Tiger3807861189/J-Space-Cognition-Suite
J-Space Cognition Suite — a model-agnostic inference-time control suite for deep reasoning, long-horizon work, verification, and recovery. Based on Anthropic's J-space global workspace research.
- Repository: https://github.com/Tiger3807861189/J-Space-Cognition-Suite
- Commit:
b2023124a1fa08278e3ee82aefa8ed9faeade995 - Generated: 2026-11-14T00:14:30+00:00
- Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 0 | possible | 65% | 100% |
| Code quality | 67 | adequate | 90% | 100% |
| Security | 75 | adequate | 85% | 100% |
AI provenance
Weak signals consistent with AI-assisted development.
-
Explicitly attributed share (lower bound): 0.0%
-
Unattributed share in AI-consistent velocity bursts: 42.5%
-
Estimated AI-generated share: 0.0%
-
Stylometry index: 0.22 per 1,000 lines (narrated steps 0, placeholders 0, assistant phrasing 0, emoji 1). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2026-08 | 2,600 | 0% |
| 2026-09 | 2,338 | 0% |
Evidence
- 2,100 lines of first-party code in ~4.0h (525 lines/hour, 1 commit session) (b2023124a1fa)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is adequate: test-to-source ratio 0.84, CI runs tests; 43% of function code in complex or long functions; 1% duplicated lines. Weakest area: complexity.
| Area | Score |
|---|---|
| Complexity (lizard) | 27 |
| Duplication | 95 |
| Code smells (Opengrep) | 52 |
| Tests and CI | 90 |
| Documentation | 80 |
| Type safety | 40 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 81; mean complexity 9.5, 90th percentile 14; 6 complex and 3 long functions
- Duplicated lines: 0.8% of 1,799 compared
- Tests: 1,917 test lines for 2,278 source lines (ratio 0.84); CI test commands: unittest; 25% of recent source commits also change tests
- Docs missing or thin: changelog
Most complex functions:
- run in j-space/scripts/control.py: complexity 99, 229 lines
- validate in j-space/scripts/control.py: complexity 92, 90 lines
- main in j-space/scripts/verify_suite.py: complexity 75, 155 lines
- mode_note in j-space/scripts/jspace.py: complexity 54, 182 lines
- gate in j-space/scripts/control.py: complexity 36, 64 lines
Security
Security posture is adequate: 1 high-severity SAST findings; 2 high-severity workflow issues. Weakest area: posture.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 100 |
| Static analysis (Opengrep) | 89 |
| Vulnerable dependencies (OSV) | n/a |
| CI workflows (zizmor) | 63 |
| Posture (policy, updates, signing, lockfiles) | 0 |
| OpenSSF Scorecard | n/a |
- Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
j-space/scripts/host_bridge.py:27 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/verify.yml:18 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/verify.yml:19 |
| medium | zizmor/artipacked: credential persistence through GitHub Actions artifacts [confidence low] |
.github/workflows/verify.yml:18 |
| medium | zizmor/excessive-permissions: overly broad permissions [confidence medium] |
.github/workflows/verify.yml:10 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Repository profile
- Source lines: 2,278; test lines: 1,917
| Language | Lines |
|---|---|
| Python | 4,195 |