mikayla-maki/loom

• Repository: https://github.com/mikayla-maki/loom
• Commit: 0d2ef7c8a88ff1c32d641bc06cfebdf05af73048
• Generated: 2026-11-13T23:54:51+00:00
• Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2

Scores

AI provenance

Explicit AI attribution on 46% of first-party code added; an estimated 46% including velocity signals.

• Explicitly attributed share (lower bound): 46.0%
• Unattributed share in AI-consistent velocity bursts: 19.8%
• Estimated AI-generated share: 46.0%

Current source lines last changed by AI-attributed commits: 6,448 of 21,395.

• Stylometry index: 0.26 per 1,000 lines (narrated steps 0, placeholders 0, assistant phrasing 0, emoji 11). Reported as a signal, not scored.

Evidence

• Claude Code: trailer 'Co-Authored-By: Claude' (0d2ef7c8a88f)
• Claude Code: trailer 'Co-Authored-By: Claude' (bccea3c236e2)
• Claude Code: trailer 'Co-Authored-By: Claude' (48e67d852b6b)
• Claude Code: trailer 'Co-Authored-By: Claude' (545525cf3e53)
• Claude Code: trailer 'Co-Authored-By: Claude' (286514e11dff)
• Claude Code: trailer 'Co-Authored-By: Claude' (b8b7eb1716cd)
• Claude Code: trailer 'Co-Authored-By: Claude' (e29af564cecb)
• Cursor agent: on merged branch (9891c6c4fc) (c7e02074947f)
• Cursor agent: on merged branch (9891c6c4fc) (cec9b53724e9)
• Cursor agent: on merged branch (9891c6c4fc) (9b31735cbaf8)
• Cursor agent: on merged branch (9891c6c4fc) (d826ed473690)
• Cursor agent: on merged branch (9891c6c4fc) (0383bfa74379)
• Cursor agent: on merged branch (9891c6c4fc) (98d2bfe2e56c)
• Cursor agent: on merged branch (9891c6c4fc) (3b1a264a8154)
• Cursor agent: on merged branch (9891c6c4fc) (981254ceb5e0)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is adequate: test-to-source ratio 0.74, no CI test run detected; 21% of function code in complex or long functions; 8% duplicated lines. Weakest area: complexity.

• Functions: 1,097; mean complexity 3.8, 90th percentile 8; 29 complex and 10 long functions
• Duplicated lines: 8.0% of 15,691 compared
• Tests: 15,754 test lines for 21,395 source lines (ratio 0.74); CI test commands: none detected; 82% of recent source commits also change tests
• Docs missing or thin: contributing, changelog

Most complex functions:

• auditAgentInner in packages/loom/src/audit/audit.ts: complexity 121, 568 lines
• formatCapabilityTree in packages/loom/src/audit/audit.ts: complexity 65, 235 lines
• renderResults in packages/loom/src/runtime/builtins/web_search.ts: complexity 35, 53 lines
• tryClassifyLineStart in packages/loom/src/cli/streaming-markdown.ts: complexity 32, 91 lines
• applyToolGroups in packages/capabilities/src/tool-groups.ts: complexity 31, 113 lines

Security

Security posture is weak: 89 known vulnerabilities in 19 dependencies. Weakest area: posture.

• Known vulnerabilities: 89 in 19 packages (critical 4, high 26, medium 52, low 7)

• Posture checks passed: none; missing: security policy, dependency updates, signed commits, lockfiles

Top findings

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Distribution signals

• readme-download-lure: gives an archive password

Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.

Repository profile

• Source lines: 21,395; test lines: 15,754