Syndical

Quality & evidence

Measured code quality.
Published evidence.

Dated source checks for Syndical Desktop, Mobile, Site and API. Inspect measured compliance, remaining findings and the scope of each published snapshot.

Inspect the results How these scores are measured

The current record

Measured on our own repositories

Download scorecards

Each result describes the checks that actually ran. A passing check covers its stated scope; it does not establish the quality of the whole system.

Commands and policy are provided. Rerunning source checks requires access to the measured repositories.

Syndical

Quality

100/100

Maintainability

100/100

Static security checks

No findings

0 critical · 0 high · 0 medium · 0 low
5 qualified rules · findings require review

2275 / 2275 files without configured warnings or errors.

29609 / 29609 actual functions within every limit. 0.00% of tokens duplicated.

Measured 11 October 2026 · a6ef69ef8d89

Coverage & evidence

2275 selected production files. csharp: 1924 · javascript: 13 · typescript: 338.

  • Native checks: 2275 / 2275 files analyzed
  • Function analysis: 2275 / 2275 files analyzed
  • Duplication: 2275 / 2275 files analyzed
  • Security checks: 2275 / 2275 files analyzed

Function limits: complexity ≤ 15, lines ≤ 80, parameters ≤ 5. Maintainability takes the lowest of 100% function compliance, 100% duplication-free tokens and 100% declaration compliance. 1013 / 1013 executable or wide-data declarations comply; 0 remain outside the reviewed contract. Function parsing limitations are recorded below.

Methodology: csharp-source-v1. C# source syntax version 1.0.0; actual callable bodies and separately reviewed declarations.

Duplication: at least 5 lines and 50 tokens, mild mode.

Qualified security checks

  • HttpClientHandler certificate callbacks that explicitly accept every certificate. (high; csharp).
  • Explicit rejectUnauthorized:false settings and NODE_TLS_REJECT_UNAUTHORIZED=0 assignments. (high; javascript, typescript).
  • BrowserWindow object literals explicitly disabling context isolation. (high; javascript, typescript).
  • BrowserWindow object literals explicitly enabling renderer Node integration. (medium; javascript, typescript).
  • Direct console arguments named password, token, key or client secret; this is not a dataflow rule. (high; javascript, typescript).

Included roots: apps/, libs/. Extensions: .cs, .ts, .tsx, .js, .jsx, .mjs.

Excluded paths and suffixes: test, tests, fixtures, bin, obj, node_modules, out, dist, resources, .test.ts, .test.tsx, .spec.ts, .spec.tsx, .d.ts, .g.cs, .generated.cs.

Gate: passed. This methodology requires a zero-debt baseline; measured debt cannot pass the gate.

Findings beyond the zero-debt baseline: 0.

Policy: syndical-oss-quality-v2

  • Scores measure compliance with this named profile; profiles can differ between languages and repositories.
  • Quality measures configured native warnings and errors, not functional correctness or test effectiveness.
  • Swift and Python functions are recognized heuristically by Lizard. JavaScript/TypeScript uses the TypeScript syntax tree.
  • C# uses the pinned Roslyn source syntax inventory across every conditional-symbol assignment; this is not a compiled control-flow or semantic correctness proof.
  • C# length counts nonempty physical declaration lines including comments and nested code. Primary constructors count only their header and executable initializer regions.
  • Executable declarations have separate compliance; wide records require exact reviewed data-shape identities. Neither adds synthesized functions to the function denominator.
  • Security covers only the named qualified rules. Dependencies, secrets, runtime behavior and broader dataflow are not assessed here.
  • No overall quality or human-superiority claim is supported by this scorecard.
Download full scorecard

Report SHA-256 b050cbbb2b25c3b365f4592a8d2f6e22d0fbf1b5d4bbf3a2ad3e0b0d418f4375

Syndical.mobile

Quality

100/100

Maintainability

100/100

Static security checks

No findings

0 critical · 0 high · 0 medium · 0 low
4 qualified rules · findings require review

45 / 45 files without configured warnings or errors.

474 / 474 recognized functions within every limit. 0.00% of tokens duplicated.

Measured 5 October 2026 · 9ce8d9f98455 + recorded changes

Coverage & evidence

45 selected production files. swift: 45.

  • Native checks: 45 / 45 files analyzed
  • Function analysis: 45 / 45 files analyzed
  • Duplication: 45 / 45 files analyzed
  • Security checks: 45 / 45 files analyzed

Function limits: complexity ≤ 15, lines ≤ 80, parameters ≤ 5. Maintainability takes the lowest of 100% function compliance, 100% duplication-free tokens. Function parsing limitations are recorded below.

Duplication: at least 5 lines and 50 tokens, mild mode.

Qualified security checks

  • Direct MD5/SHA-1 calls require a non-security rationale or a modern cryptographic algorithm. (high; swift).
  • Direct UserDefaults.standard writes with explicit credential key names. (high; swift).
  • Enabling universal network access from WebView file URLs. (high; swift).
  • Passing copied trust exceptions straight back into TLS trust evaluation. (high; swift).

Included roots: SyndicalApp/Sources/, SyndicalApp/App/. Extensions: .swift.

Excluded paths and suffixes: tests, uitests, fixtures, .build, build, deriveddata, desktopviews, assets.xcassets, resources, Fixtures.swift, ConnectionUITestFixture.swift.

Gate: passed. Accepted existing findings still count in these scores.

Findings beyond the accepted baseline: 0.

Policy: syndical-mobile-quality-v1

  • Scores measure compliance with this named profile; profiles can differ between languages and repositories.
  • Quality measures configured native warnings and errors, not functional correctness or test effectiveness.
  • C#, Swift and Python functions are recognized heuristically by Lizard; their detection is not compiler-proven complete. JavaScript/TypeScript uses the TypeScript syntax tree.
  • Security covers only the named qualified rules. Dependencies, secrets, runtime behavior and broader dataflow are not assessed here.
  • No overall quality or human-superiority claim is supported by this scorecard.
Download full scorecard

Report SHA-256 0ee7ff6d58185988bbd67e21e90f291224c0c0bf88d20710ef835303ccc66c92

Syndical.site

Quality

100/100

Maintainability

100/100

Static security checks

No findings

0 critical · 0 high · 0 medium · 0 low
2 qualified rules · findings require review

69 / 69 files without configured warnings or errors.

313 / 313 recognized functions within every limit. 0.00% of tokens duplicated.

Measured 5 October 2026 · c943d3d45c3e + recorded changes

Coverage & evidence

69 selected production files. javascript: 6 · python: 8 · typescript: 55.

  • Native checks: 69 / 69 files analyzed
  • Function analysis: 69 / 69 files analyzed
  • Duplication: 69 / 69 files analyzed
  • Security checks: 69 / 69 files analyzed

Function limits: complexity ≤ 15, lines ≤ 80, parameters ≤ 5. Maintainability takes the lowest of 100% function compliance, 100% duplication-free tokens. Function parsing limitations are recorded below.

Duplication: at least 5 lines and 50 tokens, mild mode.

Qualified security checks

  • Credential-shaped values passed directly to browser console methods (high; typescript, javascript).
  • Explicit shell=True subprocess calls require review (medium; python).

Included roots: app/, components/, icons/, illustrations/, lib/, providers/, infra/, next.config.ts, postcss.config.mjs. Extensions: .ts, .tsx, .js, .mjs, .py.

Excluded paths and suffixes: test, tests, fixtures, node_modules, dist, __pycache__, .test.ts, .test.tsx, .test.mjs, .d.ts, infra/test_.

Gate: passed. Accepted existing findings still count in these scores.

Findings beyond the accepted baseline: 0.

Policy: syndical-site-quality-v1

  • Scores measure compliance with this named profile; profiles can differ between languages and repositories.
  • Quality measures configured native warnings and errors, not functional correctness or test effectiveness.
  • C#, Swift and Python functions are recognized heuristically by Lizard; their detection is not compiler-proven complete. JavaScript/TypeScript uses the TypeScript syntax tree.
  • Security covers only the named qualified rules. Dependencies, secrets, runtime behavior and broader dataflow are not assessed here.
  • No overall quality or human-superiority claim is supported by this scorecard.
Download full scorecard

Report SHA-256 c2a1578e39a47953b885e49f0a4531c67f850fc0e38a8c81f0ecaf4a1d563196

Syndical.api

Quality

100/100

Maintainability

100/100

Static security checks

No findings

0 critical · 0 high · 0 medium · 0 low
4 qualified rules · findings require review

16 / 16 files without configured warnings or errors.

147 / 147 actual functions within every limit. 0.00% of tokens duplicated.

Measured 6 October 2026 · e6ca1d5f7191

Read the API score history and policy changes
Coverage & evidence

16 selected production files. csharp: 16.

  • Native checks: 16 / 16 files analyzed
  • Function analysis: 16 / 16 files analyzed
  • Duplication: 16 / 16 files analyzed
  • Security checks: 16 / 16 files analyzed

Function limits: complexity ≤ 15, lines ≤ 80, parameters ≤ 5. Maintainability takes the lowest of 100% function compliance, 100% duplication-free tokens and 100% declaration compliance. 59 / 59 executable or wide-data declarations comply; 0 remain outside the reviewed contract. Function parsing limitations are recorded below.

Methodology: csharp-source-v1. C# source syntax version 1.0.0; actual callable bodies and separately reviewed declarations.

Duplication: at least 5 lines and 50 tokens, mild mode.

Qualified security checks

  • Explicit HttpClientHandler callbacks that accept every certificate. (high; csharp).
  • Explicit MD5/SHA1 Create and HashData calls; cryptographic context is not inferred. (high; csharp).
  • Deserialize calls following a local var declaration constructed with BinaryFormatter; this is an explicit sequence rule. (high; csharp).
  • Direct logger arguments named password, token or private key; this is not a dataflow rule. (high; csharp).

Included roots: src/. Extensions: .cs.

Excluded paths and suffixes: tests, fixtures, bin, obj, .g.cs, .generated.cs.

Gate: passed. This methodology requires a zero-debt baseline; measured debt cannot pass the gate.

Findings beyond the zero-debt baseline: 0.

Policy: syndical-api-oss-quality-v2

  • Scores measure compliance with this named profile; profiles can differ between languages and repositories.
  • Quality measures configured native warnings and errors, not functional correctness or test effectiveness.
  • Swift and Python functions are recognized heuristically by Lizard. JavaScript/TypeScript uses the TypeScript syntax tree.
  • C# uses the pinned Roslyn source syntax inventory across every conditional-symbol assignment; this is not a compiled control-flow or semantic correctness proof.
  • C# length counts nonempty physical declaration lines including comments and nested code. Primary constructors count only their header and executable initializer regions.
  • Executable declarations have separate compliance; wide records require exact reviewed data-shape identities. Neither adds synthesized functions to the function denominator.
  • Security covers only the named qualified rules. Dependencies, secrets, runtime behavior and broader dataflow are not assessed here.
  • No overall quality or human-superiority claim is supported by this scorecard.
Download full scorecard

Report SHA-256 33b820199014191666d9437bdb83bbc4c936e6822e657c985c74395b12fec70b

Read the published score history
How to read these scores

Quality is the percentage of checked production files with no configured native warnings or errors. Build and test outcomes remain separate evidence below.

Maintainability is the lowest of function compliance and duplication-free tokens, plus declaration compliance in the C# source methodology. Scores round down; 100 requires complete compliance with the stated profile.

Security shows the highest flagged severity and findings to review in qualified rules. Missing or incomplete scans say Not measured. No findings does not mean the system is proven safe.

Profiles differ by language and repository. These scores describe their stated scope, not a ranking across projects or evidence of superiority to human development. There is no blended overall score.

Build, test & earlier measurement evidence

Syndical

Quality pipeline passed

Desktop application and orchestration runtime

  • Production source compliancePassed

    Quality 100/100 and Maintainability 100/100, with a passing reviewed baseline gate. These scores cover the configured source and qualified static rules.

  • macOS .NET regression testsPassed

    10,282 of 10,282 cases passed; 0 failed and 0 skipped. All 16 projects completed across three groups without a test filter.

  • macOS TypeScript regression testsPassed

    2,267 of 2,267 cases passed; 0 failed and 0 skipped. Both workspaces were measured.

  • macOS typecheck and desktop buildPassed

    The required TypeScript typecheck and desktop production build completed successfully.

  • macOS npm dependency advisoriesAdvisory check failed

    11 dependency entries flagged: 0 critical, 1 high, 8 moderate, 2 low and 0 informational. This advisory check is separate from the required pipeline gate.

  • Windows .NET regression testsPassed

    10,282 of 10,282 cases passed; 0 failed and 0 skipped. All 16 projects completed across three groups without a test filter.

  • Windows TypeScript regression testsPassed with skips

    2,264 of 2,267 cases passed; 0 failed and 3 skipped. Both workspaces were measured.

  • Windows typecheck and desktop buildPassed

    The required TypeScript typecheck and desktop production build completed successfully.

  • Windows npm dependency advisoriesAdvisory check failed

    11 dependency entries flagged: 0 critical, 1 high, 8 moderate, 2 low and 0 informational. This advisory check is separate from the required pipeline gate.

Measured 11 October 2026 · revision a6ef69ef8d89

Successful quality pipeline run 6772 measured this clean, stable revision on refs/heads/fix/quality-pipeline-runtime-20261010. macOS and Windows retain their own native source byte digests; the static scorecard declares its separate production scope. The manifest binds every original public report download to its SHA-256.

Scope, limitations & reproduction

Source content SHA-25663163fbc964e5e5d7f19964f156f934de81fa3ff66f3ae5fc6a1ddfda0af8a13

Read the full measurement report
Earlier measurement · 2026-10-05T22:53:52.525Z

The prior dated report remains available with its original source, policy and outcomes.

Qualified build and test measurement · 2026-10-05

The prior published 100/100 source assessment and its qualified 9,183-case .NET run, 2,037 frontend cases, 54 quality-tool cases and zero-advisory dependency audit are retained with their original source and policy metadata.

Build and test measurement · 3 October 2026

6,854 of 6,857 .NET cases passed, with 3 failures and no skips. All 1,482 frontend cases passed; npm flagged 12 dependency entries. These are the original dated outcomes and are retained without changing their source or policy metadata.

Measurement methodology and scope

Read the exact scope, reproduction commands, measurement limitations and proposed controlled comparison for this snapshot.

Measurement policy · 3 October 2026

The original machine-readable policy used for this measurement.

Initial baseline · 3 October 2026

The initial run, using instrument revision 938ac2978b1a on source c487d771442d, recorded 7 TypeScript test failures and 12 dependency entries flagged (10 high-severity). The .NET measurement was incomplete after an earlier 20-minute instrument limit; its test counts cover only 15 of 16 projects. This snapshot uses earlier instrumentation and is not an equivalent-scope comparison.

Initial baseline measurement policy

The original baseline policy is retained alongside its report.

Intermediate measurement · 3 October 2026

At revision bf73ebf41c8f, 2 TypeScript tests failed and npm flagged 12 dependency entries. The .NET measurement covers 15 of 16 projects, with 2 failures in those completed projects. A nonterminating test fixture required an explicit stop of the orchestration test project; this was an operator intervention, not a configured deadline. Incomplete counts are not full-suite totals.

Full measurement at dc5861d3 · 3 October 2026

All 16 .NET test projects completed: 6,819 of 6,857 tests passed and 38 failed, with no skips. All 1,482 TypeScript tests passed; npm flagged 12 dependency entries. The failed .NET run is retained here as measured. Subsequent fixture corrections belong to a later source snapshot and do not change this report.

Measurement policy used at dc5861d3

The original policy is retained for this completed attempt. Its scanner size setting comes from the immutable source snapshot, and comparability requires the actual measured-file inventory.

  • These are dated source snapshots, not proof of every deployment or future execution environment.
  • macOS and Windows test totals are separate executions of the same suite; adding them does not count distinct tests.
  • The six regression reports use their recorded group and check selections. The separate scorecard measures the configured production scope; unselected runner checks are not reported as passed.
  • Skipped tests and dependency advisories retain their measured outcomes in the original reports.
  • The imported reports do not establish optional OS credential-vault integration. Test coverage, effectiveness, independent review, production reliability and controlled human comparison remain unmeasured.
  • Optional OS credential-vault integration is not established by this publication.
  • This explicitly approved manual repair validation measured an unmerged repair branch.
  • Windows validation used a temporary Norton exclusion for its fixture parent; it was removed after this run. This is not proof of future Windows execution under ordinary protection.
  • Scores measure compliance with this named profile; profiles can differ between languages and repositories.
  • Quality measures configured native warnings and errors, not functional correctness or test effectiveness.
  • Swift and Python functions are recognized heuristically by Lizard. JavaScript/TypeScript uses the TypeScript syntax tree.
  • C# uses the pinned Roslyn source syntax inventory across every conditional-symbol assignment; this is not a compiled control-flow or semantic correctness proof.
  • C# length counts nonempty physical declaration lines including comments and nested code. Primary constructors count only their header and executable initializer regions.
  • Executable declarations have separate compliance; wide records require exact reviewed data-shape identities. Neither adds synthesized functions to the function denominator.
  • Security covers only the named qualified rules. Dependencies, secrets, runtime behavior and broader dataflow are not assessed here.
  • No overall quality or human-superiority claim is supported by this scorecard.

Production source compliance

npm run quality:analyzeDownload evidence

macOS .NET regression tests

npm run quality:check -- --ci azure --test-group execution --checks dotnet-build,dotnet-tests npm run quality:check -- --ci azure --test-group orchestrator --checks dotnet-build,dotnet-tests npm run quality:check -- --ci azure --test-group other --checks dotnet-build,dotnet-testsDownload evidence

macOS TypeScript regression tests

npm run quality:check -- --ci azure --test-group other --checks dotnet-build,dotnet-tests,typescript,typescript-tests,desktop-build,npm-auditDownload evidence

macOS typecheck and desktop build

npm run quality:check -- --ci azure --test-group other --checks dotnet-build,dotnet-tests,typescript,typescript-tests,desktop-build,npm-auditDownload evidence

macOS npm dependency advisories

npm audit --jsonDownload evidence

Windows .NET regression tests

npm run quality:check -- --ci azure --test-group execution --checks dotnet-build,dotnet-tests npm run quality:check -- --ci azure --test-group orchestrator --checks dotnet-build,dotnet-tests npm run quality:check -- --ci azure --test-group other --checks dotnet-build,dotnet-testsDownload evidence

Windows TypeScript regression tests

npm run quality:check -- --ci azure --test-group other --checks dotnet-build,dotnet-tests,typescript,typescript-tests,desktop-build,npm-auditDownload evidence

Windows typecheck and desktop build

npm run quality:check -- --ci azure --test-group other --checks dotnet-build,dotnet-tests,typescript,typescript-tests,desktop-build,npm-auditDownload evidence

Windows npm dependency advisories

npm audit --jsonDownload evidence

Syndical.mobile

Measured source checks passed

Native mobile application

  • Production source compliancePassed

    100/100 quality and 100/100 maintainability, with 474 compliant functions, zero native or detected duplication findings, and no matches in the four qualified static rules.

Measured 5 October 2026 · revision 9ce8d9f98455

The original 9ce8 measurement and dirty working-tree metadata are retained. Its 45 measured production files and policy inputs match remote main df6d832; the local unpublished revision differs in machine configuration. This is production-source equivalence evidence, not a fresh clean remote scan.

Scope, limitations & reproduction

Source content SHA-256f4037efddb1972cb697eb55cb38ce5df39fa03d0bdb5c05e1906ae869c47cf60

Read the full measurement report
  • The exact dated source report remains unchanged. Its published source revision is not described as the remote main commit.
  • The four qualified static rules do not establish comprehensive security or runtime correctness.

Production source compliance

node tools/quality/oss/run.mjs --profile infra/quality/profile.jsonDownload evidence

Syndical.site

Local measured checks passed

The public website you are reading

  • Production build and typecheckPassed

    The standalone production build and explicit TypeScript typecheck passed after the three-platform report-consumer patch.

  • Delivery helper regression testsPassed

    68 Python cases passed, including the actual production-build integration check.

  • Report-consumer regression testsPassed

    63 Node cases passed; 0 failed, cancelled, skipped or pending. These cases checked the preserved histories and strict instrument identities before this evidence import.

  • Production source compliancePassed

    Quality 100/100 and maintainability 100/100: all 69 files and 313 functions comply; native, duplication and both qualified static security-rule findings are zero.

  • npm dependency advisoriesPassed

    The fresh npm audit reported zero dependency advisories at every severity.

Measured 5 October 2026 · revision c943d3d45c3e

The reviewed report-consumer source patch was measured before commit together with four preserved local machine settings. All 69 selected production files and 313 recognized functions comply under the unchanged profile; this is a dated working-tree assessment, not a clean whole-repository scan.

Scope, limitations & reproduction

Source content SHA-2563a63f77d2f15f326d6744c67a596905ffb5743acff460ec9f5617b5acbf37312

Read the full measurement report
Build and test measurement · 3 October 2026

Original 64-test, build and audit results are retained with their source identity.

  • The source metadata records the actual local working tree; local machine configuration stays private. Public evidence exports are excluded from source identity to avoid self-hashing.
  • The static security result covers only the two published qualified rules. Hosted CI and live publication are separate delivery checks.
  • Coverage effectiveness, production reliability and controlled human comparison remain unmeasured.

Production build and typecheck

npm run build; node node_modules/typescript/bin/tsc --noEmitDownload evidence

Delivery helper regression tests

python3 -B -m unittest discover -s infra -p test_*.pyDownload evidence

Report-consumer regression tests

node --test infra/quality/qualify.test.mjs infra/quality/publish-scorecards.test.mjs infra/quality/csharp-scorecard.test.mjsDownload evidence

Production source compliance

node tools/quality/oss/run.mjs --profile infra/quality/profile.jsonDownload evidence

npm dependency advisories

npm audit --jsonDownload evidence

Syndical.api

Local measured checks passed

Notification API

  • Production source compliancePassed

    100/100 quality and 100/100 maintainability; zero native, function, declaration, duplication and four qualified static security-rule findings across all 16 selected files.

  • Quality tool regression testsPassed

    61 Node cases passed in the original API checkout after the reviewed vendor update; zero failures and skips. The C# instrument separately passed 59 cases on macOS ARM64.

Measured 6 October 2026 · revision e6ca1d5f7191

Clean pushed main source: all 16 selected files, 147 callable variants and 59 declarations comply. Application and solution regression inputs remain byte-identical to the previously qualified 8248 API source. The updated quality tools have separate source changes; this assessment does not claim a new API runtime suite or hosted Linux run.

Scope, limitations & reproduction

Source content SHA-256bd97544120762ad45d6b3350ab180b8b87adcd64c455cf2fe4911af06ca41824

Read the full measurement report
Earlier API source assessment · 5 October 2026

The prior clean 8248 report and its original policy identity are retained.

  • No new API runtime suite rerun is claimed at this commit; the 16 application source files remain byte-identical to the earlier qualified source.
  • The four published static rules are bounded security coverage. This local report does not claim hosted Linux execution or a passing hosted build.

Production source compliance

node tools/quality/oss/run.mjs --profile tools/quality/profile.jsonDownload evidence

Quality tool regression tests

node --test --test-reporter=tap tools/quality/oss/baseline.test.mjs tools/quality/oss/bootstrap.test.mjs tools/quality/oss/csharp-metrics.test.mjs tools/quality/oss/declarations.test.mjs tools/quality/oss/process-log.test.mjs tools/quality/oss/run.test.mjs tools/quality/oss/scores.test.mjs tools/quality/oss/typescript-metrics.test.mjs tools/quality/adapters/api.test.mjsDownload evidence

Still to measure

  • Coverage of changed code
  • Test effectiveness against hidden or seeded defects
  • Security beyond the published static rules and dependency advisories
  • Independent maintainability assessment
  • Complexity and duplication trends
  • Escaped defects and production reliability
  • Controlled comparison with human development