AI Slop Code Risk Monitor

grafana/tempo

SlopCodeMonitor badge for grafana/tempo Adjusted legacy signal; badge bands: 25 / 50 / 75 (different from dashboard bands).

Grafana Tempo is a high volume, minimal dependency distributed tracing backend.

0.6 Low pattern signal View on GitHub

Open-Source Code Quality, Security and Technical Debt Review

This report summarizes scanner evidence for grafana/tempo, a Go project with 5,550 GitHub stars. SynthScan examined 475,742 lines of code across 1791 source files, recording 230 pattern matches distributed across 11 syntactic categories. The legacy adjusted pattern signal is 0.6 (Low pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

0.6
Adjusted Signal
0.6
Raw Pattern Score
100%
Time Factor
2026-10-31
Last Push
5.5K
Stars
Go
Language
475.7K
Lines of Code
1.8K
Files
230
Pattern Hits
2026-10-31
Scan Date
0.00
HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 2.4/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 217 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.3/100 · LOW

Are imports declared and package/API names verified? 5 finding(s).

Agent Over-Engineering Ratio 0.2/100 · LOW

Are wrappers, guards, and repeated structures necessary? 8 finding(s).

PR Review Velocity Impact 3.1/100 · LOW

Which changes need focused human review? 230 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 2HIGH 3MEDIUM 20LOW 205

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 230 distinct pattern matches across 11 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block189 hits · 171 pts
SeverityFileLineSnippetContext
LOWcmd/tempo-cli/cmd-view-heatmap.go81}COMMENT
LOWcmd/tempo-vulture/validation_test.go161 }COMMENT
LOWcmd/tempo-vulture/validation_test.go181// },COMMENT
LOWcmd/tempo-vulture/validation_test.go201// }COMMENT
LOWtools/chloggen/main.go1// Copyright The OpenTelemetry AuthorsCOMMENT
LOWtools/chloggen/cmd/new_test.go1// Copyright The OpenTelemetry AuthorsCOMMENT
LOWtools/chloggen/cmd/update.go1// Copyright The OpenTelemetry AuthorsCOMMENT
LOWtools/chloggen/cmd/cmd_test.go1// Copyright The OpenTelemetry AuthorsCOMMENT
LOWtools/chloggen/cmd/validate_test.go1// Copyright The OpenTelemetry AuthorsCOMMENT
LOWtools/chloggen/cmd/root_test.go1// Copyright The OpenTelemetry AuthorsCOMMENT
LOWtools/chloggen/cmd/new.go1// Copyright The OpenTelemetry AuthorsCOMMENT
LOWtools/chloggen/cmd/update_test.go1// Copyright The OpenTelemetry AuthorsCOMMENT
LOWtools/chloggen/cmd/validate.go1// Copyright The OpenTelemetry AuthorsCOMMENT
LOWtools/chloggen/cmd/root.go1// Copyright The OpenTelemetry AuthorsCOMMENT
LOWtools/chloggen/internal/config/config.go1// Copyright The OpenTelemetry AuthorsCOMMENT
LOWtools/chloggen/internal/config/config.yaml1# The directory that stores individual changelog entries.COMMENT
LOWtools/chloggen/internal/config/config.yaml21# If 'change_logs' is specified in this file, and no value is specified for 'default_change_logs',COMMENT
LOWtools/chloggen/internal/config/config_test.go1// Copyright The OpenTelemetry AuthorsCOMMENT
LOWtools/chloggen/internal/chlog/entry_test.go1// Copyright The OpenTelemetry AuthorsCOMMENT
LOWtools/chloggen/internal/chlog/entry.go1// Copyright The OpenTelemetry AuthorsCOMMENT
LOWtools/chloggen/internal/chlog/summary.go1// Copyright The OpenTelemetry AuthorsCOMMENT
LOWtools/chloggen/internal/chlog/summary_test.go1// Copyright The OpenTelemetry AuthorsCOMMENT
LOWexample/docker-compose/migrate-to-3/docker-compose.yaml1# Docker Compose example for the Tempo 2.x -> 3.0 microservices migration.COMMENT
LOWexample/docker-compose/migrate-to-3/tempo-v3.yaml1# Tempo 3.0 microservices configuration.COMMENT
LOWintegration/util/harness.go281COMMENT
LOWintegration/limits/limits_test.go141 payload func() []byteCOMMENT
LOWintegration/storage/backend_scheduler_test.go141 // from jobs which have not been processed, we expect our outstanding blocksCOMMENT
LOWintegration/api/misc/management_test.go81 // TODO: research this behaviorCOMMENT
LOWtempodb/tempodb.go761// window bounds which traces inside the block are candidates; the zero value scans the block in full.COMMENT
LOWtempodb/redaction.go1package tempodbCOMMENT
LOWtempodb/tempodb_test.go521 name: "exclude - duh",COMMENT
LOWtempodb/tempodb_metrics_test.go2701// 1. Sets up a test environmentCOMMENT
LOWtempodb/tempodb_search_test.go1881COMMENT
LOWtempodb/encoding/versioned.go21COMMENT
LOWtempodb/encoding/versioned.go41 CreateBlock(ctx context.Context, cfg *common.BlockConfig, meta *backend.BlockMeta, i common.Iterator, r backend.Reader,COMMENT
LOWtempodb/encoding/common/interfaces.go121COMMENT
LOWtempodb/encoding/vparquet5/compactor.go21COMMENT
LOWtempodb/encoding/vparquet5/block_traceql.go1561}COMMENT
LOWtempodb/encoding/vparquet5/block_traceql.go1581// Event attribute iterator: key -------------------------------------------- -------------COMMENT
LOWtempodb/encoding/vparquet5/block_traceql.go1601// | | |COMMENT
LOWtempodb/encoding/vparquet5/block_traceql.go1621// V V V |COMMENT
LOWtempodb/encoding/vparquet5/block_traceql.go1641// valueN ----------------------------------- | | |COMMENT
LOWtempodb/encoding/vparquet5/block_traceql.go1661// | List of SpansetsCOMMENT
LOWtempodb/encoding/vparquet5/block_traceql.go1761COMMENT
LOWtempodb/encoding/vparquet5/block_traceql.go2881 }COMMENT
LOWtempodb/encoding/vparquet5/wal_block.go41// path + filename = folder to createCOMMENT
LOWtempodb/encoding/vparquet4/create_test.go101// require.NoError(t, err)COMMENT
LOWtempodb/encoding/vparquet4/create_test.go121// }COMMENT
LOWtempodb/encoding/vparquet4/block_traceql.go1521// -------------COMMENT
LOWtempodb/encoding/vparquet4/block_traceql.go1541// | ------------- |COMMENT
LOWtempodb/encoding/vparquet4/block_traceql.go1561// V V V V V VCOMMENT
LOWtempodb/encoding/vparquet4/block_traceql.go1581// Scope column iterator N --------------------------------- | | | | |COMMENT
LOWtempodb/encoding/vparquet4/block_traceql.go1601// | |COMMENT
LOWtempodb/encoding/vparquet4/block_traceql.go2781 }COMMENT
LOWtempodb/encoding/vparquet4/wal_block.go41// path + filename = folder to createCOMMENT
LOWtempodb/backend/azure/azure_test.go101 assert.Equal(t, tc.expectedHedgedRequests*2, atomic.LoadInt32(&count)) // *2 b/c reads execute a HEAD and GETCOMMENT
LOWtempodb/backend/azure/azure_test.go121COMMENT
LOWtempodb/blocklist/poller_test.go861// TestPollerDoSpanParenting verifies that the per-tenant spans started insideCOMMENT
LOWdocs/sources/tempo/configuration/_index.md181COMMENT
LOWdocs/sources/tempo/configuration/_index.md301 kafka:COMMENT
129 more matches not shown…
Decorative Section Separators8 hits · 24 pts
SeverityFileLineSnippetContext
MEDIUMexample/docker-compose/migrate-to-3/docker-compose.yaml21 # =========================================================================COMMENT
MEDIUMexample/docker-compose/migrate-to-3/docker-compose.yaml23 # =========================================================================COMMENT
MEDIUMexample/docker-compose/migrate-to-3/docker-compose.yaml88 # =========================================================================COMMENT
MEDIUMexample/docker-compose/migrate-to-3/docker-compose.yaml90 # =========================================================================COMMENT
MEDIUMexample/docker-compose/migrate-to-3/docker-compose.yaml158 # =========================================================================COMMENT
MEDIUMexample/docker-compose/migrate-to-3/docker-compose.yaml160 # =========================================================================COMMENT
MEDIUMmodules/generator/registry/cardinality.go15// ┌─────────────┐COMMENT
MEDIUMmodules/generator/registry/cardinality.go17// ┌─────┬─────┬─────┬─────┐COMMENT
Structural Annotation Overuse14 hits · 23 pts
SeverityFileLineSnippetContext
LOW.claude/skills/shared/release-notes-workflow.md38#### Step 1: Collect pending changelog entriesCOMMENT
LOW.claude/skills/shared/release-notes-workflow.md57#### Step 2: Identify known headline featuresCOMMENT
LOW.claude/skills/shared/release-notes-workflow.md72#### Step 3: AI-assisted sortingCOMMENT
LOW⚡.claude/skills/shared/release-notes-workflow.md119#### Step 4: Human reviewCOMMENT
LOW⚡.claude/skills/shared/release-notes-workflow.md129#### Step 5: Coordinate with the engineering teamCOMMENT
LOW⚡.claude/skills/shared/release-notes-workflow.md138#### Step 6: Produce the curated input, then stopCOMMENT
LOWmodules/distributor/forwarder/manager_test.go279 // Step 1 - Setup manager with two forwarders for tenant and verify that both forwarders receive the trace.COMMENT
LOWmodules/distributor/forwarder/manager_test.go325 // Step 2 - Add additional forwarder, simulate "tick" and verify that all three forwarders receive the trace.COMMENT
LOWmodules/distributor/forwarder/manager_test.go341 // Step 1 - Setup manager with three forwarders for tenant and verify that all three forwarders receive the trace.COMMENT
LOWmodules/distributor/forwarder/manager_test.go387 // Step 2 - Remove one forwarder, simulate "tick" and verify that remaining forwarders receive the trace.COMMENT
LOWmodules/distributor/forwarder/manager_test.go450 // Step 1 - Setup manager with no tenants and verify that no batches are being forwardedCOMMENT
LOWmodules/distributor/forwarder/manager_test.go487 // Step 2 - Add tenant to overrides config, simulate "tick", and verify that both forwarders receive the traces.COMMENT
LOWmodules/distributor/forwarder/manager_test.go506 // Step 1 - Setup manager with two forwarders for tenant and verify that both forwarders receive the trace.COMMENT
LOWmodules/distributor/forwarder/manager_test.go545 // Step 2 - Remove forwarder from overrides config and verify that the traces are no longer forwarded.COMMENT
Hallucination Indicators2 hits · 20 pts
SeverityFileLineSnippetContext
CRITICALcmd/tempo/app/config.go202 dcWarnings, dcErr := c.StorageConfig.Trace.Block.DedicatedColumns.Validate()CODE
CRITICALpkg/ingest/config_sasl_test.go557 require.Equal(t, map[string]string{"a": "b"}, cfg.SASL.Oauthbearer.Secret.Extensions.Read())CODE
AI Slop Vocabulary7 hits · 17 pts
SeverityFileLineSnippetContext
MEDIUMexample/docker-compose/debug/docker-compose.yaml13 - "2345:2345" # delve debug serverCODE
MEDIUMintegration/operations/config-tempo-query.yaml2backend: tempo:3200 # magically matches the name and port setup in the harness for a single binary deploymentCODE
MEDIUMtempodb/encoding/vparquet5/block_traceql.go1334 // no reason to try anything more nuanced than this. it will handle nearly all casesCOMMENT
MEDIUMtempodb/encoding/vparquet4/block_traceql.go1253 // no reason to try anything more nuanced than this. it will handle nearly all casesCOMMENT
MEDIUMmodules/generator/registry/histogram_test.go539// the registry must be robust to unsorted input.COMMENT
MEDIUMpkg/benchmark/compare/render/markdown/markdown_test.go26 require.Contains(t, md, "#### harness.wallNs · p50 per execution\n\nChange from base.\n\n")CODE
MEDIUMpkg/api/http.go789 qb.addParam("encoding", "none") // todo: remove. encoding was removed b/c its unused but we still add it here to make rCODE
Magic Placeholder Names2 hits · 10 pts
SeverityFileLineSnippetContext
HIGH.claude/skills/shared/handling-pr-content.md21**Placeholder catalog:** `<API_KEY>`, `<YOUR_TOKEN>`, `<PASSWORD>`, `user@example.com`, `https://<GRAFANA_INSTANCE>`, `<CODE
HIGH.claude/skills/docs-pr-write/evals/evals.json103 "Credentials and internal URLs are replaced with descriptive placeholders (for example, <API_KEY>, <YOUR_TOKEN>,CODE
Self-Referential Comments3 hits · 9 pts
SeverityFileLineSnippetContext
MEDIUMtools/packaging/tempo-postinstall.sh14 # Create the userCOMMENT
MEDIUMtools/chloggen/internal/config/config.yaml10# This file is used as the input for individual changelog entries.COMMENT
MEDIUM.github/zizmor.yml4# This file is copied from: https://github.com/grafana/shared-workflows/blob/main/.github/zizmor.ymlCOMMENT
Synthetic Comment Markers1 hit · 8 pts
SeverityFileLineSnippetContext
HIGHintegration/util/harness.go169// RunIntegrationTests sets up Tempo for integration tests as requested through the config and then calls the provided tCOMMENT
Slop Phrases2 hits · 6 pts
SeverityFileLineSnippetContext
MEDIUMtempodb/encoding/vparquet5/block_traceql_test.go80 // It's worth noting that float64 can have a fractional partCOMMENT
MEDIUMtempodb/encoding/vparquet4/block_traceql_test.go80 // It's worth noting that float64 can have a fractional partCOMMENT
Example Usage Blocks1 hit · 2 pts
SeverityFileLineSnippetContext
LOWintegration/util/harness.go290// Example usage:COMMENT
Fake / Example Data1 hit · 1 pts
SeverityFileLineSnippetContext
LOW…setup-tempo/deploy/kubernetes/operator/multitenancy.md86 name: 'admin@example.com'CODE