{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-13T23:57:35.238241Z","repo":{"ref":{"host":"github.com","owner":"andrewosh","name":"cellarium"},"default_branch":"main","clone_url":"https://github.com/andrewosh/cellarium.git","html_url":"https://github.com/andrewosh/cellarium","description":"A playground for cellular automata","stars":43,"forks":3,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":33272,"primary_language":"Rust","license_spdx":"Apache-2.0","created_at":"2026-02-20T23:02:20Z","pushed_at":"2026-03-06T21:53:26Z","security_policy_url":null,"distribution":{"owner_created_at":"2011-09-12T01:07:33Z","owner_type":"User","release_assets":[]}},"commit_sha":"92e55d2d3011962d7b9dbb24f8b35f6b1426a6e1","profile":{"lines_by_language":{"Rust":5760},"files_by_category":{"source":33,"config":5,"docs":4,"oversized":3,"binary":1},"source_lines":5760,"test_lines":0},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.44,"coverage":1.0,"label":"none-detected","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":null},"summary":"No AI attribution or AI-consistent velocity signals detected."},"quality":{"score":42.8,"confidence":0.9,"coverage":1.0,"label":"poor","breakdown":{"complexity":29.1,"duplication":60.3,"lint":100.0,"testing":0.0,"docs":65.0,"type_safety":null,"process":null},"summary":"Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 41% of function code in complex or long functions; 8% duplicated lines. Weakest area: testing."},"security":{"score":81.3,"confidence":0.85,"coverage":1.0,"label":"adequate","breakdown":{"secrets":100.0,"sast":98.5,"dependencies":null,"ci_actions":null,"posture":0.0,"scorecard":null},"summary":"Security posture is adequate: no high-impact findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":12.0,"checked":12.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":17.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":6041.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2026-02":{"loc":4699,"attributed_loc":0},"2026-03":{"loc":1342,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":5.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":2065.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":242.0,"median_loc_per_hour":102.01923076923077,"pr_timed_units":0.0,"excluded_import_loc":3976.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":["85426907dfc5d6ef79dd2d39d0f3d5c05deb475c"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":5760.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":1.0,"findings_high":0.0,"findings_medium":0.0,"findings_low":1.0,"weighted_findings":0.25,"scanned_lines":5760.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/rust.lang.security.args","severity":"low","message":"args should not be used for security operations. From the docs: \"The first element is traditionally the path of the executable, but it can be set to arbitrary text, and might not even exist. This means this property should not be relied upon for security purposes.\" [confidence high]","path":"src/runtime.rs","line":83,"fingerprint":"rust.lang.security.args:src/runtime.rs:83"}],"evidence":[],"data":{"rulesets":["rust"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":0.0,"signed_commit_share":0.0588,"unpinned_manifests":2.0},"findings":[],"evidence":[{"kind":"posture","description":"Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"macros/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"macros/Cargo.toml","url":null,"weight":0.3}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":252.0,"function_nloc":4229.0,"mean_ccn":4.13,"p90_ccn":9.0,"complex_functions":14.0,"long_functions":6.0,"many_param_functions":0.0,"risky_nloc_share":0.4117},"findings":[],"evidence":[{"kind":"complex-function","description":"emit_spatial_op in macros/src/lower.rs: complexity 55, 268 lines","ref":"macros/src/lower.rs","url":"https://github.com/andrewosh/cellarium/blob/92e55d2d3011962d7b9dbb24f8b35f6b1426a6e1/macros/src/lower.rs#L744","weight":0.9166666666666666},{"kind":"complex-function","description":"emit_method_call in macros/src/lower.rs: complexity 49, 88 lines","ref":"macros/src/lower.rs","url":"https://github.com/andrewosh/cellarium/blob/92e55d2d3011962d7b9dbb24f8b35f6b1426a6e1/macros/src/lower.rs#L505","weight":0.8166666666666667},{"kind":"complex-function","description":"window_event in src/runtime.rs: complexity 48, 206 lines","ref":"src/runtime.rs","url":"https://github.com/andrewosh/cellarium/blob/92e55d2d3011962d7b9dbb24f8b35f6b1426a6e1/src/runtime.rs#L640","weight":0.8},{"kind":"complex-function","description":"emit_fused_spatial_ops in macros/src/lower.rs: complexity 43, 143 lines","ref":"macros/src/lower.rs","url":"https://github.com/andrewosh/cellarium/blob/92e55d2d3011962d7b9dbb24f8b35f6b1426a6e1/macros/src/lower.rs#L1109","weight":0.7166666666666667},{"kind":"complex-function","description":"validate_expr in macros/src/check.rs: complexity 38, 80 lines","ref":"macros/src/check.rs","url":"https://github.com/andrewosh/cellarium/blob/92e55d2d3011962d7b9dbb24f8b35f6b1426a6e1/macros/src/check.rs#L31","weight":0.6333333333333333},{"kind":"complex-function","description":"run_tui in src/tui.rs: complexity 28, 77 lines","ref":"src/tui.rs","url":"https://github.com/andrewosh/cellarium/blob/92e55d2d3011962d7b9dbb24f8b35f6b1426a6e1/src/tui.rs#L236","weight":0.4666666666666667},{"kind":"complex-function","description":"expr_spatial_needs in macros/src/lower.rs: complexity 26, 65 lines","ref":"macros/src/lower.rs","url":"https://github.com/andrewosh/cellarium/blob/92e55d2d3011962d7b9dbb24f8b35f6b1426a6e1/macros/src/lower.rs#L222","weight":0.43333333333333335},{"kind":"complex-function","description":"discover_fields_in_expr in macros/src/lower.rs: complexity 25, 66 lines","ref":"macros/src/lower.rs","url":"https://github.com/andrewosh/cellarium/blob/92e55d2d3011962d7b9dbb24f8b35f6b1426a6e1/macros/src/lower.rs#L96","weight":0.4166666666666667},{"kind":"complex-function","description":"emit_expr_with_prefix in macros/src/lower.rs: complexity 24, 50 lines","ref":"macros/src/lower.rs","url":"https://github.com/andrewosh/cellarium/blob/92e55d2d3011962d7b9dbb24f8b35f6b1426a6e1/macros/src/lower.rs#L1035","weight":0.4},{"kind":"complex-function","description":"cell_impl in macros/src/parse.rs: complexity 24, 82 lines","ref":"macros/src/parse.rs","url":"https://github.com/andrewosh/cellarium/blob/92e55d2d3011962d7b9dbb24f8b35f6b1426a6e1/macros/src/parse.rs#L55","weight":0.4}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":4068.0,"duplicated_lines":343.0,"duplicated_share":0.0843,"files":33.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: examples/coupled_logistic.rs:11 and examples/kaneko_cml.rs:11","ref":"examples/coupled_logistic.rs","url":"https://github.com/andrewosh/cellarium/blob/92e55d2d3011962d7b9dbb24f8b35f6b1426a6e1/examples/coupled_logistic.rs#L11","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: macros/src/lower.rs:165 and macros/src/lower.rs:1036","ref":"macros/src/lower.rs","url":"https://github.com/andrewosh/cellarium/blob/92e55d2d3011962d7b9dbb24f8b35f6b1426a6e1/macros/src/lower.rs#L165","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/pipeline.rs:167 and src/pipeline.rs:188","ref":"src/pipeline.rs","url":"https://github.com/andrewosh/cellarium/blob/92e55d2d3011962d7b9dbb24f8b35f6b1426a6e1/src/pipeline.rs#L167","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/runtime.rs:225 and src/runtime.rs:384","ref":"src/runtime.rs","url":"https://github.com/andrewosh/cellarium/blob/92e55d2d3011962d7b9dbb24f8b35f6b1426a6e1/src/runtime.rs#L225","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/texture.rs:99 and src/texture.rs:110","ref":"src/texture.rs","url":"https://github.com/andrewosh/cellarium/blob/92e55d2d3011962d7b9dbb24f8b35f6b1426a6e1/src/texture.rs#L99","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":0.0,"weighted_findings":0.0,"scanned_lines":5760.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":0.0,"check:test_ratio":0.0,"check:ci_present":0.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.0,"test_lines":0.0,"source_lines":5760.0,"test_ratio":0.0,"ci_files":0.0,"cochange_share":0.0,"cochange_commits":7.0},"findings":[],"evidence":[],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":239.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}