3.2

Adjusted Signal

3.2

Raw Pattern Score

100%

Time Factor

—

Last Push

—

Stars

—

Language

138.0K

Lines of Code

235

Files

428

Pattern Hits

2026-10-31

Scan Date

0.01

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 13.8/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 415 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.7/100 · LOW

Are imports declared and package/API names verified? 4 finding(s).

Agent Over-Engineering Ratio 0.5/100 · LOW

Are wrappers, guards, and repeated structures necessary? 9 finding(s).

PR Review Velocity Impact 15.1/100 · LOW

Which changes need focused human review? 428 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 1HIGH 2MEDIUM 2LOW 423

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 428 distinct pattern matches across 7 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block408 hits · 402 pts

Severity	File	Line	Snippet	Context
LOW	Cargo.toml	41	chrono = { version = "0.4", default-features = false, features = ["clock", "serde"] }	COMMENT
LOW	build.rs	1	//! Build script for `hydradb`.	COMMENT
LOW	crates/cypher-parser-antlr/src/lib.rs	1	//! A pure-Rust ANTLR Cypher 25 frontend generated from Neo4j's current grammar.	COMMENT
LOW	crates/cypher-ast/src/failure.rs	1	/// Why a query could not run, at the granularity a metric label can carry.	COMMENT
LOW	crates/cypher-ast/src/failure.rs	21	/// `WHERE` predicates and the operators inside them.	COMMENT
LOW	crates/telemetry/Cargo.toml	1	[package]	COMMENT
LOW	crates/telemetry/build.rs	1	//! Build script for `hydradb-telemetry`.	COMMENT
LOW	crates/telemetry/build.rs	21	//! would quietly stamp `unknown` into precisely the builds that matter. Getting	COMMENT
LOW	crates/telemetry/examples/smoke.rs	1	//! Prints a few lines through a real, globally installed subscriber.	COMMENT
LOW	crates/telemetry/src/bridge.rs	1	//! Turning the active span into a W3C `traceparent`, and back.	COMMENT
LOW	crates/telemetry/src/bridge.rs	61	///	COMMENT
LOW	crates/telemetry/src/bridge.rs	81	/// The obvious implementation is [`current_traceparent`]'s — take	COMMENT
LOW	crates/telemetry/src/bridge.rs	121	/// Make `span` a child of the remote trace named by `traceparent`.	COMMENT
LOW	crates/telemetry/src/config.rs	1	//! Service identity and the environment-driven configuration.	COMMENT
LOW	crates/telemetry/src/config.rs	81	/// which is what makes the resolution rules below testable without an	COMMENT
LOW	crates/telemetry/src/config.rs	101	/// stdout JSON lines are collected by the Vector DaemonSet, which parses	COMMENT
LOW	crates/telemetry/src/config.rs	121	/// the bare `CARGO_PKG_VERSION`. That single substitution is what puts the	COMMENT
LOW	crates/telemetry/src/lib.rs	1	//! Telemetry for the HydraDB binaries: one subscriber, two service	COMMENT
LOW	crates/telemetry/src/lib.rs	21	//!	COMMENT
LOW	crates/telemetry/src/lib.rs	41	//! \| [`semconv`] \| the attribute registry, and which keys may be metric labels \|	COMMENT
LOW	crates/telemetry/src/lib.rs	61	//! conflict with concurrent edits to the root manifest. Three steps, all in the	COMMENT
LOW	crates/telemetry/src/lib.rs	101	pub use propagate::{TraceContext, TraceContextError};	COMMENT
LOW	crates/telemetry/src/lib.rs	121	/// The directives as given.	COMMENT
LOW	crates/telemetry/src/lib.rs	141	#[cfg(feature = "otlp")]	COMMENT
LOW	crates/telemetry/src/lib.rs	161	/// accessor rather than a call to `opentelemetry::global::set_meter_provider`	COMMENT
LOW	crates/telemetry/src/lib.rs	181	/// providers through the installed subscriber, so nothing has to name them.	COMMENT
LOW	crates/telemetry/src/meter.rs	1	//! The meter side of the pipeline: observable instruments fed from cached	COMMENT
LOW	crates/telemetry/src/meter.rs	21	//! histograms it has only the synchronous `f64_histogram` and	COMMENT
LOW	crates/telemetry/src/meter.rs	41	//!	COMMENT
LOW	crates/telemetry/src/meter.rs	81	///	COMMENT
LOW	crates/telemetry/src/meter.rs	141	/// One-line description, exported as the instrument description.	COMMENT
LOW	crates/telemetry/src/meter.rs	181	name: &'static str,	COMMENT
LOW	crates/telemetry/src/meter.rs	221		COMMENT
LOW	crates/telemetry/src/meter.rs	241	/// Deliberately its own type rather than a share of [`HistogramError`]: a counter	COMMENT
LOW	crates/telemetry/src/meter.rs	261	/// it is not part of, and after a collector's Prometheus conversion it would	COMMENT
LOW	crates/telemetry/src/meter.rs	281	///	COMMENT
LOW	crates/telemetry/src/meter.rs	301	pub struct ObservableCounter {	COMMENT
LOW	crates/telemetry/src/meter.rs	441	/// `SdkMeterProvider` and a collector to find out whether the buckets are	COMMENT
LOW	crates/telemetry/src/meter.rs	461	/// and produce a spurious `rate()` spike — but it does mean a shard that closes	COMMENT
LOW	crates/telemetry/src/meter.rs	601	/// The cardinality of one instrument family is `series_count() ×	COMMENT
LOW	crates/telemetry/src/otlp.rs	1	//! OTLP exporter wiring: the resource, the three providers, and the redaction	COMMENT
LOW	crates/telemetry/src/otlp.rs	21	//! Vector lifts those two fields into the OTLP `logRecord`.	COMMENT
LOW	crates/telemetry/src/otlp.rs	61	/// explicitly: batched spans and logs still sitting in a queue at exit are	COMMENT
LOW	crates/telemetry/src/error_class.rs	1	//! The coarse failure vocabulary carried as `error.class`.	COMMENT
LOW	crates/telemetry/src/error_class.rs	21		COMMENT
LOW	crates/telemetry/src/error_class.rs	41	/// Epoch and snapshot disagreements — the BFG-007 / BFG-009 / BFG-011	COMMENT
LOW	crates/telemetry/src/error_class.rs	121		COMMENT
LOW	crates/telemetry/src/semconv.rs	1	//! The `hydradb.*` attribute registry.	COMMENT
LOW	crates/telemetry/src/semconv.rs	21	//! set is closed — [`KERNEL`], [`OUTCOME`], [`PLACEMENT_OWNERSHIP`],	COMMENT
LOW	crates/telemetry/src/semconv.rs	41	//! [`NODE_ID`] is the one genuine judgement call. It is bounded by fleet size,	COMMENT
LOW	crates/telemetry/src/semconv.rs	121		COMMENT
LOW	crates/telemetry/src/semconv.rs	141	/// and only as text inside a `NotCellWriter` display — so "how often does a	COMMENT
LOW	crates/telemetry/src/semconv.rs	161	/// under `owner` and a three-address one under `fleet`, and nothing on the span	COMMENT
LOW	crates/telemetry/src/semconv.rs	181	/// else does: the query fingerprint says which statement, and only this says	COMMENT
LOW	crates/telemetry/src/semconv.rs	201	/// from Bolt `tx_metadata` under the same rules as [`CORRELATION_ID`].	COMMENT
LOW	crates/telemetry/src/semconv.rs	221	///	COMMENT
LOW	crates/telemetry/src/semconv.rs	241	/// instead of forcing every alarm through one policy.	COMMENT
LOW	crates/telemetry/src/semconv.rs	261	pub const DB_SYSTEM_NAME: &str = "db.system.name";	COMMENT
LOW	crates/telemetry/src/semconv.rs	281	/// into exactly two distributions at the recording site. It is deliberately	COMMENT
LOW	crates/telemetry/src/semconv.rs	301	/// `histogram_quantile` works unchanged. See [`crate::meter`].	COMMENT
348 more matches not shown…

Excessive Try-Catch Wrapping8 hits · 10 pts

Severity	File	Line	Snippet	Context
LOW	scripts/cypher_engine_ab_client.py	317	except Exception as exc: # public protocol failures are comparison output	CODE
LOW	scripts/cypher_engine_ab_client.py	368	except Exception as exc: # public protocol failures are comparison output	CODE
LOW	scripts/multinode_k3s_client.py	331	except Exception as error: # noqa: BLE001 - test must collect every worker failure	CODE
LOW	scripts/multinode_k3s_client.py	349	except Exception as error: # noqa: BLE001	CODE
LOW	scripts/multinode_k3s_client.py	488	except Exception as error: # noqa: BLE001 - the test asserts the server boundary	CODE
LOW	scripts/multinode_k3s_client.py	541	except Exception: # noqa: BLE001 - any lost response is explicitly retried	CODE
MEDIUM	scripts/multinode_k3s_client.py	320	def reader(index):	CODE
MEDIUM	scripts/multinode_k3s_client.py	334	def writer():	CODE

Hallucination Indicators1 hit · 10 pts

Severity	File	Line	Snippet	Context
CRITICAL	src/client/bolt.rs	1787	let scope = pending.prepared.request.target.scope.clone();	CODE

Cross-Language Confusion1 hit · 8 pts

Severity	File	Line	Snippet	Context
HIGH	scripts/cypher_engine_ab_client.py	438	# Duplicate sort keys, a missing residual property (null), and a	COMMENT

Deep Nesting7 hits · 7 pts

Severity	File	Line	Context
LOW	scripts/multinode_k3s_client.py	193	CODE
LOW	scripts/multinode_k3s_client.py	316	CODE
LOW	scripts/multinode_k3s_client.py	498	CODE
LOW	scripts/multinode_k3s_client.py	576	CODE
LOW	scripts/multinode_k3s_client.py	320	CODE
LOW	scripts/multinode_k3s_client.py	334	CODE
LOW	scripts/bolt_graphblas_client.py	135	CODE

Empty Error Handlers1 hit · 5 pts

Severity	File	Line	Snippet	Context
HIGH	scripts/cypher_engine_ab_client.py	592	except AssertionError:	CODE

Unused Imports2 hits · 2 pts

Severity	File	Line	Snippet	Context
LOW	scripts/cypher_engine_ab_client.py	9		CODE
LOW	scripts/bolt_graphblas_client.py	4		CODE

hydra-db/hydradb

Open-Source Code Quality, Security and Technical Debt Review