ory / kratos
Code health
This codebase scores 6.7 out of 10 for code health, which we rate fair. It also scores maintainability 7.5 and static performance 9.9 out of 10. The three are scored separately and never blended into one number. Risk is concentrated, as it usually is: 78 of 7,338 files are git hotspots, and they average 3.2 — which is where the fixes pay off most.
Do next
3 things worth doing this quarter.
Worth planning
Update the decision “Do not bound schema structural size at loader layer”: the code it governs has moved on
Agents and reviewers still follow it, so they are steered by a rule the code no longer keeps.
- status
- Accepted, drifting
Small effort, worth a checkUpdate the decision “Reject pure
$refcycles but not mixed validation cycles”: the code it governs has moved onAgents and reviewers still follow it, so they are steered by a rule the code no longer keeps.
- status
- Accepted, drifting
Small effort, worth a checkDelete 260 unused symbols and files (2,288 lines)
Nothing in the graph reaches them, across 139 files; every reader and agent pays to skip them.
- symbols
- 260
- lines
- 2,288
- safe to delete
- Yes(inferred)
Medium effort
Improve what Repowise can see
Add a test coverage report
Without one, Repowise cannot tell tested code from untested code, so every test-related action says “unknown”.
- line coverage
- Unknown, no report
Small effort
- Lines of code
- 231.7K
Recent activity
All commitsCommits
- 3699ae39fix(kratos): count second-factor enrollment as an authentication event2mo ago
- 9bbfb791fix: prevent oathkeeper rule fetcher watch deadlock2mo ago
- 35c5d1c1fix: preserve trait values on duplicate credential error2mo ago
- 4f29e90efix: serve SSO test sign-in results page from the originating domain2mo ago
- 93914da1chore(kratos): skip external_id uniqueness check on unchanged identity updates (perf)2mo ago
- 57dc7757fix(kratos): persist WebAuthn sign counter for clone detection2mo ago
Decisions
Everything we found
3,733 open
Every detector's open count by area, each with its worst example. An inventory, not a to-do list: the actions above are the part worth doing.
- worst item is critical severity. Code health1,781Untested hotspot · oryx/popx/migrator.go27 findings · 10.2 deducted
- worst item is medium severity. Refactoring121IsValidNumber+1.5 health, S effort · x/json_number.go
- worst item is high severity. Decisions723Do not bound schema structural size at loader layer2 drifting from the code · 643 awaiting review · 78 hotspots ungoverned
- worst item is medium severity. Ownership831selfservice/hook/verify_new_address.go89% single-owner concentration, 6 commits in 90d
- worst item is low severity. Dead code277oryx/josex/encoding.goUnreachable symbol (20 lines)
Composition
Open the graphExplore this codebase
- Docs1,258 pages across 26 modules
- ChatAsk this codebase a question and get an answer with its sources.
- Files7,338 files with per-file docs, health and history
- ArchitectureDependency graph, layers, and 19 entry points
- Code healthPer-file scores, 2,659 open findings, coverage and refactoring targets
- Knowledge graphEntities, communities, and the paths between them
- Change couplingFiles that keep changing together, mined from commit history
- CommitsChange-risk ranked history with agent provenance
- ContributorsBus factor, per-file maintainers, and the human/agent split
- StatsSize class, origin, lifetime churn, rhythm and records
- CostsWhat indexing this snapshot cost, by model and by run.