Dashboard score methodology

How the Q1–Q12 audit is scored

Each factor has a stable ID and a versioned definition: assessed risk, eligible population, evidence sources, unit, normalization, scoring function, thresholds, applicability, and limitations. The table summarizes the current unified-quality.v1 catalog.

Contributions and factor scores

Every canonical finding or metric signal has one primary factor. A report may cross-reference the same evidence from another factor, but it cannot apply the same contribution twice. Synthetic findings derived from a metric also share the metric’s evidence identity.

The model converts each accepted contribution to bounded badness in [0, 1]. Its versioned definition supplies the transform, weight, thresholds, and risk caps:

uncapped_score = 10 × (1 - min(1, sum(weight × badness)))
factor_score = min(uncapped_score, applicable risk_cap values)

When no risk_cap applies, the score equals uncapped_score.

The current model gives all twelve factors equal weight. Changing weights, normalization, or thresholds requires another model version and calibration decision. The exact report records model_version, basis digest, source and CPG revisions, capabilities, evidence ledger, and limitations.

Classic audit section scores

The classic report also retains a score for each Q section. Finding weights are summed as W, with repeated findings contributing progressively less, and the section score is calculated as:

section_score = 10 × exp(-0.3 × W)

Q10 calculates its initial coverage score separately:

coverage_score = 10 × (0.82 × method_coverage + 0.18 × line_coverage)

Risk modifiers for uncovered methods are then applied. The classic overall score correction defaults to a cap of overall_score_raw + 3.5; deployments can change that limit through audit_overall_score_max_uplift. These values remain in the report to explain the classic audit and preserve compatibility. They do not replace the unified-quality.v1 factor scores or make an incomplete assessment eligible for scoring.

Missing evidence and overall score

Each factor is measured, partial, unavailable, or not_applicable. Unsupported facts, query failures, missing denominators, and incomplete CPG coverage remain explicit. They are not converted to zero or a neutral passing value.

The overall score is the weighted mean of applicable factor scores only when every applicable factor is complete and the report has no blocking limitation. Otherwise score_eligible=false and overall_score=null. In particular:

• for Q10, use structural testability with measured test coverage when the project profile requires it;
• for Q4 and Q5, compare graph metrics with runtime and throughput measurements;
• for Q12, inspect document content and review results;
• analysis capabilities and CPG freshness are checked for any finding count.

Legacy compatibility scores

Older reports may contain severity-weighted section scores, metric penalties, module_health, and a numeric overall_score. CodeGraph preserves these values with their original version, or labels them legacy-unversioned when no version was stored. Current consumers must not use them as the decision score for a versioned report. Re-scoring is allowed only from complete saved input evidence and produces a separate derived evaluation with provenance.

How the other components are scored

Compliance

The GOST R 56939 report assigns each process one status:

• full = 1;
• partial = 0.5;
• gap = 0;
• n_a is excluded from the denominator.

compliance_score = 100 × sum(process_value) / applicable_process_count

If no processes apply, the result is 0. The report retains the critical-gap list alongside the overall percentage.

Release

Release Gate runs the checks in the selected profile. Every check is either a blocker or a warning:

• any failed blocker → fail;
• no failed blocker, but at least one failed warning → warn;
• all checks pass → pass.

An unknown profile, a check error, or an authorization failure is fail-closed. In the default standard profile, critical findings are prohibited, high findings are limited to five, average cyclomatic complexity is limited to 15, and coverage must be at least 55%. The last two checks are warnings. The gost-56939, standard, and minimal profiles have different check sets, so always read the profile ID and individual check results with the status.

SCA

The SCA component uses dependency vulnerability counts by severity:

sca = clamp(1 - 0.15 × critical - 0.08 × high - 0.02 × medium, 0, 1)

Low and informational vulnerabilities do not enter this formula, but remain in the SCA report. This formula scores the persisted severity summary; it does not replace reachability analysis.

Quality

Quality combines four measures: runtime line coverage — 40%, documentation coverage — 20%, the proportion of used code — 20%, and complexity — 20%. The formula expresses used code as 1 - dead_code_ratio; the complexity contribution decreases as average complexity rises.

complexity_norm = min(avg_complexity / 20, 1)
quality = 0.40 × runtime_line_coverage
        + 0.20 × documentation_coverage
        + 0.20 × (1 - dead_code_ratio)
        + 0.20 × (1 - complexity_norm)

All ratios are in the 0–1 range. If runtime line coverage is unavailable, its contribution is zero and the unavailability reason remains in score_breakdown.

Composite Health Score

The current score_formula_version is v1. The default formula is:

health_score = 100 × clamp(
  0.30 × audit/10
  + 0.25 × compliance/100
  + 0.20 × release
  + 0.15 × sca
  + 0.10 × quality,
  0, 1
)

Release maps pass to 1, warn to 0.5, and fail to 0. A deployment may override component weights, so the response’s score_breakdown is authoritative for a particular result.

Worked calculation

For illustration, use complete inputs: Audit = 8, Compliance = 80%, Release = pass, one high and two medium dependency vulnerabilities, and no critical vulnerabilities. Runtime line coverage is 75%, documentation coverage is 60%, the dead-code ratio is 10%, and average complexity is 10.

First calculate the components: SCA = 1 - 0.08 - 2 × 0.02 = 0.88. Quality = 0.40 × 0.75 + 0.20 × 0.60 + 0.20 × 0.90 + 0.20 × 0.50 = 0.70.

The contributions sum to a Health Score of 84.2, grade B, with low risk for these inputs. Each weighted contribution is rounded to two decimal places before summing.