AI Slop Code Risk Monitor

docker/compose

SlopCodeMonitor badge for docker/compose Adjusted legacy signal; badge bands: 25 / 50 / 75 (different from dashboard bands).

Define and run multi-container applications with Docker

1.3 Low pattern signal View on GitHub

Open-Source Code Quality, Security and Technical Debt Review

This report summarizes scanner evidence for docker/compose, a Go project with 38,531 GitHub stars. SynthScan examined 99,339 lines of code across 770 source files, recording 131 pattern matches distributed across 3 syntactic categories. The legacy adjusted pattern signal is 1.3 (Low pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

1.3
Adjusted Signal
1.3
Raw Pattern Score
100%
Time Factor
2026-10-30
Last Push
38.5K
Stars
Go
Language
99.3K
Lines of Code
770
Files
131
Pattern Hits
2026-10-31
Scan Date
0.00
HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 6.5/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 131 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.0/100 · LOW

Are imports declared and package/API names verified? 0 finding(s).

Agent Over-Engineering Ratio 0.0/100 · LOW

Are wrappers, guards, and repeated structures necessary? 0 finding(s).

PR Review Velocity Impact 6.4/100 · LOW

Which changes need focused human review? 131 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 0MEDIUM 0LOW 131

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 131 distinct pattern matches across 3 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block128 hits · 128 pts
SeverityFileLineSnippetContext
LOWdocker-bake.hcl1// Copyright 2022 Docker Compose CLI authorsCOMMENT
LOWcmd/compose/hooks.go41}COMMENT
LOWcmd/compose/run.go281 if err != nil {COMMENT
LOWcmd/compose/run.go481 }COMMENT
LOWcmd/compose/options.go81 if buildForSinglePlatform || len(service.Build.Platforms) == 0 {COMMENT
LOWinternal/confighash/hash.go41// and with them the hash, of configurations that did not change at all:COMMENT
LOWinternal/projectloader/unsupported_attributes.go41// presenceUnsupportedAttributes lists, by path, every schema-declaredCOMMENT
LOWinternal/projectloader/unsupported_attributes.go61 tree.NewPath("secrets", "*", "driver_opts"): "secrets[].driver_opts is only honored by Swarm secret drivCOMMENT
LOWinternal/projectloader/unsupported_attributes.go121// only a specific value is unsupported. They can never be derived fromCOMMENT
LOWinternal/projectloader/unsupported_attributes_test.go641}COMMENT
LOWinternal/containerops/cp.go221COMMENT
LOWinternal/provider/plugins.go61 RawSetEnvType = "rawsetenv"COMMENT
LOWinternal/provider/plugins.go81 // GetImageType is a message the provider sends during its pull commandCOMMENT
LOWinternal/provider/plugins.go261 // provider that emits stdout before draining its stdin. Every answer isCOMMENT
LOWinternal/provider/plugins.go341 return progress.Stopped(service)COMMENT
LOWinternal/paths/paths.go41 // then the only way to check if they're truly "equal" is to checkCOMMENT
LOWinternal/oci/push.go41 // for the generated image manifest.COMMENT
LOWinternal/desktop/client.go41const EngineLabel = "com.docker.desktop.address"COMMENT
LOWinternal/desktop/proxy.go61// On macOS/Linux: unix:///path/to/Data/docker-cli.sock → unix:///path/to/Data/httpproxy.sockCOMMENT
LOWinternal/desktop/proxy.go81 // above and the forward-slash form `npipe:////./pipe/...`.COMMENT
LOWinternal/desktop/proxy.go101// Desktop stays in control of proxy decisions (e.g. enterprise-managedCOMMENT
LOWinternal/registry/registry.go41 IndexName = "docker.io"COMMENT
LOWinternal/sync/tar.go161}COMMENT
LOWinternal/sync/tar.go221 }()COMMENT
LOWinternal/sync/shared.go21// PathMapping contains the Compose service and modified host system path.COMMENT
LOWinternal/relay/relay.go141 set["default"] = trueCOMMENT
LOWinternal/relay/relay.go161type InfoAnswer struct {COMMENT
LOWinternal/relay/relay.go181// Info assembles the get-relay-info answer for one provider service:COMMENT
LOWinternal/relay/relay.go221// collision with one, and keeps its lifecycle independent of the project'sCOMMENT
LOWinternal/relay/relay.go261 return existing.Items, nilCOMMENT
LOWinternal/relay/relay.go401// relay is a regular project container (standard compose labels, canonicalCOMMENT
LOWdocs/examples/provider.go241COMMENT
LOW.github/stale.yml41 This issue has been automatically closed because it had not recent activity during the stale period.COMMENT
LOWpkg/dryrun/dryrunclient_test.go21 "go/parser"COMMENT
LOWpkg/compose/compose.go41 "github.com/docker/compose/v5/pkg/api"COMMENT
LOWpkg/compose/create.go101 return s.executePlan(ctx, project, observed, plan)COMMENT
LOWpkg/compose/create.go481 Host: &hostConfig,COMMENT
LOWpkg/compose/observed_state.go41 ProjectName stringCOMMENT
LOWpkg/compose/observed_state.go261 state.Orphans = append(state.Orphans, toObservedContainer(ctr))COMMENT
LOWpkg/compose/observed_state.go461COMMENT
LOWpkg/compose/monitor.go61 c.services[name] = trueCOMMENT
LOWpkg/compose/monitor.go81// State.Restarting=true in that window.COMMENT
LOWpkg/compose/monitor.go101// daemon code setting it is the restart-policy one — so the container isCOMMENT
LOWpkg/compose/monitor.go121//COMMENT
LOWpkg/compose/monitor.go141// be emitted to nobody, and the monitor would track the container forever.COMMENT
LOWpkg/compose/monitor.go341 restarting.Remove(ctr.ID)COMMENT
LOWpkg/compose/api_versions.go21const (COMMENT
LOWpkg/compose/api_versions.go41 // apiVersion149 represents Docker Engine API version 1.49 (Engine v28.1).COMMENT
LOWpkg/compose/pull.go361 return errCOMMENT
LOWpkg/compose/service_containers.go201//COMMENT
LOWpkg/compose/provider_images.go41 // providerPullPolicyMissing (up path): a usable version present in theCOMMENT
LOWpkg/compose/provider_images.go121 return s.runPlugin(ctx, project, service, "pull", args...)COMMENT
LOWpkg/compose/build.go201 if img, ok = images[imgName]; !ok {COMMENT
LOWpkg/compose/up.go101COMMENT
LOWpkg/compose/up.go121 // those nodes (see executeNode), each with its OWN fresh window startingCOMMENT
LOWpkg/compose/up.go161 return errCOMMENT
LOWpkg/compose/up.go221 mu sync.MutexCOMMENT
LOWpkg/compose/up.go341 // answers with a time that can't be used fails the command without anyCOMMENT
LOWpkg/compose/start.go81 // Unlike upDetached/create, start() never calls emitRunningEvents: aCOMMENT
LOWpkg/compose/start.go101 return nilCOMMENT
68 more matches not shown…
Structural Annotation Overuse2 hits · 3 pts
SeverityFileLineSnippetContext
LOWinternal/tracing/wrap.go35// NOTE: This function is nearly identical to SpanWrapFuncForErrGroup, except the latter is designed specially forCOMMENT
LOWinternal/tracing/wrap.go58// NOTE: This function is nearly identical to SpanWrapFunc, except this function is designed specially forCOMMENT
Example Usage Blocks1 hit · 2 pts
SeverityFileLineSnippetContext
LOWpkg/compose/compose.go50// Example usage:COMMENT