Temporal service
This report summarizes scanner evidence for temporalio/temporal, a Go project with 24,100 GitHub stars. SynthScan examined 1,152,445 lines of code across 3561 source files, recording 525 pattern matches distributed across 12 syntactic categories. The legacy adjusted pattern signal is 0.5 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 511 finding(s).
Are imports declared and package/API names verified? 4 finding(s).
Are wrappers, guards, and repeated structures necessary? 10 finding(s).
Which changes need focused human review? 525 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 525 distinct pattern matches across 12 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | temporal/fx.go | 981 | // - []go.opentelemetry.io/otel/sdk/trace.BatchSpanProcessorOption | COMMENT |
| LOW | cmd/tools/test/find_altered_tests.go | 21 | // - Target Git Reference (-t): The target Git reference (commit SHA, branch, etc.). | COMMENT |
| LOW | cmd/tools/check-dependencies/plan.go | 41 | // pseudoRelease is the release implied by a pseudo-version. | COMMENT |
| LOW | cmd/tools/check-dependencies/main.go | 1 | // check-dependencies validates that key Go module dependencies (go.temporal.io/api | COMMENT |
| LOW | cmd/tools/check-dependencies/main.go | 381 | // --single-branch: fetch only the ref for --branch, not all remote branches. | COMMENT |
| LOW | cmd/tools/check-dependencies/main_test.go | 141 | onBranchHash string | COMMENT |
| LOW | temporaltest/server_test.go | 281 | // TODO(jlegrone): investigate why custom search attribute missing here while setting it from workflow succeeds. | COMMENT |
| LOW | temporaltest/internal/lite_server.go | 41 | // This is required if Ephemeral is false. | COMMENT |
| LOW | tools/ci-notify/datarace.go | 21 | // write/write, so both kinds must be matched. | COMMENT |
| LOW | tools/flakereport/doc.go | 1 | // Package flakereport implements Bayesian commit bisection for identifying which commit | COMMENT |
| LOW | tools/flakereport/doc.go | 21 | // | COMMENT |
| LOW | tools/flakereport/doc.go | 41 | // | COMMENT |
| LOW | tools/flakereport/doc.go | 61 | // # Output | COMMENT |
| LOW | tools/tdbg/util.go | 101 | // - week/w | COMMENT |
| LOW | tools/tdbg/util.go | 141 | res := now.Add(time.Duration(-num) * dur) // using server's local timezone | COMMENT |
| LOW | tools/tdbg/scheduleaudit/loaders.go | 181 | // visibilityPageSize is the per-call page size for visibility queries. 1000 is a safe default; the server may clamp | COMMENT |
| LOW | tools/tdbg/scheduleaudit/analyzer.go | 21 | ) | COMMENT |
| LOW | develop/buf-breaking.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | develop/github/monitor_test.sh | 1 | #!/bin/bash | COMMENT |
| LOW | develop/github/memory_monitor.sh | 1 | #!/bin/bash | COMMENT |
| LOW | chasm/path_encoder.go | 21 | COMMENT | |
| LOW | chasm/tree.go | 41 | ) | COMMENT |
| LOW | chasm/tree.go | 101 | // Do NOT set this field directly, use setValueState() method instead. | COMMENT |
| LOW | chasm/tree.go | 121 | // transaction) and also the executionState from backend (for previous transactions). | COMMENT |
| LOW | chasm/tree.go | 901 | n.updateLastUpdateVersionedTransition() | COMMENT |
| LOW | chasm/tree.go | 2841 | NodesWithUncoveredTasks int | COMMENT |
| LOW | chasm/tree.go | 3001 | return err | COMMENT |
| LOW | chasm/tree.go | 3021 | // and hit other undefined issues when root is deleted. | COMMENT |
| LOW | chasm/tree.go | 3881 | // executed. Intended for use by standby handlers. | COMMENT |
| LOW | chasm/task.go | 21 | ScheduledTime time.Time | COMMENT |
| LOW | chasm/task.go | 61 | } | COMMENT |
| LOW | chasm/describe.go | 1 | package chasm | COMMENT |
| LOW | chasm/detached_tree.go | 21 | "go.temporal.io/server/service/history/tasks" | COMMENT |
| LOW | chasm/visibility.go | 241 | // affecting the stored data, but the *commonpb.Payload values are shared. | COMMENT |
| LOW | chasm/ref.go | 41 | COMMENT | |
| LOW | chasm/search_attribute.go | 21 | // var testComponentStartTimeSearchAttribute = NewSearchAttributeTime("StartTime", SearchAttributeFieldDateTime01) | COMMENT |
| LOW | chasm/context.go | 21 | COMMENT | |
| LOW | chasm/context.go | 41 | NamespaceEntry() *namespace.Namespace | COMMENT |
| LOW | chasm/context.go | 61 | // RequestLinks returns the links attached to the given component for the specific requestID. | COMMENT |
| LOW | chasm/context.go | 81 | structuredRef(Component) (ComponentRef, error) | COMMENT |
| LOW | chasm/context.go | 121 | // nil/empty links removes the entry. | COMMENT |
| LOW | chasm/tree_test.go | 1701 | COMMENT | |
| LOW | chasm/engine.go | 81 | BusinessIDConflictPolicyUseExisting | COMMENT |
| LOW | chasm/engine.go | 121 | // must be recorded. It only matters for UpdateComponent(). | COMMENT |
| LOW | chasm/engine.go | 141 | // Fields: | COMMENT |
| LOW | chasm/engine.go | 161 | // - ExecutionKey: The unique identifier for the execution. This key can be used to | COMMENT |
| LOW | chasm/engine.go | 241 | // supplied component ref is validated. Currently only UpdateComponent() honors it; it defaults to | COMMENT |
| LOW | chasm/engine.go | 261 | // Type Parameters: | COMMENT |
| LOW | chasm/engine.go | 361 | // the ref in the transition function. There are some caveats there, check the | COMMENT |
| LOW | chasm/timeskipping.go | 21 | // adjust the config via SetTimeSkippingConfig. | COMMENT |
| LOW | chasm/lib/namespacereplication/tasks.go | 641 | // — the frontend's retry interceptor and SDK/activity retry re-issue the | COMMENT |
| LOW | chasm/lib/namespacereplication/peer_applier.go | 41 | // PeerApplyResultApplied means the peer accepted the mutation as new state | COMMENT |
| LOW | chasm/lib/namespacereplication/peer_applier.go | 61 | // PeerApplier applies a committed namespace mutation to a single peer cell and | COMMENT |
| LOW | chasm/lib/namespacereplication/component.go | 121 | COMMENT | |
| LOW | …eplication/gen/namespacereplicationpb/v1/service.pb.go | 21 | // Verify that this generated code is sufficiently up-to-date. | COMMENT |
| LOW | …eplication/gen/namespacereplicationpb/v1/message.pb.go | 281 | type NamespaceMutation struct { | COMMENT |
| LOW | chasm/lib/activity/operator_commands.go | 141 | HeartbeatTimeout: a.GetHeartbeatTimeout(), | COMMENT |
| LOW | chasm/lib/activity/operator_commands.go | 401 | } | COMMENT |
| LOW | chasm/lib/activity/responses.go | 321 | COMMENT | |
| LOW | chasm/lib/activity/validator.go | 81 | // ValidateAndNormalizeActivityAttributes validates and normalizes the common activity request attributes. | COMMENT |
| 425 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/history_node_cleanup_test.go | 105 | // ── Step 1: start and complete run A ───────────────────────────────────── | COMMENT |
| MEDIUM | tests/history_node_cleanup_test.go | 146 | // ── Step 2: reset A → run B ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/history_node_cleanup_test.go | 162 | // ── Step 3: force-delete run A ──────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/history_node_cleanup_test.go | 174 | // ── Step 4: force-delete run B ──────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/history_node_cleanup_test.go | 183 | // ── Assertions ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/timeskipping_test.go | 1569 | // ── Assertion 1/2/3: the three history events are present. ──────────────── | COMMENT |
| MEDIUM | tests/timeskipping_test.go | 1712 | // ── Assertion 7: activity-2 events are stamped with virtual time. ───────── | COMMENT |
| MEDIUM | tests/timeskipping_test.go | 1750 | // ── Assertion 8: activity-2 timeout task is anchored to wall clock. ────── | COMMENT |
| MEDIUM | service/history/workflow/mutable_state_impl_test.go | 9129 | // ── closeTransactionHandleActivityUserTimerTasks scenarios ────────────────── | COMMENT |
| MEDIUM | service/history/workflow/mutable_state_impl_test.go | 9248 | // closeTransactionRegenerateTimerTasksForTimeSkipping ─────────── | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | service/matching/physical_task_queue_manager_test.go | 193 | s.tqMgr.backlogMgr.taskReader.gorogrp.Cancel() | CODE |
| CRITICAL | service/matching/physical_task_queue_manager_test.go | 194 | s.tqMgr.backlogMgr.taskReader.gorogrp.Wait() | CODE |
| CRITICAL | service/history/api/multioperation/api.go | 195 | updateID := uws.updateReq.Request.Request.Meta.GetUpdateId() | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | temporal/fx.go | 392 | // into fx providers here. Essentially, we want an `fx.In` object in the server graph, and an `fx.Out` object in the | COMMENT |
| MEDIUM | tests/xdc/activity_timer_task_replication_test.go | 85 | // checkpoints. That is the property that matters, and it is robust to however many tasks | COMMENT |
| MEDIUM | common/persistence/execution_manager.go | 535 | // try to utilize resp as much as possible, for RebuildMutableState API | COMMENT |
| MEDIUM | common/persistence/execution_manager.go | 954 | // try to utilize resp as much as possible, for RebuildMutableState API | COMMENT |
| MEDIUM | service/matching/scale_manager_test.go | 212 | // fixed expected count, this is robust to how many matches happened earlier in the test. | COMMENT |
| MEDIUM | service/frontend/fx.go | 101 | // A more robust approach would require using fx groups but we shouldn't overcomplicate until this becomes an issue. | COMMENT |
| MEDIUM | service/history/tasks/task_category_registry.go | 26 | // each entry point that uses it. Essentially, get it from the dependency graph instead of calling this method, unless | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/versioning_3_test.go | 5942 | // Step 3: CaN run starts on v1. Target=v2, declined=v2 → case 4 suppresses signal. | COMMENT |
| LOW | tests/versioning_3_test.go | 5963 | // Step 4: Rollback — set v1 as current again. Target becomes v1. | COMMENT |
| LOW | tests/versioning_3_test.go | 5985 | // Step 5: Set v2 as current again. Target goes back to v2. | COMMENT |
| LOW | common/archiver/history_iterator.go | 181 | // We need to check if there's more history batches. | COMMENT |
| LOW | service/history/statemachine_environment.go | 147 | // for close workflow we need to check if it is still the current run | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/client_misc_test.go | 864 | // Server complete workflow as requested. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/versioning_3_test.go | 5942 | // Step 3: CaN run starts on v1. Target=v2, declined=v2 → case 4 suppresses signal. | COMMENT |
| LOW | tests/versioning_3_test.go | 5963 | // Step 4: Rollback — set v1 as current again. Target becomes v1. | COMMENT |
| LOW | tests/versioning_3_test.go | 5985 | // Step 5: Set v2 as current again. Target goes back to v2. | COMMENT |
| LOW | …on/persistence/transitionhistory/transition_history.go | 79 | // NOTE: This function should only be used when there is reloading logic on top of it, since the error returned is a | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/xdc/nexus_request_forwarding_test.go | 89 | // TODO: Add test cases for dispatch by endpoint ID once endpoints support replication. | COMMENT |
| LOW | tests/xdc/nexus_request_forwarding_test.go | 266 | // TODO: Add test cases for dispatch by endpoint ID once endpoints support replication. | COMMENT |
| LOW | service/matching/pri_matcher_test.go | 645 | // TODO: Add tests for verifying the validator doesn't consume rate limit tokens. | COMMENT |
| LOW | service/history/replication/executable_sync_hsm_task.go | 187 | // TODO: implement the following methods to batch syncHSM task if needed | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | develop/github/monitor_test.sh | 7 | # Usage: | COMMENT |
| LOW | develop/github/memory_monitor.sh | 21 | # Usage: | COMMENT |
| LOW | common/log/interface.go | 11 | // Usage example: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …rker/workerdeployment/replaytester/generate_history.sh | 47 | # Create the default namespace | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | service/matching/counter/map.go | 87 | // don't forget to fix the map: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | cmd/tools/check-dependencies/main_test.go | 185 | run("config", "user.email", "test@test.com") | CODE |