A code-quality runtime in Python: more than thirty detectors across 28 languages, findings ranked and tracked from scan to fix, and a CI gate on new code so the next regression never merges. State carries between scans, which makes a fix measurable and a score hard to game.
It is not a linter; it runs them. Ruff, bandit, semgrep, knip, biome, clippy, rubocop, checkstyle, phpstan and shellcheck sit underneath, and the runtime owns what happens to their output. Thirty-odd detectors run across three parallel lanes — mechanical, security and subjective — over 28 auto-detected languages: six with their own detectors, fixers and extractors, and 22 wrapping that language's existing linter. An optional tree-sitter extra adds function extraction, import parsing, complexity, god-class and AST-smell detection, so a wrapped language is never only as good as its linter.
The score is two pools, weighted 40 per cent mechanical and 60 per cent subjective. The mechanical pool is five dimensions, with file health carrying double weight because a structural problem multiplies everything downstream of it. The subjective pool is twelve model-assessed dimensions, most of its weight on three elegance measures.
Four score types differ only in which statuses count as failure. Lenient counts what is open. Strict also counts wontfix. Verified-strict counts open, wontfix, fixed and false-positive together. Strict is the declared target, because an overall score can be walked upward by marking everything wontfix — so the distance between the two numbers is published as a suppression gap.
The anti-gaming rules are the argument for the tool. Resolving a finding takes a written note and an attestation. A wontfix still damages the strict score. A score landing within 0.05 of a round target is flagged. A detector that suddenly reports zero findings has its drops held for review, because the likeliest explanation is that the detector broke. Review imports are fail-closed: one invalid finding aborts the whole import.
The CI gate is scoped to changed lines, which is what lets it switch on over a legacy codebase on day one. Three policy profiles ship, one of them for model-generated code with its own coupling threshold. Only production and script files are scored, so a fixture cannot drag a score down. An optional context layer adds embeddings, reranking, an import graph for ripple risk, review memory across sessions and temporal coupling mined from git history.