dougwithseismic/claude-does-apoc

• Repository: https://github.com/dougwithseismic/claude-does-apoc
• Commit: b1387ef1de22fbb0ff016219131f5ecbcd70f5ce
• Generated: 2026-11-14T14:52:04+00:00
• Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2

Scores

AI provenance

Weak signals consistent with AI-assisted development.

• Explicitly attributed share (lower bound): 0.0%

• Unattributed share in AI-consistent velocity bursts: 82.5%

• Estimated AI-generated share: 0.0%

• AI tooling configured in repo: claude-code

• Stylometry index: 0.13 per 1,000 lines (narrated steps 3, placeholders 0, assistant phrasing 0, emoji 0). Reported as a signal, not scored.

Evidence

• 7,380 lines of first-party code in ~1.4h (5,269 lines/hour, 3 commit session) (7690c1a20f52)
• 5,428 lines of first-party code in ~1.3h (4,324 lines/hour, 4 commit session) (65f55ba3e42c)
• 23,510 lines of first-party code in ~7.2h (3,243 lines/hour, 10 commit session) (8054dbaa25fa)
• CLAUDE.md (claude-code configuration) (CLAUDE.md)
• 6,811 lines of first-party code in ~5.9h (1,161 lines/hour, 7 commit session) (b1387ef1de22)
• step-by-step narration comment: // First, try to find by serial (packages/cor)
• step-by-step narration comment: // Then, try to find by nickname (packages/cor)
• step-by-step narration comment: // First, handle escaped variables by temporarily replacing them (packages/wor)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is adequate: test-to-source ratio 1.29, no CI test run detected; 8% of function code in complex or long functions; 4% duplicated lines. Weakest area: testing.

• Functions: 887; mean complexity 2.6, 90th percentile 6; 7 complex and 4 long functions
• Duplicated lines: 3.6% of 14,927 compared
• Tests: 29,202 test lines for 22,630 source lines (ratio 1.29); CI test commands: none detected; 84% of recent source commits also change tests
• Docs missing or thin: contributing, changelog

Most complex functions:

• matchesSelector in packages/automation/src/ui/selector.ts: complexity 34, 70 lines
• TouchCanvas in packages/ui/src/components/TouchCanvas/TouchCanvas.tsx: complexity 25, 153 lines
• matchesCriteria in packages/core/src/pool/manager.ts: complexity 18, 42 lines
• DeviceStream in packages/ui/src/components/DeviceStream/DeviceStream.tsx: complexity 18, 115 lines
• parseDisplayInfo in packages/core/src/shell/screen-capture.ts: complexity 17, 45 lines

Security

Security posture is weak: 108 known vulnerabilities in 30 dependencies. Weakest area: posture.

• Known vulnerabilities: 108 in 30 packages (critical 3, high 68, medium 32, low 5)

• Posture checks passed: none; missing: security policy, dependency updates, signed commits, lockfiles

Top findings

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Distribution signals

• readme-download-lure: gives an archive password

Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.

Repository profile

• Source lines: 22,630; test lines: 29,202