Material signal
Two mutable publication and dependency signals cleared the rule and source-quality gates.
DD Copilot / System performance
See a technical signal become an investment decision.
Public-code calibration · July 20, 2026
Follow exact source evidence into a reviewer question, decision consequence, and owned next action—the anatomy of the packet an investment team can use.
4Pinned public repositories
64Isolated analyzer executions
3,394Resolved evidence citations
2Candidate reviewer tasks
Eight analyzers completed against every repository in two repeated runs—with zero failures, timeouts, external requests, checkout mutations, or semantic drift between runs.
Decision packet anatomy
The deliverable is not a scanner report.
Analysis becomes useful when the source, operator question, transaction consequence, and next action remain connected in one record.
Operator question
Are these active, material release paths—and what controls exist beyond the repository?
Decision consequence
Resolve before relying on repeatable-release claims, or carry the control into the Day 1 plan.
Owned action
Request operating evidence, confirm materiality, then approve, condition, or defer with the rationale attached.
Have a live software or AI transaction?
Explore transaction intelligence Put the evidence chain against the decision already on your calendar.
Pinned operating surface
Every result starts from an exact source.
Each checkout was acquired separately, pinned to a commit and Git tree, mounted read-only, and independently content-hashed before and after analysis.
Evidence into action
Two signals made it through the evidence chain.
The rule layer promoted two material signals into operator review. Each arrived with exact source context, decision relevance, and the next action required.
Candidate / 01Moderate · review required
A publication path may use a mutable latest tag.
A manually invocable Macrosynergy workflow contained a mutable publication signal. DD Copilot linked the exact workflow evidence and routed the active-path and registry-control questions to review.
Human question Is this an active release path, and do registry immutability or versioned publication controls change the interpretation?
Candidate / 02Moderate · review required
Two Dockerfiles use mutable base-image tags without digests.
The Camoufox snapshot contained literal ubuntu:latest and debian:latest declarations. DD Copilot connected both declarations to the operating question that determines materiality.
Human question Are these Dockerfiles used in a material environment, and what compensating controls exist outside the repository?
System improvement loop
Five defects found. Five corrections shipped. Full cohort rerun.
The baseline exposed where lexical shortcuts created weak evidence. Each defect became a rule correction, then the entire cohort was rerun to verify the result.
- 01
Dependency citations were moved from package metadata to exact declaration lines.
- 02
Ordinary explanatory comments stopped producing commented-code signals.
- 03
Todo-domain identifiers and prose stopped counting as TODO/FIXME debt.
- 04
Common unittest failure assertions became recognized evidence.
- 05
Generic push triggers were separated from evidence of a release trigger.
The next evidence layer
Static code resolves part of the mission. Operating evidence resolves the rest.
Runtime architecture, cloud state, production traffic, or operational effectiveness
Branch protection, deployment approvals, rollback performance, or release history
Vulnerability, licensing, secrets, ownership, or bus-factor conclusions in this static cohort
Company context, management intent, transaction materiality, or reviewer sign-off
Put the system to work
Move your decision through the evidence chain.
Start with the mission. We will map the sources, tests, operators, and actions required to move it forward.
Pressure-test a transaction