3.6

Adjusted Signal

3.6

Raw Pattern Score

100%

Time Factor

2026-10-26

Last Push

5.4K

Stars

TypeScript

Language

142.7K

Lines of Code

406

Files

226

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 3.5/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 88 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.1/100 · LOW

Are imports declared and package/API names verified? 2 finding(s).

Agent Over-Engineering Ratio 14.3/100 · LOW

Are wrappers, guards, and repeated structures necessary? 173 finding(s).

PR Review Velocity Impact 16.1/100 · LOW

Which changes need focused human review? 226 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 0MEDIUM 138LOW 88

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 226 distinct pattern matches across 8 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Decorative Section Separators136 hits · 404 pts

Severity	File	Line	Snippet	Context
MEDIUM	eslint.config.js	11	// ── Code budget ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM	eslint.config.js	43	// ── token-engine boundary ───────────────────────────────────────────────────	COMMENT
MEDIUM	impl/wallet-api-v2/mailbox.ts	161	// ── deliver ────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	impl/wallet-api-v2/mailbox.ts	250	// ── incoming ───────────────────────────────────────────────────────────────	COMMENT
MEDIUM	impl/wallet-api-v2/mailbox.ts	310	// ── ack ────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	impl/wallet-api-v2/mailbox.ts	397	// ── seen-set (S7) ──────────────────────────────────────────────────────────	COMMENT
MEDIUM	impl/wallet-api-v2/session.ts	180	// ── lifecycle ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM	impl/wallet-api-v2/session.ts	203	// ── auth cell (F8/F14) ────────────────────────────────────────────────────	COMMENT
MEDIUM	impl/wallet-api-v2/session.ts	283	// ── epoch latch (F12) ─────────────────────────────────────────────────────	COMMENT
MEDIUM	impl/wallet-api-v2/session.ts	323	// ── streams ───────────────────────────────────────────────────────────────	COMMENT
MEDIUM	impl/wallet-api-v2/session.ts	352	// ── wake socket ───────────────────────────────────────────────────────────	COMMENT
MEDIUM	impl/wallet-api-v2/client.ts	194	// ── auth ─────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	impl/wallet-api-v2/client.ts	212	// ── inventory / blobs ────────────────────────────────────────────────────	COMMENT
MEDIUM	impl/wallet-api-v2/client.ts	274	// ── intents ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	impl/wallet-api-v2/client.ts	323	// ── mailbox ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	impl/wallet-api-v2/client.ts	355	// ── history ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	impl/wallet-api-v2/client.ts	372	// ── payment requests ─────────────────────────────────────────────────────	COMMENT
MEDIUM	impl/wallet-api-v2/client.ts	399	// ── realtime ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM	oracle/oracle-provider.ts	30	// ── v2 token-engine config surface ─────────────────────────────────────────	COMMENT
MEDIUM	tests/unit/token-engine/nft-payload.test.ts	89	// ── content fixtures ────────────────────────────────────────────────────────	COMMENT
MEDIUM	tests/unit/token-engine/nft-payload.test.ts	144	// ── signing fixtures ────────────────────────────────────────────────────────	COMMENT
MEDIUM	tests/unit/token-engine/FakeTokenEngine.ts	322	// ── internals ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	tests/unit/payments-v2/machine-resume.test.ts	486	// ── #835: the converger ensures a parked intent before anything else ────────	COMMENT
MEDIUM	tests/unit/payments-v2/machine-resume.test.ts	486	// ── #835: the converger ensures a parked intent before anything else ────────	COMMENT
MEDIUM	tests/unit/payments-v2/send-intent-unknown.test.ts	62	// ── wire failures a PUT /v1/intents can end in without proving "no row" ─────	COMMENT
MEDIUM	tests/unit/payments-v2/send-intent-unknown.test.ts	188	// ── observation helpers ──────────────────────────────────────────────────────	COMMENT
MEDIUM	tests/unit/payments-v2/send-intent-unknown.test.ts	407	// ── engines ──────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	tests/unit/payments-v2/send-intent-unknown.test.ts	489	// ── (a) PUT fails before the server stores the intent ───────────────────────	COMMENT
MEDIUM	tests/unit/payments-v2/send-intent-unknown.test.ts	524	// ── (b) PUT stored, response lost ───────────────────────────────────────────	COMMENT
MEDIUM	tests/unit/payments-v2/send-intent-unknown.test.ts	563	// ── (c) the same PUT failure through requests.pay() ─────────────────────────	COMMENT
MEDIUM	tests/unit/payments-v2/send-intent-unknown.test.ts	604	// ── (d) a later leg fails with an ordinary coded error, no PUT failure ──────	COMMENT
MEDIUM	tests/unit/payments-v2/send-intent-unknown.test.ts	642	// ── (e) the in-process convergence path fails AFTER delivery ────────────────	COMMENT
MEDIUM	tests/unit/payments-v2/send-intent-unknown.test.ts	690	// ── (f) mixed direct + split, PUT fails before the row is stored ────────────	COMMENT
MEDIUM	tests/unit/payments-v2/send-intent-unknown.test.ts	724	// ── (g) the PUT is refused before any write, on every attempt ───────────────	COMMENT
MEDIUM	tests/unit/payments-v2/send-intent-unknown.test.ts	815	// ── (h) every PUT answer is ambiguous: the send is HELD ─────────────────────	COMMENT
MEDIUM	tests/unit/payments-v2/send-intent-unknown.test.ts	1106	// ── (i) an epoch reseed while the PUT is in flight ──────────────────────────	COMMENT
MEDIUM	tests/unit/payments-v2/send-intent-unknown.test.ts	1139	// ── (j)–(l) once a leg certified, no failure is clean ───────────────────────	COMMENT
MEDIUM	tests/unit/payments-v2/send-intent-unknown.test.ts	1326	// ── (m) whole-token sends go through the same gate ──────────────────────────	COMMENT
MEDIUM	tests/unit/payments-v2/send-intent-unknown.test.ts	1406	// ── (n)–(p) a clean leg failure is clean only when it can be fenced ─────────	COMMENT
MEDIUM	tests/unit/payments-v2/send-intent-unknown.test.ts	1577	// ── (q) a pass that cannot read the backstop reconciles nothing ─────────────	COMMENT
MEDIUM	tests/unit/payments-v2/send-intent-unknown.test.ts	1609	// ── (r) a settled partial whose close fails ─────────────────────────────────	COMMENT
MEDIUM	tests/unit/payments-v2/send-intent-unknown.test.ts	1639	// ── (s) a convergence pass that overlaps a send or a payment ────────────────	COMMENT
MEDIUM	tests/unit/payments-v2/send-intent-unknown.test.ts	1943	// ── (t) a §5.1 reseed already running when the send starts ──────────────────	COMMENT
MEDIUM	tests/unit/payments-v2/send-intent-unknown.test.ts	2019	// ── (u) a listener's throw never reaches a money-path outcome ───────────────	COMMENT
MEDIUM	tests/unit/payments-v2/send-intent-unknown.test.ts	2079	// ── (v) a remainder attempt that is being cancelled holds the remainder ─────	COMMENT
MEDIUM	tests/unit/payments-v2/send-intent-unknown.test.ts	2138	// ── (x) after a partial, the re-plan attempt is held ───────────────────────	COMMENT
MEDIUM	tests/unit/payments-v2/send-intent-unknown.test.ts	2409	// ── (z) a 2xx whose ack write fails ─────────────────────────────────────────	COMMENT
MEDIUM	tests/unit/payments-v2/send-intent-unknown.test.ts	2448	// ── (y) a cancel the server confirms with 404 ──────────────────────────────	COMMENT
MEDIUM	tests/unit/payments-v2/send-intent-unknown.test.ts	2478	// ── (w) a converged hold is forgotten ───────────────────────────────────────	COMMENT
MEDIUM	tests/unit/payments-v2/send-intent-unknown.test.ts	2528	// ── #842: SENT history beside the apply ─────────────────────────────────────	COMMENT
MEDIUM	tests/unit/payments-v2/send-intent-unknown.test.ts	2528	// ── #842: SENT history beside the apply ─────────────────────────────────────	COMMENT
MEDIUM	tests/unit/payments-v2/providers.test.ts	78	// ── contract harnesses ────────────────────────────────────────────────────────	COMMENT
MEDIUM	tests/unit/payments-v2/providers.test.ts	125	// ── targeted: storage fan-out ─────────────────────────────────────────────────	COMMENT
MEDIUM	tests/unit/payments-v2/providers.test.ts	220	// ── targeted: delivery ────────────────────────────────────────────────────────	COMMENT
MEDIUM	tests/unit/payments-v2/providers.test.ts	393	// ── targeted: checkpoints ─────────────────────────────────────────────────────	COMMENT
MEDIUM	tests/unit/payments-v2/fakes/fake-client.ts	105	// ── auth (not modeled by FakeWalletApi) ──────────────────────────────────	COMMENT
MEDIUM	tests/unit/payments-v2/fakes/fake-client.ts	127	// ── inventory / blobs ────────────────────────────────────────────────────	COMMENT
MEDIUM	tests/unit/payments-v2/fakes/fake-client.ts	204	// ── intents ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	tests/unit/payments-v2/fakes/fake-client.ts	245	// ── mailbox ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	tests/unit/payments-v2/fakes/fake-client.ts	298	// ── history ──────────────────────────────────────────────────────────────	COMMENT
76 more matches not shown…

Hyper-Verbose Identifiers37 hits · 37 pts

Severity	File	Line	Snippet	Context
LOW	constants.ts	121	export function isNetworkScopedAddressKey(key: string): boolean {	CODE
LOW	impl/nodejs/transport/index.ts	29	export function createNodeWebSocketFactory(): WebSocketFactory {	CODE
LOW	impl/nodejs/transport/index.ts	42	export function createNostrTransportProvider(	CODE
LOW	impl/nodejs/oracle/index.ts	77	export function createNodeTrustBaseLoader(	CODE
LOW	impl/nodejs/oracle/index.ts	91	export function createUnicityAggregatorProvider(	CODE
LOW	impl/nodejs/storage/FileStorageProvider.ts	341	export function createFileStorageProvider(config: FileStorageProviderConfig \| string): FileStorageProvider {	CODE
LOW	impl/browser/transport/index.ts	43	export function createNostrTransportProvider(	CODE
LOW	impl/browser/oracle/index.ts	77	export function createBrowserTrustBaseLoader(	CODE
LOW	impl/browser/oracle/index.ts	91	export function createUnicityAggregatorProvider(	CODE
LOW	impl/browser/storage/IndexedDBStorageProvider.ts	448	export function createIndexedDBStorageProvider(	CODE
LOW	impl/browser/storage/LocalStorageProvider.ts	341	export function createLocalStorageProvider(	CODE
LOW	impl/browser/connect/ExtensionTransport.ts	35	export function isExtensionConnectEnvelope(data: unknown): data is ExtensionConnectEnvelope {	CODE
LOW	core/errors.ts	262	export function isPossiblyCommittedSendOutcome(err: unknown): boolean {	CODE
LOW	core/crypto.ts	437	export function generateAddressFromMasterKey(	CODE
LOW	core/crypto.ts	567	export function recoverPubkeyFromSignature(message: string, signature: string): string {	CODE
LOW	core/delivery-envelope.ts	67	export function deriveDeliveryEncryptionKey(privKeyHex: string, peerPubkeyHex: string): Uint8Array {	CODE
LOW	core/transport-resolver.ts	70	export function createTransportAddressResolver(	CODE
LOW	serialization/wallet-text.ts	162	export function serializeEncryptedWalletToText(params: {	CODE
LOW	serialization/wallet-text.ts	317	export function parseAndDecryptWalletText(	CODE
LOW	…/unit/transport/NostrTransportProvider.nametag.test.ts	20	function deriveNametagEncryptionKey(privateKeyHex: string): Uint8Array {	CODE
LOW	tests/unit/transport/NostrTransportProvider.test.ts	546	function createProviderWithStorage(storage: { get: ReturnType<typeof vi.fn>; set: ReturnType<typeof vi.fn> }) {	CODE
LOW	tests/unit/core/Sphere.nametag-sync.test.ts	307	function createMockTransportWithRecovery(options: {	CODE
LOW	…s/unit/storage/contracts/tracked-addresses.contract.ts	55	export function describeTrackedAddressesContract(	CODE
LOW	…/unit/registry/TokenRegistry.networkResolution.test.ts	102	async function configureWithFailingFetch(remoteUrl: string): Promise<void> {	CODE
LOW	tests/unit/payments-v2/pinned-balance.test.ts	271	async function restartOverUnreadableIntent(): Promise<{ world: World; nft: string; valued: string }> {	CODE
LOW	…s/unit/payments-v2/contracts/delivery-port.contract.ts	66	export function describeDeliveryPortContract(	CODE
LOW	…ts/unit/payments-v2/contracts/storage-port.contract.ts	55	export function describeStoragePortContract(	CODE
LOW	tests/integration/wallet-clear-indexeddb.test.ts	90	function simulateStrictModeLeakedConnection(dbName: string): Promise<IDBDatabase> {	CODE
LOW	tests/e2e/sphere-paymentsv2-wiring.staging.e2e.test.ts	211	async function sendConvergedThroughThrottle(	CODE
LOW	docs/API.md	1656	function isPossiblyCommittedSendOutcome(err: unknown): boolean;	CODE
LOW	docs/INTEGRATION.md	1240	export async function saveTrackedAddressesMerging(	CODE
LOW	token-engine/value-envelope.ts	101	function selfDescribedBodyCarriesValue(body: Uint8Array): boolean {	CODE
LOW	token-engine/factory.ts	204	export function createWorkerTokenVerifier(config: VerificationWorkerConfig): CancellableTokenVerifier {	CODE
LOW	modules/communications/CommunicationsModule.ts	813	export function createCommunicationsModule(	CODE
LOW	modules/payments-v2/mint-custom.ts	50	export async function runCustomMintUnderJournal(	CODE
LOW	modules/payments-v2/recipient.ts	27	export async function requireSameNetworkRecipient(	CODE
LOW	modules/payments-v2/compose.ts	42	export function supportsDeterministicMint(	CODE

Over-Commented Block32 hits · 32 pts

Severity	File	Line	Snippet	Context
LOW	tsup.config.ts	1	import { defineConfig } from 'tsup';	COMMENT
LOW	tsup.shared.js	1	// Shared tsup build configuration (sphere-sdk#548).	COMMENT
LOW	tsup.shared.js	161	noExternal: [/^@noble\//],	COMMENT
LOW	tsup.shared.js	181	// (esbuild groups code by the set of entries that reach it), so	COMMENT
LOW	tsup.shared.js	221	// Sphere Connect — CJS: deliberately still one unsplit bundle per entry,	COMMENT
LOW	index.ts	181	AggregatorEventCallback,	COMMENT
LOW	index.ts	301		COMMENT
LOW	CLAUDE.md	181	// 6. Send tokens (L3). Recipient must have a PUBLISHED chain pubkey	COMMENT
LOW	CLAUDE.md	201	// and payments.pendingTransfers() lists what is still converging. A PartialSendConflictError	COMMENT
LOW	CLAUDE.md	221	// MintResult: { success, tokenId?, error? } — one flat interface, so `success` does not narrow	COMMENT
LOW	transport/MultiAddressTransportMux.ts	161	private eventCallbacks: Set<TransportEventCallback> = new Set();	COMMENT
LOW	transport/NostrTransportProvider.ts	261		COMMENT
LOW	core/Sphere.ts	2561		COMMENT
LOW	core/Sphere.ts	2601	// re-run initializeAddressModules, so leaving it behind means `_tokenEngine`	COMMENT
LOW	…sts/unit/impl/browser/IndexedDBStorageProvider.test.ts	181	});	COMMENT
LOW	…ransport/MultiAddressTransportMux.sharedClient.test.ts	281	// must not run — the sub-call counter stays where it was.	COMMENT
LOW	…ransport/MultiAddressTransportMux.sharedClient.test.ts	441	// Across both layers: exactly one NostrClient was constructed (by	COMMENT
LOW	tests/unit/transport/identity-binding-quests.test.ts	1	// #847 keeps exactly one DIRECT:// job: the wallet's Sphere Quests account id.	COMMENT
LOW	tests/unit/payments-v2/send-intent-unknown.test.ts	1	// #835: a send whose durable intent the server may NOT hold. When PUT /v1/intents	COMMENT
LOW	…s/unit/payments-v2/recipient-network.transport.test.ts	1	// §5.6 cross-network recipient gate, driven from the RELAY (#733/#734).	COMMENT
LOW	tests/integration/kv-network-isolation-extra.test.ts	181	// enumeration — getFullKey('') resolves to the bare base prefix ('sphere_'),	COMMENT
LOW	tests/integration/wallet-password.test.ts	201	transport: createMockTransport(),	COMMENT
LOW	tests/aggregator/docker/docker-compose.yml	1	# The local aggregator stack the `test:aggregator` suite runs against.	COMMENT
LOW	docs/QUICKSTART-NODEJS.md	801	if (err.remainingAmount === '0') {	COMMENT
LOW	docs/API.md	41	dmSince: Math.floor(Date.now() / 1000) - 86400, // Optional DM history fallback (unix seconds);	COMMENT
LOW	docs/API.md	1541		COMMENT
LOW	docs/CONNECT.md	401	// Asked when the handshake failed the NETWORK check, and only then: never for a protocol or	COMMENT
LOW	docs/CONNECT.md	441		COMMENT
LOW	docs/CONNECT.md	881		COMMENT
LOW	token-engine/SphereTokenEngine.ts	381	// 1. Resolve the burnt token: from a durable checkpoint on resume, else burn now and persist	COMMENT
LOW	token-engine/SphereTokenEngine.ts	401	...(await Promise.allSettled(	COMMENT
LOW	token-engine/SphereTokenEngine.ts	421	// re-runs ALL legs idempotently from the burn checkpoint (HKDF-deterministic stateId → the	COMMENT

Structural Annotation Overuse15 hits · 26 pts

Severity	File	Line	Snippet	Context
LOW	docs/QUICKSTART-NODEJS.md	188	// Step 1: Create base providers	COMMENT
LOW	docs/QUICKSTART-NODEJS.md	227	// Step 2: Attach the wallet-api transport config (required for money)	COMMENT
LOW	docs/QUICKSTART-NODEJS.md	234	// Step 3: Initialize	COMMENT
LOW	docs/INTEGRATION.md	132	### Step 1: Create Base Providers	COMMENT
LOW	docs/INTEGRATION.md	275	### Step 2: Attach the Wallet-Api Transport Config	COMMENT
LOW	docs/INTEGRATION.md	316	### Step 3: Initialize the Wallet	COMMENT
LOW⚡	docs/INTEGRATION.md	378	// Step 1: Base providers	COMMENT
LOW⚡	docs/INTEGRATION.md	385	// Step 2: Attach the wallet-api transport config	COMMENT
LOW⚡	docs/INTEGRATION.md	392	// Step 3: Initialize wallet	COMMENT
LOW⚡	docs/INTEGRATION.md	399	// Step 4: Use payments (sender-driven, certified on-chain, delivered via mailbox).	COMMENT
LOW	docs/QUICKSTART-BROWSER.md	367	// Step 1: Base providers (storage, transport, oracle)	COMMENT
LOW	docs/QUICKSTART-BROWSER.md	401	// Step 2: Attach the wallet-api transport config (REQUIRED for money)	COMMENT
LOW	docs/QUICKSTART-BROWSER.md	408	// Step 3: Initialize wallet with the composed providers	COMMENT
LOW	registry/TokenRegistry.ts	307	// Step 1: the cache read applyConfig started (none without storage)	COMMENT
LOW	registry/TokenRegistry.ts	318	// Step 2: Cache miss — wait for first remote fetch (only when auto-refresh is enabled)	COMMENT

AI Slop Vocabulary1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	transport/NostrTransportProvider.ts	262	// Create NostrClient with robust connection handling:	COMMENT

Verbosity Indicators2 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	registry/TokenRegistry.ts	307	// Step 1: the cache read applyConfig started (none without storage)	COMMENT
LOW	registry/TokenRegistry.ts	318	// Step 2: Cache miss — wait for first remote fetch (only when auto-refresh is enabled)	COMMENT

Fake / Example Data2 hits · 2 pts

Severity	File	Line	Snippet	Context
LOW	tests/unit/core/utils.test.ts	222	expect(extractFromText(text, pattern)).toBe('John Doe');	CODE
LOW	tests/unit/token-engine/FakeTokenEngine.ts	406	// fake-token state: CBOR array[ tokenId, stateId, owner, genesisData?, transferMemo?, genesisOwner, tokenType, justific	COMMENT

Modern AI Meta-Vocabulary1 hit · 2 pts

Severity	File	Line	Snippet	Context
MEDIUM	CLAUDE.md	454	│ │ ├── PaymentsFacade.ts # Facade: lifecycle, send/mint/receive orchestration	CODE

unicity-sphere/sphere-sdk

Open-Source Code Quality, Security and Technical Debt Review