cristianbica/small-council

• Repository: https://github.com/cristianbica/small-council
• Commit: 82162d944689f21d04f23f1e3694f01e1f46c776
• Generated: 2026-11-14T14:52:03+00:00
• Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2

Scores

AI provenance

Weak signals consistent with AI-assisted development.

• Explicitly attributed share (lower bound): 0.0%

• Unattributed share in AI-consistent velocity bursts: 21.3%

• Estimated AI-generated share: 0.0%

• AI tooling configured in repo: generic-agent, github-copilot

• Stylometry index: 0.21 per 1,000 lines (narrated steps 1, placeholders 0, assistant phrasing 0, emoji 2). Reported as a signal, not scored.

Evidence

• 2,010 lines of first-party code in ~1.0h (2,072 lines/hour, 1 commit session) (f733c3af8340)
• 1,481 lines of first-party code in ~0.8h (1,952 lines/hour, 1 commit session) (c84ca68ed3ac)
• .opencode/AGENTS.md (generic-agent configuration) (.opencode/AG)
• AGENTS.md (generic-agent configuration) (AGENTS.md)
• .github/copilot-instructions.md (github-copilot configuration) (.github/copi)
• 1,532 lines of first-party code in ~1.0h (1,492 lines/hour, 2 commit session) (0ed260cf7916)
• 1,745 lines of first-party code in ~1.6h (1,124 lines/hour, 3 commit session) (a5942d36f5a4)
• 3,113 lines of first-party code in ~4.5h (691 lines/hour, 2 commit session) (177d536110d5)
• 1,106 lines of first-party code in ~1.6h (685 lines/hour, 1 commit session) (b580929d6ecb)
• 2,043 lines of first-party code in ~4.0h (511 lines/hour, 2 commit session) (421f8f002dad)
• step-by-step narration comment: # First, create entries for council advisors (db/migrate/2)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is strong: test-to-source ratio 2.12, no CI test run detected; 3% of function code in complex or long functions; 3% duplicated lines. Weakest area: docs.

• Functions: 715; mean complexity 2.0, 90th percentile 4; 3 complex and 0 long functions
• Duplicated lines: 2.7% of 6,231 compared
• Tests: 19,826 test lines for 9,363 source lines (ratio 2.12); CI test commands: none detected; 78% of recent source commits also change tests
• Docs missing or thin: contributing, changelog

Most complex functions:

• getPrefixedKey in app/assets/tailwind/daisyui.mjs: complexity 31, 55 lines
• (anonymous) in app/assets/tailwind/daisyui.mjs: complexity 16, 36 lines
• generate in app/javascript/controllers/prompt_generator_controller.js: complexity 16, 59 lines

Security

Security posture is poor: 123 known vulnerabilities in 25 dependencies; 5 high-severity SAST findings; 10 high-severity workflow issues. Weakest area: dependencies.

• Known vulnerabilities: 123 in 25 packages (critical 3, high 26, medium 66, low 27)

• Posture checks passed: dependency updates, lockfiles; missing: security policy, signed commits

Top findings

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Distribution signals

• readme-download-lure: gives an archive password

Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.

Repository profile

• Source lines: 9,363; test lines: 19,826