Code Assurance Platform PRD

The core challenge: AI-generated code ships with significant quality and security deficits. Studies show up to 62% dead code and duplication in AI-assisted codebases, with 40% containing known security vulnerabilities. There is no unified assurance layer that combines code quality, security scanning, testing adequacy, supply chain integrity, and compliance reporting into a single pipeline.

The result: teams either skip quality checks entirely (shipping vulnerable code) or cobble together ad-hoc tool chains that produce thousands of unranked findings, most of which are false positives. Developers lose trust in the tooling and stop paying attention to findings.

What you need:

• Unified scanning across 6 pillars (quality, security, testing, performance, supply chain, policy) with a single command
• Intelligent finding enrichment that eliminates false positives through 6 stages of progressive analysis
• Quantitative scoring that gives every codebase a comparable quality number (0–1000)
• Cryptographic attestation that proves what was scanned, when, by whom, with what results
• Multiple integration methods — MCP server, CLI skill, REST API, n8n workflows, or natural language

The profile engine determines which tools run, at what depth, and with what thresholds. 12 predefined profiles cover the full spectrum from rapid pre-commit checks to exhaustive compliance audits.

Combines 10 custom AI-powered analyzers with 8 established open-source tools for comprehensive code quality assessment.

13 security-focused tools covering SAST, secret detection, dependency vulnerabilities, container scanning, and API security.

Beyond test execution, mutation testing validates that your test suite actually catches bugs. Mutants are generated, and tests that fail to detect them reveal weak spots.

Full software supply chain integrity from dependency analysis to cryptographic signing and provenance tracking.

• SBOM Generation — Syft and cdxgen produce Software Bills of Materials in CycloneDX and SPDX formats
• Sigstore Signing — Keyless code signing via Sigstore with transparency log entries
• SLSA Provenance — SLSA Level 3 provenance attestations documenting the build pipeline
• Dependency Analysis — Transitive dependency resolution with license compliance checking
• Reproducible Builds — Build environment attestation for audit and verification

Raw tool output is noise. The 6-stage enrichment pipeline transforms thousands of findings into a ranked, actionable set with near-zero false positives.

Every scan produces a composite quality score on a 1000-point scale. The scoring algorithm uses a square-root penalty curve — early findings cost more, preventing "good enough" complacency.

Base Score Calculation

Start at 1000. Deduct points per finding: penalty = weight × sqrt(count). The sqrt curve means the first critical finding costs ~31 points, but 10 critical findings cost ~100 (not 310).

Bonus Categories (15)

Positive quality signals add up to 150 bonus points across 15 categories: test coverage (>80%), zero critical findings, complete documentation, no dead code, SBOM present, all dependencies up-to-date, mutation score >60%, no secrets detected, supply chain signed, SLSA attestation, performance thresholds met, accessibility compliance, license compliance, code review completed, and CI/CD integration active.

Every scan result can be cryptographically signed to create a tamper-proof record of what was scanned, when, and what was found.

• Ed25519 Signing — Fast, secure digital signatures on scan results and quality scores
• Rekor Transparency Log — Append-only public ledger via Sigstore Rekor for audit trail
• SLSA Provenance — Level 3 provenance documents linking code to scan results to build artifacts
• Verification CLI — hardener verify <attestation-id> confirms integrity against transparency log

Five integration methods ensure the platform fits into any development workflow:

Scan results are available in 5 output formats with executive summaries for non-technical stakeholders.

Tool Orchestration: Parallel with Dependency Graph

Decision: Run tools in parallel using a dependency-aware scheduler rather than sequentially.

Trade-off: Higher memory usage but significantly faster scans. A full-audit scan with 67 tools completes in 15–30 minutes instead of 2+ hours sequential. Tool dependencies (e.g., SBOM must complete before license checking) are modeled as a DAG.

Scoring Algorithm: Square-Root Penalty Curve

Decision: Use sqrt(count) rather than linear penalties.

Trade-off: A codebase with 1 critical and 100 low findings scores differently than 100 criticals and 1 low. The sqrt curve prevents "why bother" despair from high finding counts while still penalizing the first findings heavily. The first critical finding is more impactful to your score than the 10th.

Enrichment Pipeline: 6 Stages over 3

Decision: Invest in 6 enrichment stages rather than simpler 3-stage filtering.

Trade-off: The pipeline adds processing time (30s–2min per stage) but reduces false positive rates from typical 60–80% to under 5%. The LLM verification stage (Stage 6) is the most expensive but catches context-dependent patterns that static analysis cannot.

Self-Hosted vs SaaS: Self-Hosted First

Decision: Design for self-hosted deployment with Docker Compose, SaaS as optional future layer.

Trade-off: More operational overhead but no data leaves the organization. Source code never touches external servers. Critical for enterprises with strict data residency requirements. The containerized architecture means tools are version-locked and reproducible.

Governance Framework

The code assurance platform emits audit events to the governance framework's event bus. Every scan produces scan_initiated, scan_completed, and attestation_created events. Quality scores below configured thresholds trigger policy_violation events that can block deployments.

Multi-Agent Orchestration

The conductor's QA tier integrates directly with the code assurance platform. When the conductor classifies a task as STANDARD or MAJOR, it automatically triggers a scan at the appropriate profile depth. The QA agent reviews findings and can request code modifications before approving the task.

Persistent Memory System

Scan results are stored in the vector memory system for trend analysis. Over time, the system builds a knowledge base of common findings, successful remediations, and quality trajectories. Memory queries like "what security findings have we seen in authentication code?" return contextualized results.

Plugin Ecosystem

The code assurance platform integrates via the plugin hook system. PreToolUse hooks can trigger pre-commit scans. PostToolUse hooks can validate that file modifications don't introduce new findings. Custom skills expose scanning capabilities through slash commands.

Context Management

Scan profiles and quality thresholds can be configured per-project via CLAUDE.md or project-level configuration. The context system ensures that the right scan profile is automatically selected based on the project's security requirements and compliance posture.