOW⚡scripts/test_changelog.py135 def test_invalid_fragment_name_fails(self):STRING
LOW⚡scripts/test_changelog.py144 def test_changelog_md_edit_is_not_enough_for_code(self):STRING
LOW⚡scripts/test_changelog.py152 def test_code_plus_changelog_and_fragment_still_fails(self):STRING
LOW⚡scripts/test_changelog.py161 def test_release_skip_allows_changelog_and_cargo(self):STRING
LOW⚡scripts/test_changelog.py241 def test_roll_rejects_duplicate_version_headings(self):STRING
LOW⚡scripts/test_changelog.py250 def test_roll_rejects_staged_and_dated_version_headings(self):STRING
LOW⚡scripts/test_changelog.py259 def test_notes_match_awk_style_section_body(self):STRING
LOW⚡scripts/test_changelog.py268 def test_roll_command_deletes_fragments(self):STRING
LOWscripts/test_changelog.py172 def test_empty_fragment_body_fails(self):STRING
LOWscripts/test_changelog.py187 def test_entry_wraps_prose_as_bullet(self):STRING
LOWscripts/test_changelog.py193 def test_roll_moves_unreleased_and_fragments_without_touching_history(self):STRING
LOWscripts/test_changelog.py211 def test_roll_finalizes_matching_staged_version_in_place(self):STRING
LOWscripts/test_changelog.py297 def test_notes_require_rolled_fails_on_pending_fragment(self):STRING
LOWscripts/test_validate_release_archive.py38 def test_linux_and_windows_inventories_validate(self) -> None:CODE
LOWscripts/test_validate_release_archive.py48 def test_missing_provider_is_rejected(self) -> None:CODE
LOWscripts/test_validate_release_archive.py60 def test_redirecting_member_is_rejected(self) -> None:CODE
LOW⚡scripts/test_fskit_app_handoff.py66 def test_cold_install_does_not_signal(self):STRING
LOW⚡scripts/test_fskit_app_handoff.py71 def test_verified_old_app_exits_before_replacement(self):STRING
LOW⚡scripts/test_fskit_app_handoff.py76 def test_active_mount_refuses_before_signal(self):STRING
204 more matches not shown…
AI Slop Vocabulary18 hits · 54 pts
SeverityFileLineSnippetContext
MEDIUMCargo.toml172# Oracle-only dependency for the pre-release chunker evidence harness. PersistentCOMMENT
MEDIUMcrates/astrid-cli/src/commands/daemon_control.rs26//! The identity check is also robust to an in-place upgrade replacing theCOMMENT
MEDIUMcrates/astrid-capsule/src/engine/wasm/mod.rs143/// upward, there is no robust primitive for "contains a repo below", and theCOMMENT
MEDIUMcrates/astrid-capsule/src/engine/wasm/mod.rs6462 /// the trap's `Display` string — robust across wasmtime point releases andCOMMENT
MEDIUMscripts/test-gateway-quota-fixture.sh3# This is a harness regression, not evidence of a real gateway journey.COMMENT
MEDIUMscripts/e2e/runtime-harness.sh382 # the harness's published/runtime IDs remain `astrid-capsule-*`. Prefer theCOMMENT
MEDIUMscripts/e2e/runtime-harness.sh618 # wall-clock sleep in this runtime harness.COMMENT
MEDIUMscripts/e2e/runtime-process-helpers.sh69 # This process was launched directly by the harness, so exercise its nativeCOMMENT
MEDIUMscripts/e2e/runtime-multi-home-smoke.sh90 # installed capsule set before the harness-owned restart.COMMENT
MEDIUMscripts/e2e/runtime-multi-home-smoke.sh110 # Match the primary harness' non-interactive declared-config install soCOMMENT
MEDIUMscripts/e2e/runtime-multi-home-smoke.sh142 # the harness-owned process so cleanup cannot leave an untracked second home.COMMENT
MEDIUM.github/workflows/runtime-e2e.yml65 # Runtime budget: the harness has bounded daemon startup, curl/SSE, fake LLM,COMMENT
MEDIUM.github/workflows/runtime-e2e.yml98 # Install it up front so the runtime harness cannot trigger anCOMMENT
MEDIUMe2e/first-party-capsule-scenarios.toml8# family. status = "covered" means the current runtime harness executes it.COMMENT
MEDIUMe2e/capability-scenarios.toml7# - status = "covered": the current runtime harness asserts allow/deny behaviorCOMMENT
MEDIUMe2e/cli-scenarios.toml8# status = "covered" means the current runtime harness executes an assertion forCOMMENT
MEDIUMe2e/http-scenarios.toml8# status = "covered" means the current runtime harness executes an assertion forCOMMENT
MEDIUMe2e/runtime-scenario-specs.toml6# evidence the harness must assert. Drift tests reject mappings to scenariosCOMMENT
Modern AI Meta-Vocabulary17 hits · 45 pts
SeverityFileLineSnippetContext
MEDIUMCHANGELOG.md760- **Capsule access is now per-principal, enforced kernel-side at dispatch — closing the gap where the capsule tool surfaCODE
MEDIUMCHANGELOG.md825- **`astrid capsule new <name>` scaffolds a complete, first-try-compiling tool capsule — with a toolchain preflight and CODE
MEDIUMCHANGELOG.md891- **Per-capsule WASM instance pool: principals' interceptors now run concurrently instead of serialising through one `StCODE
MEDIUMCHANGELOG.md1021- **Per-capsule WASM instance pool: principals' interceptors now run concurrently instead of serialising through one `StCODE
MEDIUMCHANGELOG.md1100- **Per-domain WIT review fixups (PR #752).** A multi-agent review surfaced fixes addressed in-branch before merge:CODE
MEDIUMREADME.md293astrid capsule new my-capsule # scaffold Capsule.toml, Cargo.toml, src/lib.rs, .cargo/config.tomlCODE
MEDIUMcrates/astrid-config/src/defaults.toml33# Maximum context window size in tokens (soft limit for summarization)COMMENT
MEDIUMcrates/astrid-cli/src/commands/capsule/new.rs1//! `astrid capsule new <name>` — scaffold a complete, first-try-compilingCOMMENT
MEDIUMcrates/astrid-cli/src/commands/capsule/new.rs112/// Every check is fail-FRIENDLY: nothing here aborts the scaffold. A capsuleCOMMENT
MEDIUMcrates/astrid-cli/src/commands/capsule/new.rs130 // the caller scaffold).COMMENT
MEDIUMcrates/astrid-cli/src/commands/capsule/new.rs358/// Print the friendly next-steps message after a successful scaffold.COMMENT
MEDIUMcrates/astrid-capsule/src/engine/wasm/mod.rs3687 // cross-principal race that #813 collapsed the orchestration cliffCOMMENT
MEDIUMcrates/astrid-capsule/src/engine/wasm/pool.rs6//! `astrid#813` orchestration cliff (one LLM turn every ~3s, invariant toCOMMENT
MEDIUMcrates/astrid-mcp/src/registry.rs5//! The runtime's agentic loop uses the registry instead of knowing aboutCOMMENT
MEDIUM…es/astrid-kernel/src/principal_home_migration/tests.rs28 // source root. Normal v2 boot must not scaffold `home/` at all.COMMENT
MEDIUMdocs/astrid-tensor-logic-composition.md624### 9.2 Why scaffold nowCOMMENT
MEDIUMdocs/metrics.md292### 4.3 Capsule lifecycle & WASM sandbox (`astrid-capsule`, `astrid-capsule-install`, kernel orchestration)COMMENT
Unused Imports42 hits · 42 pts
SeverityFileLineSnippetContext
LOWscripts/test_oci_arm64_container_contract.py4CODE
LOWscripts/check_static_elf.py4CODE
LOWscripts/nightly_version.py4CODE
LOWscripts/test_macos_release_packaging.py3CODE
LOWscripts/package_release_archive.py4CODE
LOWscripts/test_musl_release_manifest.py3CODE
LOWscripts/test_validate_release_archive.py3CODE
LOWscripts/test_windows_release_manifest.py3CODE
LOWscripts/test_channel_metadata.py3CODE
LOWscripts/test_crate_publication.py3CODE
LOWscripts/check_dco.py4CODE
LOWscripts/test_release_draft_recovery.py3CODE
LOWscripts/validate_macos_release.py4CODE
LOWscripts/release_manifest.py4CODE
LOWscripts/oci_export_binding.py4CODE
LOWscripts/test_check_glibc.py3CODE
LOWscripts/runatal_v1_physical.py11CODE
LOWscripts/runatal_v1_physical.py11CODE
LOWscripts/runatal_v1_physical.py11CODE
LOWscripts/changelog.py4CODE
LOWscripts/channel_publication.py4CODE
LOWscripts/test_release_publication.py3CODE
LOWscripts/create_oci_test_shuttle.py4CODE
LOWscripts/test_nightly_version.py3CODE
LOWscripts/test_oci_export_binding.py4CODE
LOWscripts/test_release_manifest.py3CODE
LOWscripts/oci_release.py4CODE
LOWscripts/crate_publication.py4CODE
LOWscripts/release_publication.py4CODE
LOWscripts/check_glibc.py4CODE
LOWscripts/test_check_static_elf.py3CODE
LOWscripts/test_channel_publication.py3CODE
LOWscripts/musl_release_manifest.py4CODE
LOWscripts/validate_release_archive.py4CODE
LOWscripts/windows_release_manifest.py4CODE
LOWscripts/release_draft_recovery.py4CODE
LOWscripts/test_oci_container_contract.py4CODE
LOWscripts/classify_release_build_matrix.py1CODE
LOWscripts/test_oci_release.py4CODE
LOWscripts/channel_metadata.py4CODE
LOWscripts/e2e/check-first-party-capsule-commands.py4CODE
LOWscripts/e2e/fake-openai-compat.py15CODE
Deep Nesting30 hits · 30 pts
SeverityFileLineSnippetContext
LOWscripts/test_macos_release_packaging.py86CODE
LOWscripts/package_release_archive.py42CODE
LOWscripts/runatal_v1_volume.py135CODE
LOWscripts/runatal_v1_reader.py482CODE
LOWscripts/runatal_v1_reader.py523CODE
LOWscripts/runatal_v1_reader.py566CODE
LOWscripts/runatal_v1_reader.py609CODE
LOWscripts/runatal_v1_reader.py837CODE
LOWscripts/test_supervised_fskit.py75CODE
LOWscripts/test_supervised_fskit.py179CODE
LOWscripts/test_supervised_fskit.py199CODE
LOWscripts/test_supervised_fskit.py210CODE
LOWscripts/release_manifest.py88CODE
LOWscripts/release_manifest.py221CODE
LOWscripts/release_manifest.py396CODE
LOWscripts/test_mcp_http_live.py23CODE
LOWscripts/runatal_v1_sketch.py124CODE
LOWscripts/runatal_v1_kv.py137CODE
LOWscripts/runatal_v1_kv.py237CODE
LOWscripts/runatal_v1_physical.py246CODE
LOWscripts/runatal_v1_physical.py294CODE
LOWscripts/runatal_v1_physical.py365CODE
LOWscripts/runatal_v1_physical.py450CODE
LOWscripts/runatal_v1_physical.py670CODE
LOWscripts/test_release_publication.py130CODE
LOWscripts/create_oci_test_shuttle.py34CODE
LOWscripts/musl_release_manifest.py116CODE
LOWscripts/certify_fskit_local.py131CODE
LOWscripts/channel_metadata.py352CODE
LOWscripts/ci/with_macos_profiles.py44CODE
Empty Error Handlers4 hits · 20 pts
SeverityFileLineSnippetContext
HIGHscripts/runatal_v1_reader.py405except FormatError:CODE
HIGHscripts/test_mcp_connection_lifetime.py68except ProcessLookupError:CODE
HIGHscripts/runatal_v1_fastcdc.py266except ValueError:CODE
HIGHscripts/runatal_v1_fastcdc.py279except ValueError:CODE
Cross-Language Confusion2 hits · 12 pts
SeverityFileLineSnippetContext
HIGH⚡scripts/test_runtime_shutdown_diagnostics.py28stop_daemon || status=$?CODE
HIGHscripts/e2e/fake-openai-compat.py210 b'"delta":{"content":"still "},"finish_reason":null}]}\n\n'CODE
Structural Annotation Overuse5 hits · 9 pts
SeverityFileLineSnippetContext
LOWcrates/astrid-capsule/src/security/mod.rs124 /// NOTE: This method currently takes no socket path argument because theCOMMENT
LOWcrates/astrid-approval/src/manager.rs217 // Step 1: Check if an existing allowance covers this action (atomic find + consume).COMMENT
LOW⚡crates/astrid-approval/src/manager.rs230 // Step 2: No allowance — we need user approvalCOMMENT
LOW⚡crates/astrid-approval/src/manager.rs233 // Step 3: Check if handler is availableCOMMENT
LOWcrates/astrid-approval/src/manager.rs252 // Step 4: Send request to handler with timeoutCOMMENT
Verbosity Indicators4 hits · 8 pts
SeverityFileLineSnippetContext
LOWcrates/astrid-approval/src/manager.rs217 // Step 1: Check if an existing allowance covers this action (atomic find + consume).COMMENT
LOW⚡crates/astrid-approval/src/manager.rs230 // Step 2: No allowance — we need user approvalCOMMENT
LOW⚡crates/astrid-approval/src/manager.rs233 // Step 3: Check if handler is availableCOMMENT
LOWcrates/astrid-approval/src/manager.rs252 // Step 4: Send request to handler with timeoutCOMMENT
Self-Referential Comments1 hit · 3 pts
SeverityFileLineSnippetContext
MEDIUMcontainer/amd64/test.sh87# Create a test-only local alias from the verified digest for the two derivedCOMMENT
TODO Padding1 hit · 2 pts
SeverityFileLineSnippetContext
LOWcrates/astrid-hooks/src/handler/agent.rs16/// TODO: implement real agent handler. For now, it returns a stub response.COMMENT
Fake / Example Data1 hit · 1 pts
SeverityFileLineSnippetContext
LOWcrates/astrid-gateway/src/routes/env.rs454 .get("placeholder")CODE
AI Structural Patterns1 hit · 1 pts
SeverityFileLineSnippetContext
LOWscripts/test_fskit_app_handoff.py13CODE
Excessive Try-Catch Wrapping1 hit · 1 pts
SeverityFileLineSnippetContext
LOWe2e/concurrency.sh51 except Exception as e: # noqa: BLE001 - reported, not raisedCODE