craigloewen-msft/guitar-practice-tool

• Repository: https://github.com/craigloewen-msft/guitar-practice-tool
• Commit: 269dc8199607d3a0fac4b757b2367eb0cef419e7
• Generated: 2026-11-14T14:52:03+00:00
• Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2

Scores

Unreviewed AI code risk: a large share of this code is explicitly AI-attributed, and its tests or review process are weak while quality or security scores are low.

AI provenance

Explicit AI attribution on 100% of first-party code added; an estimated 100% including velocity signals.

• Explicitly attributed share (lower bound): 100.0%
• Unattributed share in AI-consistent velocity bursts: 0.0%
• Estimated AI-generated share: 100.0%

Current source lines last changed by AI-attributed commits: 12,105 of 12,105.

Too few lines in one group to compare finding densities.

• Stylometry index: 0.74 per 1,000 lines (narrated steps 5, placeholders 0, assistant phrasing 0, emoji 8). Reported as a signal, not scored.

Evidence

• GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot' (269dc8199607)
• GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot' (6f220c2133f5)
• GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot' (34925619d8d7)
• GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot' (a2839208cd0c)
• GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot' (296385520bf8)
• GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot' (0d78a68edaa2)
• GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot' (9a48ab09a612)
• GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot' (2b5a37a1e83c)
• GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot' (8624017078b1)
• GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot' (860cfeb828ff)
• 3,227 lines of first-party code in ~4.0h (807 lines/hour, 1 commit session) (34925619d8d7)
• 2,748 lines of first-party code in ~4.5h (613 lines/hour, 2 commit session) (2b5a37a1e83c)
• step-by-step narration comment: // Step 1: structure. Match the whole song at once by what each part is doing - which parts (src/backing.)
• step-by-step narration comment: // Step 2: hits. Place the tab's hits where the structure says they fall, and slide each (src/backing.)
• step-by-step narration comment: // Step 3: the map playback follows. Every point is measured, so there is no single tempo for (src/backing.)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is weak: test-to-source ratio 0.00, CI runs tests; 43% of function code in complex or long functions; 0% duplicated lines. Weakest area: complexity.

• Functions: 432; mean complexity 5.9, 90th percentile 16; 47 complex and 16 long functions
• Duplicated lines: 0.1% of 9,111 compared
• Tests: 0 test lines for 12,105 source lines (ratio 0.00); CI test commands: go test, cargo test; 0% of recent source commits also change tests
• Docs missing or thin: contributing, changelog

Most complex functions:

• parse in src/gp.rs: complexity 61, 102 lines
• read_note_effects in src/gp.rs: complexity 58, 117 lines
• schedule_beat in src/timeline.rs: complexity 54, 243 lines
• process_block in src/synth/mod.rs: complexity 53, 187 lines
• align in src/backing.rs: complexity 47, 234 lines

Security

Security posture is weak: 12 known vulnerabilities in 9 dependencies; 12 high-severity workflow issues. Weakest area: posture.

• Known vulnerabilities: 12 in 9 packages (critical 0, high 0, medium 1, low 3)

• Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits

Top findings

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Distribution signals

• binary-release-asset: release v0.1.0 ships guitar-practice-tool_0.1.0_amd64.deb (0 downloads)
• binary-release-asset: release v0.1.0 ships guitar-practice-tool_0.1.0_x64-setup.exe (1 downloads)
• binary-release-asset: release v0.1.0 ships guitar-practice-tool_0.1.0_x86_64.AppImage (0 downloads)
• binary-release-asset: release v0.1.0 ships Guitar.Practice.Tool_0.1.0_aarch64.dmg (1 downloads)
• binary-release-asset: release v0.1.0 ships Guitar.Practice.Tool_0.1.0_x64.dmg (0 downloads)

Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.

Repository profile

• Source lines: 12,105; test lines: 0