humanlayer/12-factor-agents: technical due diligence, read from its repository

5 test files against 279 source files (1.8%). This does not measure whether the tests are good, only whether enough of them exist for the codebase to be changed safely by someone who did not write it — which is exactly the situation after an acquisition.

91 of 229 subjects are either under twelve characters or one of the standard placeholders — wip, fix, update. The history is therefore not usable for reconstructing why a decision was taken, which is the main thing an inheriting engineer needs it for. It says nothing about code quality and a great deal about how much context transfers with the asset.

26 of 224 commits in the last 24 months changed over 2,000 lines of code, not counting reformatting, renames, vendored or generated code. A change that size is rarely reviewed line by line. Ask how they were reviewed, and what made them that large.

There is no disclosure policy, no automated dependency updates, no named code owners and no pre-commit configuration. None of these is load-bearing on its own. Their collective absence says that security posture here is whatever the current team happens to remember to do, which is not a posture that survives the team changing.

25 of 270 locked dependencies match 121 published advisories in OSV, 47 of them rated high or critical. A lockfile says which version is installed, not whether the flawed code is reachable from this product, so each needs a look. Most are fixed by an upgrade, and the advisory names the version.

Nothing references a structured logging library. Logs that are written to be read by a person are not searchable by a machine, which means incident response here is proportional to how well someone remembers the codebase rather than to what the tooling can find.

411 `print` or `console.log` calls in the service's code, and 0 calls through a logger. Printed lines carry no level and no context, cannot be switched off, and are hard to find again in production.

Nothing in the service carries a request or correlation id, and there is no tracing. When a customer reports a failure, the log lines that belong to their request cannot be picked out from everyone else's.

The service took 229 commits in the last year with no tag, no release commit and no changelog entry. What is running in production cannot be read from the repository, and a bug report cannot be mapped to a version. Ask how the team knows what is deployed.