Syndical

Quality & evidence

Measured code quality.
Published evidence.

Dated source checks for Syndical Desktop, Mobile, Site and API. Inspect measured compliance, remaining findings and the scope of each published snapshot.

Inspect the results How these scores are measured

The current record

Measured on our own repositories

Download scorecards

Each result describes the checks that actually ran. A passing check covers its stated scope; it does not establish the quality of the whole system.

Commands and policy are provided. Rerunning source checks requires access to the measured repositories.

Syndical

Quality

100/100

Maintainability

100/100

Static security checks

No findings

0 critical · 0 high · 0 medium · 0 low
5 qualified rules · findings require review

2107 / 2107 files without configured warnings or errors.

28144 / 28144 actual functions within every limit. 0.00% of tokens duplicated.

Measured 5 October 2026 · db4a57882042

Coverage & evidence

2107 selected production files. csharp: 1800 · javascript: 8 · typescript: 299.

  • Native checks: 2107 / 2107 files analyzed
  • Function analysis: 2107 / 2107 files analyzed
  • Duplication: 2107 / 2107 files analyzed
  • Security checks: 2107 / 2107 files analyzed

Function limits: complexity ≤ 15, lines ≤ 80, parameters ≤ 5. Maintainability takes the lowest of 100% function compliance, 100% duplication-free tokens and 100% declaration compliance. 970 / 970 executable or wide-data declarations comply; 0 remain outside the reviewed contract. Function parsing limitations are recorded below.

Methodology: csharp-source-v1. C# source syntax version 1.0.0; actual callable bodies and separately reviewed declarations.

Duplication: at least 5 lines and 50 tokens, mild mode.

Qualified security checks

  • HttpClientHandler certificate callbacks that explicitly accept every certificate. (high; csharp).
  • Explicit rejectUnauthorized:false settings and NODE_TLS_REJECT_UNAUTHORIZED=0 assignments. (high; javascript, typescript).
  • BrowserWindow object literals explicitly disabling context isolation. (high; javascript, typescript).
  • BrowserWindow object literals explicitly enabling renderer Node integration. (medium; javascript, typescript).
  • Direct console arguments named password, token, key or client secret; this is not a dataflow rule. (high; javascript, typescript).

Included roots: apps/, libs/. Extensions: .cs, .ts, .tsx, .js, .jsx, .mjs.

Excluded paths and suffixes: test, tests, fixtures, bin, obj, node_modules, out, dist, resources, .test.ts, .test.tsx, .spec.ts, .spec.tsx, .d.ts, .g.cs, .generated.cs.

Gate: passed. This methodology requires a zero-debt baseline; measured debt cannot pass the gate.

Findings beyond the zero-debt baseline: 0.

Policy: syndical-oss-quality-v2

  • Scores measure compliance with this named profile; profiles can differ between languages and repositories.
  • Quality measures configured native warnings and errors, not functional correctness or test effectiveness.
  • Swift and Python functions are recognized heuristically by Lizard. JavaScript/TypeScript uses the TypeScript syntax tree.
  • C# uses the pinned Roslyn source syntax inventory across every conditional-symbol assignment; this is not a compiled control-flow or semantic correctness proof.
  • C# length counts nonempty physical declaration lines including comments and nested code. Primary constructors count only their header and executable initializer regions.
  • Executable declarations have separate compliance; wide records require exact reviewed data-shape identities. Neither adds synthesized functions to the function denominator.
  • Security covers only the named qualified rules. Dependencies, secrets, runtime behavior and broader dataflow are not assessed here.
  • No overall quality or human-superiority claim is supported by this scorecard.
Download full scorecard

Report SHA-256 58353eb6a24693433c57e9e865e11985546456a979f93eb16bb630b24e1fc502

Syndical.mobile

Quality

100/100

Maintainability

100/100

Static security checks

No findings

0 critical · 0 high · 0 medium · 0 low
4 qualified rules · findings require review

45 / 45 files without configured warnings or errors.

474 / 474 recognized functions within every limit. 0.00% of tokens duplicated.

Measured 5 October 2026 · 9ce8d9f98455 + recorded changes

Coverage & evidence

45 selected production files. swift: 45.

  • Native checks: 45 / 45 files analyzed
  • Function analysis: 45 / 45 files analyzed
  • Duplication: 45 / 45 files analyzed
  • Security checks: 45 / 45 files analyzed

Function limits: complexity ≤ 15, lines ≤ 80, parameters ≤ 5. Maintainability takes the lowest of 100% function compliance, 100% duplication-free tokens. Function parsing limitations are recorded below.

Duplication: at least 5 lines and 50 tokens, mild mode.

Qualified security checks

  • Direct MD5/SHA-1 calls require a non-security rationale or a modern cryptographic algorithm. (high; swift).
  • Direct UserDefaults.standard writes with explicit credential key names. (high; swift).
  • Enabling universal network access from WebView file URLs. (high; swift).
  • Passing copied trust exceptions straight back into TLS trust evaluation. (high; swift).

Included roots: SyndicalApp/Sources/, SyndicalApp/App/. Extensions: .swift.

Excluded paths and suffixes: tests, uitests, fixtures, .build, build, deriveddata, desktopviews, assets.xcassets, resources, Fixtures.swift, ConnectionUITestFixture.swift.

Gate: passed. Accepted existing findings still count in these scores.

Findings beyond the accepted baseline: 0.

Policy: syndical-mobile-quality-v1

  • Scores measure compliance with this named profile; profiles can differ between languages and repositories.
  • Quality measures configured native warnings and errors, not functional correctness or test effectiveness.
  • C#, Swift and Python functions are recognized heuristically by Lizard; their detection is not compiler-proven complete. JavaScript/TypeScript uses the TypeScript syntax tree.
  • Security covers only the named qualified rules. Dependencies, secrets, runtime behavior and broader dataflow are not assessed here.
  • No overall quality or human-superiority claim is supported by this scorecard.
Download full scorecard

Report SHA-256 0ee7ff6d58185988bbd67e21e90f291224c0c0bf88d20710ef835303ccc66c92

Syndical.site

Quality

100/100

Maintainability

100/100

Static security checks

No findings

0 critical · 0 high · 0 medium · 0 low
2 qualified rules · findings require review

69 / 69 files without configured warnings or errors.

313 / 313 recognized functions within every limit. 0.00% of tokens duplicated.

Measured 5 October 2026 · c943d3d45c3e + recorded changes

Coverage & evidence

69 selected production files. javascript: 6 · python: 8 · typescript: 55.

  • Native checks: 69 / 69 files analyzed
  • Function analysis: 69 / 69 files analyzed
  • Duplication: 69 / 69 files analyzed
  • Security checks: 69 / 69 files analyzed

Function limits: complexity ≤ 15, lines ≤ 80, parameters ≤ 5. Maintainability takes the lowest of 100% function compliance, 100% duplication-free tokens. Function parsing limitations are recorded below.

Duplication: at least 5 lines and 50 tokens, mild mode.

Qualified security checks

  • Credential-shaped values passed directly to browser console methods (high; typescript, javascript).
  • Explicit shell=True subprocess calls require review (medium; python).

Included roots: app/, components/, icons/, illustrations/, lib/, providers/, infra/, next.config.ts, postcss.config.mjs. Extensions: .ts, .tsx, .js, .mjs, .py.

Excluded paths and suffixes: test, tests, fixtures, node_modules, dist, __pycache__, .test.ts, .test.tsx, .test.mjs, .d.ts, infra/test_.

Gate: passed. Accepted existing findings still count in these scores.

Findings beyond the accepted baseline: 0.

Policy: syndical-site-quality-v1

  • Scores measure compliance with this named profile; profiles can differ between languages and repositories.
  • Quality measures configured native warnings and errors, not functional correctness or test effectiveness.
  • C#, Swift and Python functions are recognized heuristically by Lizard; their detection is not compiler-proven complete. JavaScript/TypeScript uses the TypeScript syntax tree.
  • Security covers only the named qualified rules. Dependencies, secrets, runtime behavior and broader dataflow are not assessed here.
  • No overall quality or human-superiority claim is supported by this scorecard.
Download full scorecard

Report SHA-256 c2a1578e39a47953b885e49f0a4531c67f850fc0e38a8c81f0ecaf4a1d563196

Syndical.api

Quality

100/100

Maintainability

100/100

Static security checks

No findings

0 critical · 0 high · 0 medium · 0 low
4 qualified rules · findings require review

16 / 16 files without configured warnings or errors.

147 / 147 actual functions within every limit. 0.00% of tokens duplicated.

Measured 6 October 2026 · e6ca1d5f7191

Read the API score history and policy changes
Coverage & evidence

16 selected production files. csharp: 16.

  • Native checks: 16 / 16 files analyzed
  • Function analysis: 16 / 16 files analyzed
  • Duplication: 16 / 16 files analyzed
  • Security checks: 16 / 16 files analyzed

Function limits: complexity ≤ 15, lines ≤ 80, parameters ≤ 5. Maintainability takes the lowest of 100% function compliance, 100% duplication-free tokens and 100% declaration compliance. 59 / 59 executable or wide-data declarations comply; 0 remain outside the reviewed contract. Function parsing limitations are recorded below.

Methodology: csharp-source-v1. C# source syntax version 1.0.0; actual callable bodies and separately reviewed declarations.

Duplication: at least 5 lines and 50 tokens, mild mode.

Qualified security checks

  • Explicit HttpClientHandler callbacks that accept every certificate. (high; csharp).
  • Explicit MD5/SHA1 Create and HashData calls; cryptographic context is not inferred. (high; csharp).
  • Deserialize calls following a local var declaration constructed with BinaryFormatter; this is an explicit sequence rule. (high; csharp).
  • Direct logger arguments named password, token or private key; this is not a dataflow rule. (high; csharp).

Included roots: src/. Extensions: .cs.

Excluded paths and suffixes: tests, fixtures, bin, obj, .g.cs, .generated.cs.

Gate: passed. This methodology requires a zero-debt baseline; measured debt cannot pass the gate.

Findings beyond the zero-debt baseline: 0.

Policy: syndical-api-oss-quality-v2

  • Scores measure compliance with this named profile; profiles can differ between languages and repositories.
  • Quality measures configured native warnings and errors, not functional correctness or test effectiveness.
  • Swift and Python functions are recognized heuristically by Lizard. JavaScript/TypeScript uses the TypeScript syntax tree.
  • C# uses the pinned Roslyn source syntax inventory across every conditional-symbol assignment; this is not a compiled control-flow or semantic correctness proof.
  • C# length counts nonempty physical declaration lines including comments and nested code. Primary constructors count only their header and executable initializer regions.
  • Executable declarations have separate compliance; wide records require exact reviewed data-shape identities. Neither adds synthesized functions to the function denominator.
  • Security covers only the named qualified rules. Dependencies, secrets, runtime behavior and broader dataflow are not assessed here.
  • No overall quality or human-superiority claim is supported by this scorecard.
Download full scorecard

Report SHA-256 33b820199014191666d9437bdb83bbc4c936e6822e657c985c74395b12fec70b

Read the published score history
How to read these scores

Quality is the percentage of checked production files with no configured native warnings or errors. Build and test outcomes remain separate evidence below.

Maintainability is the lowest of function compliance and duplication-free tokens, plus declaration compliance in the C# source methodology. Scores round down; 100 requires complete compliance with the stated profile.

Security shows the highest flagged severity and findings to review in qualified rules. Missing or incomplete scans say Not measured. No findings does not mean the system is proven safe.

Profiles differ by language and repository. These scores describe their stated scope, not a ranking across projects or evidence of superiority to human development. There is no blended overall score.

Build, test & earlier measurement evidence

Syndical

Local measured checks passed

Desktop application and orchestration runtime

  • .NET regression testsPassed

    9,183 of 9,183 cases passed; 0 failed and 0 skipped. All 16 test projects completed without a test filter. This is the retained qualified test snapshot, with the declared subsequent source changes available in the evidence.

  • TypeScript regression testsPassed

    2,037 of 2,037 cases passed across both workspaces; 0 failed and 0 skipped. These checks ran after the dependency update and again after the qualified whitespace cleanup.

  • Quality tool regression testsPassed

    66 of 66 cases passed in the original checkout after the reviewed three-platform compiler catalog update; 0 failed, cancelled, skipped or pending.

  • TypeScript typecheckPassed

    The configured workspace typechecks passed after the dependency update; those application inputs remain unchanged.

  • Desktop production buildPassed

    The desktop production build passed after the dependency update; those application inputs remain unchanged.

  • Configured source lintPassed

    All 295 reported source files completed with zero errors, warnings, fatal findings or suppressed messages after the dependency update.

  • Production source compliancePassed

    The clean committed source measures 100/100 for quality and maintainability: zero configured native, function, declaration, duplication and five qualified static-rule findings across all 2,107 selected files.

  • npm dependency advisoriesPassed

    0 dependency entries flagged in the retained fresh npm audit, including production and development dependencies. All reported severity totals were zero; the dependency lock remains unchanged.

Measured 5 October 2026 · revision db4a57882042

All 9,183 .NET cases passed on the retained test snapshot. Subsequent source mapping records the dependency/document/baseline changes and qualified whitespace cleanup in exactly 37 C# files, then the reviewed compiler-tool, catalog, CI and baseline updates. Application and solution regression inputs remain equal to the prior qualified application commit; the quality tool has separately declared C# identity changes. The 2,037 frontend cases passed after the whitespace cleanup; the updated quality tools passed 66 cases and the C# instrument passed 59 cases on macOS ARM64. No full .NET suite rerun at this commit, whole-repository byte identity or latest hosted CI pass is claimed.

Scope, limitations & reproduction

Source content SHA-25604da3f69b6a2b1e15fa23dbb3cf1c1c81fd65692f4c4b752fad018b0356fb130

Read the full measurement report
Qualified build and test measurement · 2026-10-05

The prior published 100/100 source assessment and its qualified 9,183-case .NET run, 2,037 frontend cases, 54 quality-tool cases and zero-advisory dependency audit are retained with their original source and policy metadata.

Build and test measurement · 3 October 2026

6,854 of 6,857 .NET cases passed, with 3 failures and no skips. All 1,482 frontend cases passed; npm flagged 12 dependency entries. These are the original dated outcomes and are retained without changing their source or policy metadata.

Measurement methodology and scope

Read the exact scope, reproduction commands, measurement limitations and proposed controlled comparison for this snapshot.

Measurement policy · 3 October 2026

The original machine-readable policy used for this measurement.

Initial baseline · 3 October 2026

The initial run, using instrument revision 938ac2978b1a on source c487d771442d, recorded 7 TypeScript test failures and 12 dependency entries flagged (10 high-severity). The .NET measurement was incomplete after an earlier 20-minute instrument limit; its test counts cover only 15 of 16 projects. This snapshot uses earlier instrumentation and is not an equivalent-scope comparison.

Initial baseline measurement policy

The original baseline policy is retained alongside its report.

Intermediate measurement · 3 October 2026

At revision bf73ebf41c8f, 2 TypeScript tests failed and npm flagged 12 dependency entries. The .NET measurement covers 15 of 16 projects, with 2 failures in those completed projects. A nonterminating test fixture required an explicit stop of the orchestration test project; this was an operator intervention, not a configured deadline. Incomplete counts are not full-suite totals.

Full measurement at dc5861d3 · 3 October 2026

All 16 .NET test projects completed: 6,819 of 6,857 tests passed and 38 failed, with no skips. All 1,482 TypeScript tests passed; npm flagged 12 dependency entries. The failed .NET run is retained here as measured. Subsequent fixture corrections belong to a later source snapshot and do not change this report.

Measurement policy used at dc5861d3

The original policy is retained for this completed attempt. Its scanner size setting comes from the immutable source snapshot, and comparability requires the actual measured-file inventory.

  • The full .NET runtime suite was not rerun at this final commit. The retained 9,183-case run and finite source-chain evidence identify the exact subsequent changes; whole-repository identity with the tested snapshot is false.
  • The C# instrument completed 59 qualification cases on macOS ARM64. macOS Intel and Linux x64 compiler pins were independently reviewed from official SDK archives; this report does not claim execution of the Linux SDK or a passing hosted build for the latest revision.
  • The static security result covers the five published qualified rules. It is not a claim of complete security coverage or an independent security audit.
  • Earlier failed and incomplete measurements remain dated historical evidence with their original outcomes and policy identities.
  • Coverage effectiveness, hidden or seeded defect detection, independent maintainability, production reliability and controlled human comparison remain unmeasured.

.NET regression tests

dotnet test Syndical.sln --no-restore --nologo --disable-build-servers --logger trx -m:1 -p:UseSharedCompilation=false -nodeReuse:falseDownload evidence

TypeScript regression tests

npm testDownload evidence

Quality tool regression tests

npm run quality:test:scoreDownload evidence

TypeScript typecheck

npm run typecheckDownload evidence

Desktop production build

npm run buildDownload evidence

Configured source lint

npm exec -- eslint apps/desktop/src libs/ipc-client-ts/src --format jsonDownload evidence

Production source compliance

npm run quality:analyzeDownload evidence

npm dependency advisories

npm audit --jsonDownload evidence

Syndical.mobile

Measured source checks passed

Native mobile application

  • Production source compliancePassed

    100/100 quality and 100/100 maintainability, with 474 compliant functions, zero native or detected duplication findings, and no matches in the four qualified static rules.

Measured 5 October 2026 · revision 9ce8d9f98455

The original 9ce8 measurement and dirty working-tree metadata are retained. Its 45 measured production files and policy inputs match remote main df6d832; the local unpublished revision differs in machine configuration. This is production-source equivalence evidence, not a fresh clean remote scan.

Scope, limitations & reproduction

Source content SHA-256f4037efddb1972cb697eb55cb38ce5df39fa03d0bdb5c05e1906ae869c47cf60

Read the full measurement report
  • The exact dated source report remains unchanged. Its published source revision is not described as the remote main commit.
  • The four qualified static rules do not establish comprehensive security or runtime correctness.

Production source compliance

node tools/quality/oss/run.mjs --profile infra/quality/profile.jsonDownload evidence

Syndical.site

Local measured checks passed

The public website you are reading

  • Production build and typecheckPassed

    The standalone production build and explicit TypeScript typecheck passed after the three-platform report-consumer patch.

  • Delivery helper regression testsPassed

    68 Python cases passed, including the actual production-build integration check.

  • Report-consumer regression testsPassed

    63 Node cases passed; 0 failed, cancelled, skipped or pending. These cases checked the preserved histories and strict instrument identities before this evidence import.

  • Production source compliancePassed

    Quality 100/100 and maintainability 100/100: all 69 files and 313 functions comply; native, duplication and both qualified static security-rule findings are zero.

  • npm dependency advisoriesPassed

    The fresh npm audit reported zero dependency advisories at every severity.

Measured 5 October 2026 · revision c943d3d45c3e

The reviewed report-consumer source patch was measured before commit together with four preserved local machine settings. All 69 selected production files and 313 recognized functions comply under the unchanged profile; this is a dated working-tree assessment, not a clean whole-repository scan.

Scope, limitations & reproduction

Source content SHA-2563a63f77d2f15f326d6744c67a596905ffb5743acff460ec9f5617b5acbf37312

Read the full measurement report
Build and test measurement · 3 October 2026

Original 64-test, build and audit results are retained with their source identity.

  • The source metadata records the actual local working tree; local machine configuration stays private. Public evidence exports are excluded from source identity to avoid self-hashing.
  • The static security result covers only the two published qualified rules. Hosted CI and live publication are separate delivery checks.
  • Coverage effectiveness, production reliability and controlled human comparison remain unmeasured.

Production build and typecheck

npm run build; node node_modules/typescript/bin/tsc --noEmitDownload evidence

Delivery helper regression tests

python3 -B -m unittest discover -s infra -p test_*.pyDownload evidence

Report-consumer regression tests

node --test infra/quality/qualify.test.mjs infra/quality/publish-scorecards.test.mjs infra/quality/csharp-scorecard.test.mjsDownload evidence

Production source compliance

node tools/quality/oss/run.mjs --profile infra/quality/profile.jsonDownload evidence

npm dependency advisories

npm audit --jsonDownload evidence

Syndical.api

Local measured checks passed

Notification API

  • Production source compliancePassed

    100/100 quality and 100/100 maintainability; zero native, function, declaration, duplication and four qualified static security-rule findings across all 16 selected files.

  • Quality tool regression testsPassed

    61 Node cases passed in the original API checkout after the reviewed vendor update; zero failures and skips. The C# instrument separately passed 59 cases on macOS ARM64.

Measured 6 October 2026 · revision e6ca1d5f7191

Clean pushed main source: all 16 selected files, 147 callable variants and 59 declarations comply. Application and solution regression inputs remain byte-identical to the previously qualified 8248 API source. The updated quality tools have separate source changes; this assessment does not claim a new API runtime suite or hosted Linux run.

Scope, limitations & reproduction

Source content SHA-256bd97544120762ad45d6b3350ab180b8b87adcd64c455cf2fe4911af06ca41824

Read the full measurement report
Earlier API source assessment · 5 October 2026

The prior clean 8248 report and its original policy identity are retained.

  • No new API runtime suite rerun is claimed at this commit; the 16 application source files remain byte-identical to the earlier qualified source.
  • The four published static rules are bounded security coverage. This local report does not claim hosted Linux execution or a passing hosted build.

Production source compliance

node tools/quality/oss/run.mjs --profile tools/quality/profile.jsonDownload evidence

Quality tool regression tests

node --test --test-reporter=tap tools/quality/oss/baseline.test.mjs tools/quality/oss/bootstrap.test.mjs tools/quality/oss/csharp-metrics.test.mjs tools/quality/oss/declarations.test.mjs tools/quality/oss/process-log.test.mjs tools/quality/oss/run.test.mjs tools/quality/oss/scores.test.mjs tools/quality/oss/typescript-metrics.test.mjs tools/quality/adapters/api.test.mjsDownload evidence

Still to measure

  • Coverage of changed code
  • Test effectiveness against hidden or seeded defects
  • Security beyond the published static rules and dependency advisories
  • Independent maintainability assessment
  • Complexity and duplication trends
  • Escaped defects and production reliability
  • Controlled comparison with human development