{"note":"Deterministic layer only. No model calls were made and no source content left this machine.","layer":"deterministic","coverage":{"statement":"A repository answers roughly three and a half of seven dimensions. The rest are reported as not assessable, with the questions a human would ask instead.","total_dimensions":7,"assessable_dimensions":6},"dimensions":[{"id":"01","band":"adequate","name":"Architecture & Codebase — including AI provenance","coverage":"full","findings":[{"id":"01.6","band":"adequate","layer":"deterministic","title":"internal/terraform/context_apply_test.go is 12,986 lines, 85× this codebase's median file","signal":"oversized_modules","evidence":[{"ref":"line-count","kind":"path","path":"internal/terraform/context_apply_test.go","detail":"12,986 lines (85× median)","line_end":12986,"line_start":1},{"ref":"line-count","kind":"path","path":"internal/command/init_test.go","detail":"8,967 lines (58× median)","line_end":8967,"line_start":1},{"ref":"line-count","kind":"path","path":"internal/command/jsonformat/plan_test.go","detail":"8,955 lines (58× median)","line_end":8955,"line_start":1},{"ref":"line-count","kind":"path","path":"internal/terraform/context_plan2_test.go","detail":"8,122 lines (53× median)","line_end":8122,"line_start":1},{"ref":"line-count","kind":"path","path":"internal/stacks/stackruntime/plan_test.go","detail":"7,721 lines (50× median)","line_end":7721,"line_start":1}],"observed":{"largest":12986,"threshold":1520,"files_over":61,"median_lines":152},"dimension":"01","rationale":"The median source file here is 152 lines. 61 files exceed 1,520 lines, the largest being 12,986. Size is not a defect on its own — some problems genuinely live in one place — but these are where merge conflicts, review fatigue and single-owner knowledge concentrate, and they are the first thing that slows an inheriting engineer down."}],"signals_run":6,"conclusive_signals":6},{"id":"02","band":"strong","name":"Engineering Process & SDLC Maturity","coverage":"high","findings":[],"signals_run":7,"conclusive_signals":7,"what_a_repository_cannot_tell_you":["Incident response practice is not visible in a repository."]},{"id":"03","band":"strong","name":"Organizational Health","coverage":"partial","findings":[],"signals_run":5,"conclusive_signals":5,"what_a_repository_cannot_tell_you":["Hiring pipeline, bench depth and retention are not visible in a repository.","Whether the dominant contributor is part of the transaction.","Seniority, levelling and who actually mentors whom.","Whether the team wants to stay after the deal closes."]},{"id":"04","band":"adequate","name":"Product & Engineering Maturity","coverage":"minimal","findings":[{"id":"04.3","band":"adequate","layer":"deterministic","title":"314 direct dependencies in a single manifest","signal":"dependency_sprawl","evidence":[{"ref":"direct-dependencies","kind":"path","path":"go.mod","detail":"314 declared"},{"ref":"direct-dependencies","kind":"path","path":"internal/backend/remote-state/gcs/go.mod","detail":"78 declared"},{"ref":"direct-dependencies","kind":"path","path":"internal/backend/remote-state/s3/go.mod","detail":"73 declared"},{"ref":"direct-dependencies","kind":"path","path":"internal/backend/remote-state/kubernetes/go.mod","detail":"69 declared"}],"observed":{},"dimension":"04","rationale":"go.mod declares 314 direct dependencies. Each one is a maintenance obligation, a supply-chain surface and a potential licence question that transfers with the asset. The count says nothing about whether any given dependency was a good choice; it says how many such choices a buyer inherits.","unproven":true},{"id":"04.5","band":"adequate","layer":"deterministic","title":"Effort is shifting from building to rewriting","signal":"churn_trend","evidence":[{"ref":"deletions-per-insertion","kind":"metric","detail":"first half 0.80, second half 1.93 (split 2020-07-18)"}],"observed":{},"dimension":"04","rationale":"Deleted lines per line added rose from 0.80 to 1.93 between the first and second halves of this history. Rework is normal and often healthy, but a rising ratio means an increasing share of the team's time is spent replacing code that already exists rather than building what does not. Whether that is deliberate repayment or churn is a question for the team."}],"signals_run":5,"conclusive_signals":5,"what_a_repository_cannot_tell_you":["Roadmap credibility requires the data room.","Whether technical debt is acknowledged and funded."]},{"id":"05","band":"adequate","name":"Security & Reliability Posture","coverage":"partial","findings":[{"id":"05.1","band":"adequate","layer":"deterministic","title":"9 credential-shaped string(s) committed to the tree","signal":"committed_secrets","evidence":[{"kind":"metric","ref":"private key block","detail":"5 cited: private key block pattern matched"}],"observed":{},"dimension":"05","rationale":"Matches for private key block appear in tracked files outside test and fixture paths. Whether these are live is not something a repository can settle, and they may well be rotated already — but they are in the history permanently, and the question a buyer must ask is what the rotation process was, not whether one string still works.","unproven":true,"locations_withheld":5},{"id":"05.6","band":"adequate","layer":"deterministic","title":"1 Dockerfile(s) run the application as root","signal":"container_runs_as_root","evidence":[{"ref":"no-USER-instruction","kind":"path","path":"Dockerfile","detail":"runs as root"}],"observed":{"rootful":1,"dockerfiles":1},"dimension":"05","rationale":"No USER instruction switches away from root, so the process runs with full privileges inside the container. It is a one-line fix and an ordinary expectation, which is why its absence is worth asking about: it usually says more about whether anyone has reviewed the deployment than about this container specifically."},{"id":"05.10","band":"adequate","layer":"deterministic","title":"Licence text does not match a standard licence","signal":"license_grant_unclear","evidence":[{"ref":"LICENSE","kind":"path","path":"LICENSE","detail":"92 lines, BUSL-1.1","line_end":3,"line_start":1}],"observed":{"path":"LICENSE","identified":"BUSL-1.1"},"dimension":"05","rationale":"LICENSE exists but its text does not match any standard licence. A bespoke or hand-edited licence is not wrong, but it cannot be cleared by recognising its name: counsel has to read it, and until they do neither side knows precisely what rights transfer with the code."}],"signals_run":10,"conclusive_signals":8,"what_a_repository_cannot_tell_you":["Incident history and failure-mode analysis are not in the repository."]},{"id":"06","band":"strong","name":"Observability & Operations","coverage":"partial","findings":[],"signals_run":3,"conclusive_signals":3,"what_a_repository_cannot_tell_you":["Whether anyone watches the telemetry that exists."]},{"id":"07","band":"not assessable","name":"Fit with the Acquirer","coverage":"none","findings":[],"signals_run":0,"conclusive_signals":0,"not_assessable_reason":"structurally not assessable from a repository","what_a_repository_cannot_tell_you":["This is a Go codebase. Does your engineering organisation already run Go in production, or would this be the first?","2324 people have committed here. Which of them are you acquiring, and which are you replacing?","The bulk of this system sits in vendor/, internal/, builtin/. Which of your existing systems would each of those have to absorb or replace?","This deploys as a container or managed service. Does that match your deployment and on-call model, or does it need rehosting first?","What is your tolerance for the findings above remaining unaddressed for the first two quarters after close, given everything else that will compete for this team's time?"]}],"repository":{"loc":763627,"head":"7dd5b3394b4487afc235b86a1a588e5c8fef8e7e","slug":"hashicorp/terraform","tags":474,"stars":49717,"span_days":4506.5,"last_commit":"2026-09-22T11:29:53+00:00","commits_read":35959,"first_commit":"2014-05-21T23:29:16+00:00","truncated_at":null,"tracked_files":5539},"generated_at":"2026-09-23T09:59:38.537461+00:00","generated_by":"borehole 0.1.0.dev0","rejection_log":[{"reason":"change is spread across the codebase rather than pooling in a few files","signal":"hotspot_concentration","observed":{"files":37693,"top5_share":0.04},"dimension":"04","conclusive":true},{"reason":"debt markers are sparse","signal":"debt_markers","observed":{"markers":387,"per_kloc":0.51,"lines_read":759576},"dimension":"04","conclusive":true},{"reason":"test effort kept pace with code written","signal":"test_growth","observed":{"late_test_per_code":0.914,"early_test_per_code":0.639},"dimension":"04","conclusive":true},{"reason":"a telemetry or error-reporting library is referenced","signal":"telemetry_presence","observed":{"note":"presence only; whether anyone watches it is not visible here","sample":["checkpoint.go: opentelemetry","docs/dependency-upgrades.md: opentelemetry","go.mod: opentelemetry"],"matches":34},"dimension":"06","conclusive":true},{"reason":"a structured logging library is referenced","signal":"structured_logging","observed":{"sample":["internal/backend/remote/testdata/plan-long-line/main.tf","internal/cloud/testdata/plan-long-line/main.tf","internal/command/test_test.go"],"matches":3},"dimension":"06","conclusive":true},{"reason":"no single contributor dominates the history","signal":"contributor_concentration","observed":{"authors":2324,"top_share":"less than a quarter","bus_factor":10},"dimension":"03","conclusive":true},{"reason":"more than one contributor active in the trailing year","signal":"active_contributors","observed":{"all_time":2324,"active_12mo":67},"dimension":"03","conclusive":true},{"reason":"every substantial directory has been touched by more than one person","signal":"knowledge_silos","observed":{"authors":2324,"directories":39},"dimension":"03","conclusive":true},{"reason":"a healthy share of contributors committed more than once","signal":"drive_by_contributors","observed":{"share":0.611,"authors":2324,"one_commit_authors":1420},"dimension":"03","conclusive":true},{"reason":"no contributor dominates enough for their absence to matter","signal":"contributor_attrition","observed":{"authors":2324,"top_share":"less than a quarter","top_contributor_last_committed":"more than three years ago"},"dimension":"03","conclusive":true},{"reason":"a meaningful share of change arrives through a reviewable path","signal":"merge_discipline","observed":{"merges":7084,"commits":35959,"reviewed_share":0.31,"squashed_with_pr_ref":4080},"dimension":"02","conclusive":true},{"reason":"CI configuration is present in the working tree","signal":"ci_presence","observed":{"count":11,"configs":[".github/workflows/backport.yml",".github/workflows/build-terraform-cli.yml",".github/workflows/build.yml",".github/workflows/changelog-validation.yml",".github/workflows/checks.yml"]},"dimension":"02","conclusive":true},{"reason":"tests are present in a normal proportion to source","signal":"test_presence","observed":{"tests":684,"source":2016,"test_ratio":0.339},"dimension":"02","conclusive":true},{"reason":"tags are present","signal":"release_cadence","observed":{"tags":474,"sample":["0.7.7","list","v0.1.0","v0.1.1","v0.10.0"]},"dimension":"02","conclusive":true},{"reason":"commit subjects generally carry content","signal":"conventional_commits","observed":{"sampled":28875,"low_content_share":0.018},"dimension":"02","conclusive":true},{"reason":"process scaffolding is present in the repository","signal":"branch_protection_hints","observed":{"present":["CI workflows","CODEOWNERS","a pull-request template","contribution guidance"]},"dimension":"02","conclusive":true},{"reason":"CI invokes a test runner","signal":"ci_runs_tests","observed":{"sample":[".github/workflows/build.yml",".github/workflows/checks.yml"],"configs":11,"with_tests":2},"dimension":"02","conclusive":true},{"reason":"first commit is not a disproportionate share of the codebase","signal":"initial_dump","observed":{"insertions":8,"share_of_insertions":0.0},"dimension":"01","conclusive":true},{"reason":"commit subjects vary in wording and length","signal":"message_uniformity","observed":{"length_stdev":21.93,"repeat_share":0.166},"dimension":"01","conclusive":true},{"reason":"most files were revisited after they were first written","signal":"revision_depth","observed":{"files_seen":37693,"write_once_share":0.32},"dimension":"01","conclusive":true},{"reason":"little shipping code is repeated verbatim across files","signal":"duplicated_blocks","observed":{"share":0.0281,"product_files":1963,"distinct_blocks":398224,"duplicated_blocks":11206},"dimension":"01","conclusive":true},{"reason":"at least one standard guard rail is configured","signal":"security_guardrails","observed":{"present":[".github/dependabot.yml","CODEOWNERS"]},"dimension":"05","conclusive":true},{"reason":"no manifest whose pinning can be read without a lockfile","signal":"dependency_pinning","observed":{"checked":["requirements.txt","package.json","Gemfile"]},"dimension":"05","conclusive":false},{"reason":"a licence file is present","signal":"license_present","observed":{"found":true},"dimension":"05","conclusive":true},{"reason":"no packaging manifest states a licence","signal":"license_manifest_conflict","observed":{"manifests_checked":["package.json","pyproject.toml","Cargo.toml","composer.json"]},"dimension":"05","conclusive":false},{"reason":"no vendored third-party code is committed","signal":"license_vendored_unlicensed","observed":{"components":0},"dimension":"05","conclusive":true}],"schema_version":"1","provenance_disclosure":{"agents":["Claude"],"excluded":"lockfiles, vendored and generated paths are excluded from both measurements so that code nobody wrote cannot move the share","measures":"share of lines added by commits declaring an AI agent as co-author, as a proportion of all lines ever added","confidence":"low","measurable":true,"ai_line_share":0.0001,"total_commits":28875,"affects_rating":false,"excluded_lines":8155994,"ai_commit_share":0.0001,"confidence_basis":["3% of non-merge commits carry any trailer at all","low trailer coverage: the convention may not be in consistent use","20% of commits show author/committer date divergence, which is the shape of replayed history that can drop trailers"],"declared_commits":3,"total_lines_added":2303602,"surviving_ai_lines":null,"surviving_measures":"share of lines still present in the working tree that originate in an AI-declared commit; null unless the scan was run with --deep","declared_lines_added":158,"surviving_line_share":null,"floor_not_measurement":"This is a lower bound. It counts what the repository declares. Undeclared AI authorship is invisible here, and a single rebase removes the trailers this rests on. Absence of a declaration is absence of disclosure, not absence of AI authorship.","surviving_total_lines":null},"band":"adequate","reliance":"An automated reading of a repository's code and its history up to one commit, with public advisory records. It may be wrong, it is not legal, financial, investment or security advice, and it does not replace diligence by a qualified person. It is provided for information: nobody may rely on it (Borehole's terms, section 3).","published_under_todays_rules":["Words about people are today's: bands rather than exact shares, dates or day counts, and what the history measured rather than why.","2 findings rated significant by a check that has not yet held up in Borehole's calibration are now worth checking first.","4 findings from checks Borehole's calibration found wrong more often than right are no longer published.","The file and line of 5 credential-shaped matches are withheld. File and line are shown to whoever GitHub says controls this repository, signed in, and to a buyer of this report."]}