This report summarizes scanner evidence for nicholas-ochoa/OpenSC2K. SynthScan examined 136,042 lines of code across 555 source files, recording 98 pattern matches distributed across 5 syntactic categories. The legacy adjusted pattern signal is 0.9 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 95 finding(s).
Are imports declared and package/API names verified? 2 finding(s).
Are wrappers, guards, and repeated structures necessary? 47 finding(s).
Which changes need focused human review? 98 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 98 distinct pattern matches across 5 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | tools/test_validation_runner.py | 183 | def test_registry_covers_every_script(self): | CODE |
| LOW⚡ | tools/test_validation_runner.py | 187 | def test_domains_keep_core_cases_and_history_dependency(self): | CODE |
| LOW⚡ | tools/test_validation_runner.py | 197 | def test_headless_selects_full_workflow_once(self): | CODE |
| LOW⚡ | tools/test_validation_runner.py | 203 | def test_headless_excludes_native_only_checks(self): | CODE |
| LOW⚡ | tools/test_validation_runner.py | 212 | def test_missing_and_unregistered_files_fail(self): | CODE |
| LOW | tools/test_validation_runner.py | 27 | def test_fresh_projects_share_the_import_cache(self): | CODE |
| LOW | tools/test_validation_runner.py | 45 | def test_parallel_bound_and_failure_drain(self): | CODE |
| LOW | tools/test_validation_runner.py | 77 | def test_groups_preserve_native_and_persistence_order_without_losing_checks(self): | CODE |
| LOW | tools/test_validation_runner.py | 91 | def test_scene_batch_rejects_incomplete_and_shutdown_failures(self): | CODE |
| LOW | tools/test_validation_runner.py | 112 | def test_scene_cases_share_process_and_clean_up(self): | CODE |
| LOW | tools/test_validation_runner.py | 138 | def test_scene_case_failure_skip_and_timeout(self): | CODE |
| LOW | tools/test_validation_runner.py | 166 | def test_progress_watchdog_resets_for_each_case_and_stops_blocked_process(self): | CODE |
| LOW | tools/test_validation_runner.py | 227 | def test_script_error_and_timeout_cannot_pass(self): | CODE |
| LOW | tools/test_validation_runner.py | 236 | def test_interleaved_engine_error_cannot_pass(self): | CODE |
| LOW | tools/test_validation_runner.py | 248 | def test_split_error_is_detected_during_read_and_exit_drain(self): | CODE |
| LOW | tools/test_validation_runner.py | 283 | def test_skip_is_reported_separately(self): | CODE |
| LOW | tools/test_validation_runner.py | 292 | def test_console_streams_before_exit_and_can_also_save_logs(self): | CODE |
| LOW | tools/test_validation_runner.py | 319 | def test_default_run_does_not_create_log_directory(self): | CODE |
| LOW | tools/test_validation_runner.py | 334 | def test_release_rejects_missing_prerequisite(self): | CODE |
| LOW | tools/test_validation_runner.py | 347 | def test_strict_rejects_missing_tools_and_runtime_skips(self): | CODE |
| LOW | tools/test_validation_runner.py | 358 | def test_committed_city_fixture_hashes(self): | CODE |
| LOW | tools/test_validation_runner.py | 378 | def test_isolated_user_data_matches_godot(self): | CODE |
| LOW | tools/test_graphics_tools.py | 15 | def test_palette_padding_preserves_encoded_indices(self): | CODE |
| LOW⚡ | tools/test_release_automation.py | 71 | def test_range_includes_branch_and_merge_but_excludes_base_and_later_commits(self): | CODE |
| LOW⚡ | tools/test_release_automation.py | 79 | def test_first_release_includes_all_ancestors(self): | CODE |
| LOW⚡ | tools/test_release_automation.py | 85 | def test_no_new_commits_produces_empty_list(self): | CODE |
| LOW⚡ | tools/test_release_automation.py | 88 | def test_missing_tag_or_shallow_history_fails_instead_of_omitting_commits(self): | CODE |
| LOW⚡ | tools/test_release_automation.py | 96 | def test_publish_uses_last_published_stable_release_and_exact_build_commit(self): | CODE |
| LOW⚡ | tools/test_release_automation.py | 188 | def test_missing_nightly_tag_is_not_deleted(self): | CODE |
| LOW⚡ | tools/test_release_automation.py | 194 | def test_upload_failure_preserves_previous_release(self): | CODE |
| LOW⚡ | tools/test_release_automation.py | 204 | def test_failed_draft_is_removed_without_deleting_a_missing_tag(self): | CODE |
| LOW⚡ | tools/test_release_automation.py | 211 | def test_remote_hash_mismatch_prevents_publish_and_cleanup(self): | CODE |
| LOW⚡ | tools/test_release_automation.py | 218 | def test_invalid_package_or_commit_never_contacts_github(self): | CODE |
| LOW⚡ | tools/test_release_automation.py | 227 | def test_cleanup_requires_nightly_tag_prerelease_and_workflow_marker(self): | CODE |
| LOW⚡ | tools/test_release_automation.py | 234 | def test_out_of_order_run_does_not_replace_newer_nightly(self): | CODE |
| LOW⚡ | tools/test_release_automation.py | 242 | def test_portable_zip_adds_empty_data_folder(self): | CODE |
| LOW | tools/test_release_automation.py | 170 | def test_publish_verifies_upload_then_replaces_the_single_nightly_tag(self): | CODE |
| LOW | tools/test_release_automation.py | 255 | def test_only_linux_packages_include_the_soundfont_and_its_license(self): | CODE |
| LOW | tools/test_release_automation.py | 307 | def test_disk_image_keeps_the_volume_name_with_either_tool(self): | CODE |
| LOW | tools/test_release_automation.py | 316 | def test_busy_disk_image_is_retried_then_fails(self): | CODE |
| LOW | tools/test_release_automation.py | 334 | def test_lost_stapler_connection_is_retried_then_fails(self): | CODE |
| LOW | tools/test_release_automation.py | 349 | def test_notary_credentials_come_from_a_profile_or_a_complete_api_key(self): | CODE |
| LOW | tools/test_release_automation.py | 362 | def test_identity_is_found_by_name_or_hash(self): | CODE |
| LOW | tools/test_release_automation.py | 368 | def test_signing_settings_that_cannot_notarize_fail_before_the_export(self): | CODE |
| LOW | tools/test_release_automation.py | 385 | def test_install_copies_both_extensions_for_every_platform(self): | CODE |
| LOW | tools/test_release_automation.py | 422 | def test_platform_selection_takes_package_or_native_folder_names(self): | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/setup_macos_signing_ci.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | native/core/scripting/quickjs/libregexp.c | 61 | //#define DUMP_REOP | COMMENT |
| LOW | native/core/scripting/quickjs/dtoa.c | 21 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN | COMMENT |
| LOW | native/core/scripting/quickjs/quickjs-c-atomics.h | 21 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN | COMMENT |
| LOW | native/core/scripting/quickjs/quickjs-c-atomics.h | 41 | #define atomic_store(obj, desired) \ | COMMENT |
| LOW | native/core/scripting/quickjs/libregexp.h | 21 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN | COMMENT |
| LOW | native/core/scripting/quickjs/quickjs.h | 61 | */ | COMMENT |
| LOW | native/core/scripting/quickjs/quickjs.h | 101 | * | COMMENT |
| LOW | native/core/scripting/quickjs/quickjs.h | 121 | /* Clang on Windows doesn't seem to support _Printf_format_string_ */ | COMMENT |
| LOW | native/core/scripting/quickjs/quickjs.h | 141 | */ | COMMENT |
| LOW | native/core/scripting/quickjs/quickjs.h | 201 | COMMENT | |
| LOW | native/core/scripting/quickjs/quickjs.h | 221 | // - a function returning a JSValueConst does *not* transfer ownership; | COMMENT |
| LOW | native/core/scripting/quickjs/quickjs.h | 401 | #define JS_NULL JS_MKVAL(JS_TAG_NULL, 0) | COMMENT |
| LOW | native/core/scripting/quickjs/quickjs.h | 421 | #define JS_PROP_HAS_SHIFT 8 | COMMENT |
| LOW | native/core/scripting/quickjs/quickjs.h | 441 | #ifndef JS_DEFAULT_STACK_SIZE | COMMENT |
| LOW | native/core/scripting/quickjs/quickjs.h | 481 | #define JS_DUMP_BYTECODE_PASS2 0x02 /* dump pass 2 code */ | COMMENT |
| LOW | native/core/scripting/quickjs/quickjs.h | 1401 | #define JS_DEF_CFUNC 0 | COMMENT |
| LOW | native/core/scripting/quickjs/quickjs.h | 1421 | #define JS_CGETSET_DEF2(name, fgetter, fsetter, prop_flags) { name, prop_flags, JS_DEF_CGETSET, 0, { .getset = { .get = | COMMENT |
| LOW | native/core/scripting/quickjs/cutils.h | 21 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, | COMMENT |
| LOW | native/core/scripting/quickjs/cutils.h | 41 | #include <inttypes.h> | COMMENT |
| LOW | native/core/scripting/quickjs/cutils.h | 61 | #include <windows.h> | COMMENT |
| LOW | native/core/scripting/quickjs/cutils.h | 81 | # define __maybe_unused | COMMENT |
| LOW | native/core/scripting/quickjs/cutils.h | 101 | /* return the pointer of type 'type *' containing 'ptr' as field 'member' */ | COMMENT |
| LOW | native/core/scripting/quickjs/cutils.h | 121 | #define JS_PRINTF_FORMAT_ATTR(format_param, dots_param) \ | COMMENT |
| LOW | native/core/scripting/src/sandbox/mod.rs | 1 | //! The folder of a mod. A mod script can read and write files only in its | COMMENT |
| LOW | native/core/audio/src/sound_loop.rs | 1 | //! The disaster sound loop of SIMCITY.EXE 0x00480480 and 0x0047fda0. One | COMMENT |
| LOW | native/core/sim/src/lib.rs | 1 | //! The SimCity 2000 simulation of OpenSC2K. | COMMENT |
| LOW | native/core/sim/src/formats/sc2kfix.rs | 1 | //! The SC2X save format of the sc2kfix plugin (version 1), internally called | COMMENT |
| LOW | native/core/sim/src/formats/sc2x/project.rs | 1 | //! Projection between the runtime working layout and the version 4 structures. | COMMENT |
| LOW | native/core/sim/src/sim/overlay.rs | 1 | //! XTXT links, as OverlayData. Original IDs are unchanged. SC2X v2 adds | COMMENT |
| LOW | native/core/sim/src/sim/economy/city_value.rs | 1 | //! The city value, as CityValuePhase. The network values and most building | COMMENT |
| LOW | native/core/sim/src/sim/data_maps/mod.rs | 21 | pub const ZONE_BUILDING_ORIGIN: i64 = 0x80; | COMMENT |
| LOW | native/simulation/src/bridge/city_cache.rs | 1 | //! Native city copies by handle. A cache keeps the chunks of one city between | COMMENT |
| LOW | native/rendering/src/bridge/changes.rs | 1 | //! Changed screen areas between two revisions of the region source chunks. | COMMENT |
| LOW | examples/mods/monthly-report/main.js | 1 | // Monthly report: writes each month that the City Statistics mod records to | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | native/core/sim/src/sim/economy/budget.rs | 281 | for (label, value) in settlement.base.timing.steps.0.iter() { | CODE |
| CRITICAL | native/core/sim/src/sim/data_maps/native.rs | 77 | for (name, value) in result.base.timing.steps.0.iter() { | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/build_desktop_release.py | 324 | CODE | |
| LOW | tools/test_validation_runner.py | 27 | CODE | |
| LOW | tools/test_validation_runner.py | 248 | CODE | |
| LOW | tools/validate_project.py | 181 | CODE | |
| LOW | tools/validate_project.py | 225 | CODE | |
| LOW | tools/validate_project.py | 287 | CODE | |
| LOW | tools/validate_project.py | 308 | CODE | |
| LOW | tools/validate_project.py | 415 | CODE | |
| LOW | tools/profile_resources.py | 19 | CODE | |
| LOW | tools/paint_icon.py | 484 | CODE | |
| LOW | tools/paint_icon.py | 526 | CODE | |
| LOW | tools/paint_icon.py | 648 | CODE | |
| LOW | tools/test_benchmark_failures.py | 9 | CODE | |
| LOW | tools/run_godot_check.py | 16 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tools/run_godot_check.py | 35 | except (OSError, ValueError, KeyError): | CODE |