Verify

What Verify does

Verify runs approximately 120 deterministic checks across eight categories on every push. It produces a readiness score (0–100), architecture and security grades (A–F), a deployment risk level, and policy outcomes. Every finding cites graph evidence — no heuristics, no ML in the scoring path.

Check categories

Checks are organized into eight categories. Each category produces its own sub-score that feeds into the overall readiness score.

• Architecture — cycles, coupling, layering violations, orphan modules
• Security — authentication gaps, authorization patterns, exposed secrets
• Dependencies — outdated, vulnerable, or circular dependencies
• API — breaking changes, undocumented endpoints, inconsistent contracts
• Ownership — unowned modules, bus-factor analysis, coverage gaps
• Performance — N+1 patterns, synchronous bottlenecks, resource leaks
• Dead code — unreachable functions, unused exports, orphan types
• Testing — untested public APIs, missing edge-case coverage

Readiness score

The readiness score is a weighted composite of all check categories. Weights are documented and configurable per team. A score above 80 typically indicates low deployment risk. The score is deterministic — same graph, same score.

Grades

Architecture and security receive letter grades (A through F) computed from category-specific metrics. Grades translate complex graph analysis into a single signal your team can act on without reading every finding.

Policy gates

Define policies as declarative rules. Each policy evaluates to block, warn, or pass. Use threshold conditions on the readiness score, count conditions on specific finding types, exists conditions for critical patterns, and delta conditions to prevent regressions.

# Example policy: block deploy if readiness < 70
# Example policy: warn if dead-code count > 50
# Example policy: block if security grade below C