ajay-sainy/GemOfGemma

• Repository: https://github.com/ajay-sainy/GemOfGemma
• Commit: e1c006e637972bc5780ffd1ee46da1184dd73c39
• Generated: 2026-11-13T23:56:16+00:00
• Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2

Scores

AI provenance

No AI attribution or AI-consistent velocity signals detected.

• Explicitly attributed share (lower bound): 0.0%

• Unattributed share in AI-consistent velocity bursts: 0.0%

• Estimated AI-generated share: 0.0%

• Stylometry index: 1.04 per 1,000 lines (narrated steps 0, placeholders 0, assistant phrasing 0, emoji 21). Reported as a signal, not scored.

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is weak: test-to-source ratio 0.00, no CI test run detected; 15% of function code in complex or long functions; 13% duplicated lines. Weakest area: testing.

• Functions: 348; mean complexity 2.7, 90th percentile 6; 5 complex and 4 long functions
• Duplicated lines: 12.6% of 6,369 compared
• Tests: 0 test lines for 10,090 source lines (ratio 0.00); CI test commands: none detected; 0% of recent source commits also change tests
• Docs missing or thin: contributing, changelog

Most complex functions:

• executeAction in actions/src/main/java/com/gemofgemma/actions/ActionDispatcher.kt: complexity 24, 35 lines
• ChatBubble in ui/src/main/java/com/gemofgemma/ui/chat/ChatScreen.kt: complexity 24, 105 lines
• getToolIdForFunction in actions/src/main/java/com/gemofgemma/actions/ActionDispatcher.kt: complexity 22, 26 lines
• findRoleKeywordMatch in .squad/templates/ralph-triage.js: complexity 18, 24 lines
• downloadModel in ai/src/main/java/com/gemofgemma/ai/model/ModelDownloadManager.kt: complexity 17, 68 lines

Security

Security posture is weak: 15 high-severity workflow issues. Weakest area: posture.

• Posture checks passed: none; missing: security policy, dependency updates, signed commits, lockfiles

Top findings

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Distribution signals

• binary-release-asset: release v1.0.3 ships GemOfGemma-1.0.3-arm64-v8a.apk (389 downloads)
• binary-release-asset: release v1.0.3 ships GemOfGemma-1.0.3-armeabi-v7a.apk (48 downloads)
• binary-release-asset: release v1.0.3 ships GemOfGemma-1.0.3-universal.apk (91 downloads)
• binary-release-asset: release v1.0.3 ships GemOfGemma-1.0.3-x86_64.apk (14 downloads)
• binary-release-asset: release v1.0.2 ships GemOfGemma-1.0.2-arm64-v8a.apk (4 downloads)

Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.

Repository profile

• Source lines: 10,090; test lines: 0