Quality Ratings

Completed Smart and Deep repository scans can receive five A–E ratings and a total tech-debt estimate. Dependency-only SCA scans do not run quality analysis. A dimension remains null when the scan has no verified evidence for it. This page shows the exact math.

The Five Ratings

Rating	What it measures	Primary inputs
Overall	Composite - worst of the four below	min(reliability, maintainability, coverage, duplication)
Reliability	Likelihood of runtime bugs	complexity + dead-code + SAST critical/high
Maintainability	Change safety	complexity + duplication + dead-code
Coverage	Test completeness	ingested coverage reports, aggregate line %
Duplication	Copy-paste code	Code Quality Analyzer duplication percentage

Missing data, such as no coverage report or no duplication summary, produces null rather than a fabricated grade.

A–E Thresholds

Severity-driven ratings (reliability, maintainability)

Rating	Criterion (counts findings of matching type + severity in scan)
A	0 critical + 0–2 high
B	0 critical + 3–10 high
C	0 critical + 11+ high
D	1–3 critical
E	4+ critical

Coverage rating

Rating	Coverage % (from ingested lcov/cobertura/jacoco/clover)
A	≥ 90%
B	≥ 80%
C	≥ 60%
D	≥ 40%
E	< 40%

Duplication rating

Rating	Duplication % from the Code Quality Analyzer
A	< 1%
B	< 3%
C	< 5%
D	< 10%
E	≥ 10%

Composite

composite = max(reliability, maintainability, coverage, duplication) - the worst letter wins (since letters are ordered A..E lexicographically, max = worst).

Missing ratings are ignored (they don’t drag the composite down).

Tech Debt Hours

CodeStax implements a simplified SQALE model. Every rule maps to a remediation-minute estimate:


Finding category                    Minutes
────────────────────────────────────────────
Increasing complexity severity       20–180
Maintainability-index issue          60
Cognitive-complexity issue           30
Unused code or export                5–10
Duplicate block                      30
Coverage below threshold             15
Unclassified quality finding         10

The scan’s total tech_debt_minutes = sum of above for non-FP findings. Exposed as:

tech_debt_minutes (raw) on ScanResult
tech_debt_hours = round(minutes / 60, 2)
tech_debt_engineer_days = round(minutes / 480, 2) (8-hour days)

API:


GET /api/quality/tech-debt/{scan_id}
{
  "scan_id": 12345,
  "total_minutes": 847,
  "total_hours": 14.12,
  "total_engineer_days": 1.76,
  "findings_by_type": {
    "complexity": 23,
    "dead_code": 8,
    "duplication": 5,
    "coverage_gap": 12
  }
}

FP-Marked Findings

Findings with user_marked_fp = true are excluded from tech-debt totals + rating counts. See Mark False Positives.

Deterministic

Ratings are a pure function of the findings list. Same scan → same ratings. See Reproducibility.

Parse Coverage

Each scan also reports parse coverage - the % of files the scanner could successfully read. Low parse coverage = underestimates in ratings. Visible in Quality Insights → collapsible “Scan metadata”:


parse_coverage_pct: 98.2
files_parsed: 1847
files_skipped: 34

If parse coverage < 95%, the dashboard surfaces it in yellow as a warning.

Viewing Ratings

Scan detail page - Quality Insights panel shows all 5 ratings as badges + tech-debt hours + engineer-days
API: GET /api/quality/ratings/:scan_id
Historical context - ratings remain attached to each scan and repository quality history is available through the Code Quality dashboard and GET /api/quality/history/{repo_id}.