AI Slop Code Risk Monitor

pollen-robotics/microduck

SlopCodeMonitor badge for pollen-robotics/microduck Adjusted legacy signal; badge bands: 25 / 50 / 75 (different from dashboard bands).
9.6 Moderate pattern signal View on GitHub

Open-Source Code Quality, Security and Technical Debt Review

This report summarizes scanner evidence for pollen-robotics/microduck. SynthScan examined 195,349 lines of code across 391 source files, recording 1625 pattern matches distributed across 13 syntactic categories. The legacy adjusted pattern signal is 9.6 (Moderate pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

9.6
Adjusted Signal
9.6
Raw Pattern Score
100%
Time Factor
—
Last Push
—
Stars
—
Language
195.3K
Lines of Code
391
Files
1.6K
Pattern Hits
2026-10-31
Scan Date
0.01
HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 25.9/100 · MEDIUM

Can maintainers explain intent, assumptions, and trade-offs? 1365 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.6/100 · LOW

Are imports declared and package/API names verified? 20 finding(s).

Agent Over-Engineering Ratio 16.2/100 · LOW

Are wrappers, guards, and repeated structures necessary? 246 finding(s).

PR Review Velocity Impact 41.6/100 · MEDIUM

Which changes need focused human review? 1625 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

Run additional scans to build a history of the legacy pattern signal. Score changes are not a measure of AI adoption or code quality.

No multi-scan history yet — run the scanner again to build trend data.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 5MEDIUM 225LOW 1395

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 1625 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block1349 hits · 1144 pts
SeverityFileLineSnippetContext
LOWCargo.toml1# Workspace root for the robot daemon.COMMENT
LOWCargo.toml21default-members = ["btd", "configd", "duck-ble", "duck-ble", "duck-control", "duck-detect", "duck-ipc-proto", "kinematicCOMMENT
LOWCargo.toml41[workspace.metadata.rknpu]COMMENT
LOWCargo.toml61# The duck detector, the same way: trained in pollen-robotics/duck_detector, published on the Hub,COMMENT
LOWbtd/Cargo.toml21serde_json.workspace = trueCOMMENT
LOWbtd/src/session.rs1//! One connected central, from `hello` to disconnect.COMMENT
LOWbtd/src/route.rs1//! Which calls BLE may make, and which of a service's connections carries them.COMMENT
LOWbtd/src/route.rs21use duck_ipc_proto as proto;COMMENT
LOWbtd/src/route.rs81COMMENT
LOWbtd/src/route.rs101 // question an owner whose update failed actually has. Bigger than every other reply hereCOMMENT
LOWbtd/src/route.rs121 //COMMENT
LOWbtd/src/route.rs141 // The owner's switch for anonymous usage data. The phone is where an owner looks for aCOMMENT
LOWbtd/src/route.rs161 // stronger flag be satisfied if it were set: the agent leaves every handler `None`, whichCOMMENT
LOWbtd/src/route.rs181 SystemServices => true,COMMENT
LOWbtd/src/route.rs201COMMENT
LOWbtd/src/route.rs221 // ── refused ─────────────────────────────────────────────────────────COMMENT
LOWbtd/src/route.rs241 // `updaterd`'s private questions to `robotd` — may I restart the control loop, whichCOMMENT
LOWbtd/src/route.rs261 // robot up is the *first* of the two things the gamepad's Start button does; the secondCOMMENT
LOWbtd/src/route.rs281 // phone that can send this is in the room with the robot by construction. It is also theCOMMENT
LOWbtd/src/route.rs301 // refusal either way, and the same reason to lift it — an app that can play the duck.COMMENT
LOWbtd/src/route.rs321 // Switching modes means the robot goes home, loads other policies and drives differentlyCOMMENT
LOWbtd/src/route.rs341 // words with different durability depending on who asked — the ephemeral "try it untilCOMMENT
LOWbtd/src/route.rs361 // in the policy path that only a terminal on the robot could reach — `[[policy.skill]]`COMMENT
LOWbtd/src/route.rs381 RobotVetbook | RobotVetbookNote(_) => true,COMMENT
LOWbtd/src/route.rs401 //COMMENT
LOWbtd/src/route.rs421 // `remote-webrtc.md` §4 gives about BLE generally: it is PIN-bonded, and ten metres ofCOMMENT
LOWbtd/src/route.rs441 // Daemon-to-daemon: how `mediad` and `tofd` report to the book. Nothing a phone sends.COMMENT
LOWbtd/src/route.rs461 // latch and `init` argues with it rather than winning. A client that has those does notCOMMENT
LOWbtd/src/route.rs481 // The hazard is real for the robot that *is* standing, and it is the one the app isCOMMENT
LOWbtd/src/route.rs501 // `robot.stop` deserves its own line, because refusing it looks wrong. An emergency stopCOMMENT
LOWbtd/src/route.rs521 // It is also not `btd`'s to forward: `padd` is deliberately not one of the sockets `btd`COMMENT
LOWbtd/src/route.rs581#[cfg(test)]COMMENT
LOWbtd/src/lib.rs1//! `btd` — the BLE front door onto the robot's API.COMMENT
LOWbtd/src/lib.rs21//!COMMENT
LOWbtd/src/link.rs1//! The seam between the radio and everything worth testing.COMMENT
LOWbtd/src/link.rs21/// Sized so that a **maximal inbound line never has to block**, which is a correctnessCOMMENT
LOWbtd/src/link.rs41 pub outbound: mpsc::Sender<Vec<u8>>,COMMENT
LOWbtd/src/pairing.rs1//! Who is allowed to talk to this robot over BLE.COMMENT
LOWbtd/src/pairing.rs21//! Pairing is just-works (all agent handlers `None`, which BlueZ reads as `NoInputNoOutput`), soCOMMENT
LOWbtd/src/pairing.rs41//!COMMENT
LOWbtd/src/pairing.rs61//! `updater-design.md` §5.7's per-device state.COMMENT
LOWbtd/src/main.rs21 /// `updaterd`'s socket.COMMENT
LOWbtd/src/main.rs41 /// pre-shipping development tooling and the usable one wins. The cost is real and unhedged:COMMENT
LOWbtd/src/main.rs81/// reordered chunk does not fail — it reassembles into something that parses as the wrong thing.COMMENT
LOWbtd/src/bluez.rs1//! The radio. BlueZ via `bluetoothd`'s D-Bus API, Linux only.COMMENT
LOWbtd/src/bluez.rs21//! bytes into it.COMMENT
LOWbtd/src/bluez.rs61/// **This is the only backpressure the callback model offers, and it has to exist.**COMMENT
LOWbtd/src/bluez.rs81/// A `notify` that fails while the session is *not* stopped is a queue that is momentarily full,COMMENT
LOWbtd/src/bluez.rs101/// identified the interval from the arrivals rather than from a guess.COMMENT
LOWbtd/src/bluez.rs141/// so this is generous enough to survive a loaded board rather than tuned for a spinner.COMMENT
LOWbtd/src/bluez.rs161/// `configd` would be the tidier answer and is a protocol change nobody needs yet.COMMENT
LOWbtd/src/bluez.rs181/// would multiply the traffic to `configd` by five to buy nothing it answers.COMMENT
LOWbtd/src/bluez.rs201/// Waiting for an adapter to *appear* was never enough. Everything after that wait — powering theCOMMENT
LOWbtd/src/bluez.rs261 adapter.set_powered(true).await?;COMMENT
LOWbtd/src/bluez.rs361 // wrong: a client that vanishes mid-request leaves a partial line in the reassembler andCOMMENT
LOWbtd/src/bluez.rs421 // acknowledgement per chunk. A client that wants a *refusal* to be visibleCOMMENT
LOWbtd/src/bluez.rs561 },COMMENT
LOWbtd/src/bluez.rs641 &current,COMMENT
LOWbtd/src/bluez.rs681 retries = NOTIFY_RETRIES,COMMENT
LOWbtd/src/bluez.rs721///COMMENT
1289 more matches not shown…
Decorative Section Separators220 hits · 645 pts
SeverityFileLineSnippetContext
MEDIUMbtd/src/route.rs86 // ── the update subset §4.1 names ────────────────────────────────────COMMENT
MEDIUMbtd/src/route.rs148 // ── provisioning, which is what §4.1 puts BLE here for ──────────────COMMENT
MEDIUMbtd/src/route.rs207 // ── the gamepad ─────────────────────────────────────────────────────COMMENT
MEDIUMbtd/src/route.rs221 // ── refused ─────────────────────────────────────────────────────────COMMENT
MEDIUMbtd/src/route.rs417 // ── the account, which BLE is the right transport for ────────────────COMMENT
MEDIUMduck-control/src/model.rs157// ── battery ──────────────────────────────────────────────────────────────────COMMENT
MEDIUMdeploy/robotd.toml605# ── Controller-IMU head control ─────────────────────────────────────────────────────────────COMMENT
MEDIUMdeploy/robotd.toml624# ── Pad walking speeds ──────────────────────────────────────────────────────────────────────COMMENT
MEDIUMdeploy/robotd.toml642# ── Pad joystick axes ──────────────────────────────────────────────────────────────────────COMMENT
MEDIUMdeploy/robotd.toml680# ── Pad over UDP ────────────────────────────────────────────────────────────────────────────COMMENT
MEDIUMdeploy/updater.toml84# ── daemon ────────────────────────────────────────────────────────────────────COMMENT
MEDIUMdeploy/updater.toml182# ── models ────────────────────────────────────────────────────────────────────COMMENT
MEDIUMrobotd/tests/updater_gate.rs25// ── locating and running the real robotd ─────────────────────────────────────COMMENT
MEDIUMrobotd/tests/updater_gate.rs150// ── fixture ──────────────────────────────────────────────────────────────────COMMENT
MEDIUMrobotd/tests/updater_gate.rs247// ── the wire ─────────────────────────────────────────────────────────────────COMMENT
MEDIUMrobotd/tests/updater_gate.rs357// ── the M1 done-test ─────────────────────────────────────────────────────────COMMENT
MEDIUMrobotd/tests/updater_gate.rs437// ── version reporting over the wire ──────────────────────────────────────────COMMENT
MEDIUMrobotd/src/main.rs8277 // ── the policy channel ───────────────────────────────────────────────COMMENT
MEDIUMspaces/vetbook/traits.py54# ── mood ─────────────────────────────────────────────────────────────────────COMMENT
MEDIUMspaces/vetbook/traits.py94# ── badges ───────────────────────────────────────────────────────────────────COMMENT
MEDIUMspaces/vetbook/traits.py142# ── fun facts ────────────────────────────────────────────────────────────────COMMENT
MEDIUMspaces/vetbook/traits.py196# ── personality and star sign ────────────────────────────────────────────────COMMENT
MEDIUMspaces/vetbook/traits.py232# ── palette and season ───────────────────────────────────────────────────────COMMENT
MEDIUMspaces/vetbook/traits.py256# ── a football card ──────────────────────────────────────────────────────────COMMENT
MEDIUMspaces/shared/wire.py103 # ── the surface `app.py` uses ────────────────────────────────────────────COMMENT
MEDIUMspaces/shared/wire.py196 # ── the wire ────────────────────────────────────────────────────────────COMMENT
MEDIUMspaces/shared/wire.py344 # ── checking the lane against the real rendezvous and a real duck ─────────COMMENT
MEDIUMspaces/policy-playground/web/src/main.ts111// ── talking to the duck ──────────────────────────────────────────────────────COMMENT
MEDIUMspaces/policy-playground/web/src/main.ts426// ── the page ─────────────────────────────────────────────────────────────────COMMENT
MEDIUMspaces/vision-demo/wire.py103 # ── the surface `app.py` uses ────────────────────────────────────────────COMMENT
MEDIUMspaces/vision-demo/wire.py196 # ── the wire ────────────────────────────────────────────────────────────COMMENT
MEDIUMspaces/vision-demo/wire.py344 # ── checking the lane against the real rendezvous and a real duck ─────────COMMENT
MEDIUMpad-imu/src/lib.rs308// ── quaternion arithmetic, w first ───────────────────────────────────────────────────────COMMENT
MEDIUMupdater/updater.example.toml101# ── daemon ────────────────────────────────────────────────────────────────────COMMENT
MEDIUMupdater/updater.example.toml154# ── models ────────────────────────────────────────────────────────────────────COMMENT
MEDIUMupdater/updater.example.toml206# ── local (dev / CI) ──────────────────────────────────────────────────────────COMMENT
MEDIUMupdater/tests/ipc.rs29// ── fixture ──────────────────────────────────────────────────────────────────COMMENT
MEDIUMupdater/tests/ipc.rs307// ── tests ────────────────────────────────────────────────────────────────────COMMENT
MEDIUMupdater/tests/ipc.rs689// ── scheduled checks (§8.1) ──────────────────────────────────────────────────COMMENT
MEDIUMupdater/tests/ipc.rs1006// ── peer credential enforcement ──────────────────────────────────────────────COMMENT
MEDIUMupdater/tests/ipc.rs1149// ── account.* ────────────────────────────────────────────────────────────────COMMENT
MEDIUMupdater/tests/apply.rs23// ── fixture ──────────────────────────────────────────────────────────────────COMMENT
MEDIUMupdater/tests/apply.rs403// ── happy path ───────────────────────────────────────────────────────────────COMMENT
MEDIUMupdater/tests/apply.rs884// ── refusals: nothing changes ────────────────────────────────────────────────COMMENT
MEDIUMupdater/tests/apply.rs1081// ── rollback ─────────────────────────────────────────────────────────────────COMMENT
MEDIUMupdater/tests/apply.rs1292// ── crash recovery ───────────────────────────────────────────────────────────COMMENT
MEDIUMupdater/tests/apply.rs1495// ── explicit transitions ─────────────────────────────────────────────────────COMMENT
MEDIUMupdater/tests/apply.rs1634// ── bookkeeping ──────────────────────────────────────────────────────────────COMMENT
MEDIUMupdater/tests/apply.rs1796// ── regressions ──────────────────────────────────────────────────────────────COMMENT
MEDIUMupdater/tests/apply.rs2326// ── §16.2 Tier-1 gaps closed ────────────────────────────────────────────────COMMENT
MEDIUMupdater/tests/apply.rs2623// ── installing by ref (the dev channel, `docs/project/roadmap.md` M2) ────────────────COMMENT
MEDIUMupdater/tests/apply.rs2736// ── installing from a directory on the board (`apply --from`) ────────────────────────COMMENT
MEDIUMupdater/tests/apply.rs2910// ── the run transcript ───────────────────────────────────────────────────────COMMENT
MEDIUMupdater/tests/install.rs189// ── the bootstrap ────────────────────────────────────────────────────────────COMMENT
MEDIUMupdater/src/policy.rs1103// ── the community library ────────────────────────────────────────────────────COMMENT
MEDIUMupdater/src/ipc.rs582 // ── read-only ────────────────────────────────────────────────────COMMENT
MEDIUMupdater/src/ipc.rs618 // ── mutating ─────────────────────────────────────────────────────COMMENT
MEDIUMupdater/src/ipc.rs707 // ── account.* ───────────────────────────────────────────────────────COMMENT
MEDIUMupdater/src/ipc.rs726 // ── telemetry.* ─────────────────────────────────────────────────────COMMENT
MEDIUMupdater/src/ipc.rs743 // ── os.* ────────────────────────────────────────────────────────────COMMENT
160 more matches not shown…
Empty Error Handlers4 hits · 20 pts
SeverityFileLineSnippetContext
HIGHspaces/shared/wire.py157except WireError:CODE
HIGHspaces/vision-demo/receiver.py295except WebSocketDisconnect:CODE
HIGHspaces/vision-demo/wire.py157except WireError:CODE
HIGHspaces/vision-demo/app.py97except Exception: # noqa: BLE001 - a logger that raises is worse than a line lostCODE
Unused Imports19 hits · 19 pts
SeverityFileLineSnippetContext
LOWspaces/vetbook/cards.py9CODE
LOWspaces/vetbook/app.py22CODE
LOWspaces/vetbook/traits.py7CODE
LOWspaces/vetbook/gallery.py13CODE
LOWspaces/shared/rendezvous.py29CODE
LOWspaces/shared/control.py21CODE
LOWspaces/shared/control.py23CODE
LOWspaces/shared/wire.py38CODE
LOWspaces/vision-demo/rendezvous.py29CODE
LOWspaces/vision-demo/boot.py13CODE
LOWspaces/vision-demo/control.py21CODE
LOWspaces/vision-demo/control.py23CODE
LOWspaces/vision-demo/receiver.py27CODE
LOWspaces/vision-demo/wire.py38CODE
LOWspaces/vision-demo/app.py29CODE
LOWspaces/vision-demo/app.py39CODE
LOWspaces/vision-demo/filters.py10CODE
LOWpet-detect/training/train.py21CODE
LOWscripts/endurance-plot.py21CODE
Excessive Try-Catch Wrapping9 hits · 9 pts
SeverityFileLineSnippetContext
LOWspaces/vetbook/app.py273 except Exception as e: # noqa: BLE001 — one odd book must not empty the galleryCODE
LOWspaces/vetbook/app.py294 except Exception as e: # noqa: BLE001 — the visitor's request will try againCODE
LOWspaces/shared/wire.py282 except Exception as e: # noqa: BLE001 - see below; a reader cannot pick its exceptionCODE
LOWspaces/vision-demo/boot.py24except Exception: # noqa: BLE001 - the whole point is that any failure becomes a pageCODE
LOWspaces/vision-demo/receiver.py119 except Exception as e: # noqa: BLE001 - a bad unit is not a bad streamCODE
LOWspaces/vision-demo/receiver.py297 except Exception as e: # noqa: BLE001 - one bad socket is not a bad SpaceCODE
LOWspaces/vision-demo/wire.py282 except Exception as e: # noqa: BLE001 - see below; a reader cannot pick its exceptionCODE
LOWspaces/vision-demo/app.py97 except Exception: # noqa: BLE001 - a logger that raises is worse than a line lostCODE
LOWspaces/vision-demo/app.py181 except Exception as e: # noqa: BLE001 - a teardown that fails still ends this sideCODE
Hyper-Verbose Identifiers6 hits · 8 pts
SeverityFileLineSnippetContext
LOWspaces/vetbook/test_traits.py20def test_moods_in_priority_order():CODE
LOW⚡spaces/vetbook/test_traits.py32def test_badges_rarest_first_and_records_count():CODE
LOW⚡spaces/vetbook/test_traits.py39def test_facts_say_something_true():CODE
LOW⚡spaces/vetbook/test_traits.py45def test_star_sign_and_season():CODE
LOW⚡spaces/vetbook/test_traits.py53def test_a_book_with_nothing_in_it_still_makes_a_card():CODE
LOW⚡spaces/vetbook/test_traits.py58def test_only_a_listed_book_is_in_the_gallery():CODE
Modern Structural Boilerplate7 hits · 7 pts
SeverityFileLineSnippetContext
LOWspaces/shared/rendezvous.py88logger = logging.getLogger(__name__)CODE
LOWspaces/shared/control.py32logger = logging.getLogger(__name__)CODE
LOWspaces/shared/wire.py51logger = logging.getLogger(__name__)CODE
LOWspaces/vision-demo/rendezvous.py88logger = logging.getLogger(__name__)CODE
LOWspaces/vision-demo/control.py32logger = logging.getLogger(__name__)CODE
LOWspaces/vision-demo/receiver.py40logger = logging.getLogger(__name__)CODE
LOWspaces/vision-demo/wire.py51logger = logging.getLogger(__name__)CODE
Modern AI Meta-Vocabulary2 hits · 6 pts
SeverityFileLineSnippetContext
MEDIUMscripts/provision.sh19# This orchestrates `setup-board.sh`, `migrate-network.sh` and `install.sh`; it does notCOMMENT
MEDIUM.github/workflows/_promote-release.yml11# bytes, which quietly made a tag named like scaffolding load-bearing for the customer channel — andCOMMENT
Self-Referential Comments2 hits · 6 pts
SeverityFileLineSnippetContext
MEDIUMscripts/provision.sh436 # Create the log before systemd does, so it exists with a mode chosen here rather thanCOMMENT
MEDIUM.github/workflows/release.yml3# Create a release in the web interface and this decides what that means, from the tag and from whatCOMMENT
Cross-Language Confusion1 hit · 5 pts
SeverityFileLineSnippetContext
HIGHspaces/vetbook/app.py123 await page.evaluate("document.fonts.ready.then(() => window.fit && window.fit())")CODE
Deep Nesting4 hits · 4 pts
SeverityFileLineSnippetContext
LOWspaces/shared/wire.py259CODE
LOWspaces/vision-demo/receiver.py230CODE
LOWspaces/vision-demo/receiver.py247CODE
LOWspaces/vision-demo/wire.py259CODE
AI Slop Vocabulary1 hit · 3 pts
SeverityFileLineSnippetContext
MEDIUMscripts/systemd-test.sh86# copied in. One at a time, and the harness controls when.COMMENT
Example Usage Blocks1 hit · 2 pts
SeverityFileLineSnippetContext
LOWscripts/publish-space.sh10# Usage:COMMENT