{
  "schemaVersion": 3,
  "repository": "Syndical.api",
  "startedAt": "2026-10-05T23:06:02.879Z",
  "source": {
    "commit": "e6ca1d5f71919681a662065da7e7a1b1f121a069",
    "dirty": false,
    "contentSha256": "bd97544120762ad45d6b3350ab180b8b87adcd64c455cf2fe4911af06ca41824",
    "stableDuringRun": true,
    "finishedContentSha256": "bd97544120762ad45d6b3350ab180b8b87adcd64c455cf2fe4911af06ca41824"
  },
  "policy": {
    "id": "syndical-api-oss-quality-v2",
    "sha256": "c3c4a2ed91a2aa2366680b40eab5a7b5b61deb715f714b06e244e8dd7d5644b3",
    "sastRules": [
      {
        "id": "syndical.csharp.tls-validation-always-true",
        "severity": "high",
        "languages": [
          "csharp"
        ],
        "description": "Explicit HttpClientHandler callbacks that accept every certificate."
      },
      {
        "id": "syndical.csharp.weak-cryptographic-hash",
        "severity": "high",
        "languages": [
          "csharp"
        ],
        "description": "Explicit MD5/SHA1 Create and HashData calls; cryptographic context is not inferred."
      },
      {
        "id": "syndical.csharp.binaryformatter-deserialization",
        "severity": "high",
        "languages": [
          "csharp"
        ],
        "description": "Deserialize calls following a local var declaration constructed with BinaryFormatter; this is an explicit sequence rule."
      },
      {
        "id": "syndical.csharp.credential-logging",
        "severity": "high",
        "languages": [
          "csharp"
        ],
        "description": "Direct logger arguments named password, token or private key; this is not a dataflow rule."
      }
    ],
    "duplication": {
      "minLines": 5,
      "minTokens": 50,
      "mode": "mild"
    },
    "methodology": {
      "revision": "csharp-source-v1",
      "csharp": {
        "version": "1.0.0",
        "dataRecordReviews": "tools/quality/csharp-data-records.json"
      }
    }
  },
  "tools": [
    {
      "name": "jscpd",
      "version": "5.4.0",
      "license": "MIT"
    },
    {
      "name": "OpenGrep",
      "version": "1.30.0",
      "license": "LGPL-2.1"
    },
    {
      "name": ".NET SDK analyzers",
      "version": "10.0.401",
      "license": "MIT"
    },
    {
      "name": "Microsoft (R) Visual C# Compiler",
      "version": "5.9.0-1.26423.113 (e34a38d2ae1fc26406a317517196e55c68ff83ab)",
      "license": "MIT"
    },
    {
      "name": "Syndical C# source syntax",
      "version": "1.0.0",
      "license": "MIT"
    }
  ],
  "scope": {
    "selectedFiles": 16,
    "byLanguage": {
      "csharp": 16
    },
    "exclusions": {
      "roots": [
        "src/"
      ],
      "extensions": [
        ".cs"
      ],
      "excludedSegments": [
        "tests",
        "fixtures",
        "bin",
        "obj"
      ],
      "excludedSuffixes": [
        ".g.cs",
        ".generated.cs"
      ],
      "excludedPrefixes": []
    }
  },
  "measurements": {
    "native": {
      "status": "measured",
      "selectedFiles": 16,
      "analyzedFiles": 16,
      "filesWithFindings": 0,
      "totalFindings": 0,
      "errors": []
    },
    "functions": {
      "status": "measured",
      "selectedFiles": 16,
      "analyzedFiles": 16,
      "totalFunctions": 147,
      "compliantFunctions": 147,
      "violatingFunctions": 0,
      "limits": {
        "maxComplexity": 15,
        "maxFunctionLines": 80,
        "maxParameters": 5
      },
      "instruments": [
        {
          "name": "Syndical C# source syntax",
          "version": "1.0.0",
          "files": 16,
          "functions": 147,
          "lengthDefinition": "Nonempty physical source lines including comments and nested bodies; primary constructor header/initializer region union",
          "methodology": "csharp-source-v1",
          "qualifiedCases": 59,
          "sourceSha256": "f42ece50c4ff1a1c5c743e9fb76e28ec3afa527ad19fbbb04d98278db1a45dd7",
          "sdkRuntimeIdentifier": "osx-arm64"
        }
      ],
      "executableDeclarations": {
        "total": 59,
        "compliant": 59,
        "violating": 0,
        "executable": 57,
        "violatingExecutable": 0,
        "wideRecords": 2,
        "reviewedWideRecords": 2,
        "unreviewedWideRecords": 0
      },
      "errors": []
    },
    "duplication": {
      "status": "measured",
      "selectedFiles": 16,
      "analyzedFiles": 16,
      "cloneEligibleFiles": 15,
      "belowMinimumTokenFiles": 1,
      "totalTokens": 15294,
      "duplicatedTokens": 0,
      "duplicatedTokenPercent": 0,
      "errors": []
    },
    "sast": {
      "status": "measured",
      "selectedFiles": 16,
      "analyzedFiles": 16,
      "ruleCount": 4,
      "qualifiedRules": 4,
      "counts": {
        "critical": 0,
        "high": 0,
        "medium": 0,
        "low": 0,
        "info": 0
      },
      "errors": []
    }
  },
  "limitations": [
    "Scores measure compliance with this named profile; profiles can differ between languages and repositories.",
    "Quality measures configured native warnings and errors, not functional correctness or test effectiveness.",
    "Swift and Python functions are recognized heuristically by Lizard. JavaScript/TypeScript uses the TypeScript syntax tree.",
    "C# uses the pinned Roslyn source syntax inventory across every conditional-symbol assignment; this is not a compiled control-flow or semantic correctness proof.",
    "C# length counts nonempty physical declaration lines including comments and nested code. Primary constructors count only their header and executable initializer regions.",
    "Executable declarations have separate compliance; wide records require exact reviewed data-shape identities. Neither adds synthesized functions to the function denominator.",
    "Security covers only the named qualified rules. Dependencies, secrets, runtime behavior and broader dataflow are not assessed here.",
    "No overall quality or human-superiority claim is supported by this scorecard."
  ],
  "finishedAt": "2026-10-05T23:06:17.721Z",
  "scores": {
    "quality": {
      "status": "measured",
      "value": 100,
      "label": "Quality",
      "explanation": "Percentage of checked production files with no configured analyzer warnings or errors.",
      "numerator": 16,
      "denominator": 16,
      "details": {
        "filesWithFindings": 0,
        "totalFindings": 0
      }
    },
    "maintainability": {
      "status": "measured",
      "value": 100,
      "label": "Maintainability",
      "explanation": "The lowest compliance score for actual functions, executable declarations and tokens without detected duplication.",
      "numerator": 147,
      "denominator": 147,
      "details": {
        "functionScore": 100,
        "duplicationScore": 100,
        "declarationComponent": {
          "score": 100,
          "total": 59,
          "compliant": 59,
          "violating": 0
        },
        "duplicatedTokenPercent": 0,
        "limits": {
          "maxComplexity": 15,
          "maxFunctionLines": 80,
          "maxParameters": 5
        }
      }
    },
    "security": {
      "status": "no-findings",
      "risk": "none",
      "label": "Security checks",
      "counts": {
        "critical": 0,
        "high": 0,
        "medium": 0,
        "low": 0,
        "info": 0
      },
      "ruleCount": 4,
      "explanation": "Highest observed risk in the named, qualified rules. No findings is not a comprehensive security audit."
    }
  },
  "gate": {
    "status": "passed",
    "baselinePresent": true,
    "newFindings": 0,
    "duplicationRegression": false,
    "reasons": []
  },
  "evidenceSha256": "bb664c744378e946958b41eda72af17725b7cb2c9d677110fe913f5ebc850577"
}