maintainability-agent 2.10.0__tar.gz → 2.11.2__tar.gz

{maintainability_agent-2.10.0/src/maintainability_agent.egg-info → maintainability_agent-2.11.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: maintainability-agent
-Version: 2.10.0
+Version: 2.11.2
 Summary: Maintainability gate and AI remediation prompt generator for CI.
 Author: Marshall Guillory
 License: MIT
@@ -35,6 +35,7 @@ Requires-Dist: pip-audit>=2.7; extra == "dev"
 Requires-Dist: mcp<3,>=2; extra == "dev"
 Requires-Dist: PyYAML>=6; extra == "dev"
 Requires-Dist: setuptools>=70; extra == "dev"
+Requires-Dist: lizard>=1.17; extra == "dev"
 Dynamic: license-file
 
 # Maintainability Agent
@@ -44,11 +45,18 @@ Dynamic: license-file
 **A deterministic, offline maintainability audit whose output is a _bounded
 work order_ for an AI coding agent** — a copy-paste prompt, per finding, that
 says *fix exactly these and refactor nothing else*. Chat-primary; CLI for CI.
-Version **2.10.0**.
-
-**Languages parsed:** Python, Java, C, C++, C#, Swift, Fortran (free-form
-*and* fixed-form), and the JS/TS family — each by a scanner written for it, and
-measured with that language's own reading of what a branch is.
+Version **2.11.2**.
+
+**Planned, not shipped:** the audit tool will become `maintainability-audit`;
+a new `maintainability-agent` companion will run it and automate human-selected
+work orders within the user's agent chat. The installation commands below
+still describe the current product. See the [planned split](docs/product-intent.md#planned-product-split-and-companion-workflow).
+
+**Languages parsed:** Python, Java, C, C++, C#, Go, Rust, PHP, Ruby, Swift,
+COBOL, Fortran (free-form *and* fixed-form), and the JS/TS/HTML family — each
+by a scanner written for it, and measured with that language's own reading of
+what a branch is, checked construct-by-construct against an independent
+implementation.
 [What that means per language](#language-support).
 
 ```bash
@@ -103,50 +111,22 @@ differ.
 
 ## Why this exists
 
-The ratio of code-written to code-reviewed has collapsed. Unmaintainable code
-that used to accumulate over years can now accumulate in an afternoon:
-duplicated helpers, oversized files, speculative abstractions — the same slop
-hand-written codebases always accrued, now at machine speed.
-
-The same speed is the way out. An agent pointed at specific, deterministic
-findings can fix them at the rate they appear. The loop this tool closes:
-
-1. **Measure** pressure points deterministically, with no LLM involved.
-2. **Score** with one uniform standard, so the verdict is not a debate.
-3. **Emit** a prompt scoped to *those findings only*, with explicit
-   instructions not to refactor beyond them.
-4. **Hand it to the agent.** Review a scoped diff instead of a speculative
-   rewrite.
-
-Step 3 is the product; steps 1 and 2 are in service of it. Every other tool in
-this space stops at "here's a list of findings."
+The ratio of code-written to code-reviewed has collapsed, and the same speed is
+the way out: an agent pointed at specific, deterministic findings can fix them
+at the rate they appear. The loop is **measure** with no model involved,
+**score** against one uniform standard, **emit a prompt scoped to those findings
+only**, and hand it over. Step three is the product.
 
 **Who does the checking matters as much as what it checks.** An author is never
 the independent check on their own work, so a platform that generates code and
-grades it is producing a self-assessment — a property of the arrangement, not a
-criticism of any one of them. This writes nothing and runs no model, which is
-what lets its verdict be evidence ([the principle](docs/philosophy.md#principles)).
-Since 2.1.0 the work order is also **checked**: `--conformance` compares the
-returned diff against the paths the report named, `--fail-on-regression`
-ratchets the dimension scores, and `--attestation-output` composes them into one
-record ([how that hole was closed](docs/roadmap.md#the-remediation-hole-closed-in-210-through-230)).
-The limit, stated in the same breath: those checks read the diff's **shape**,
-never its correctness — whether the change works is not a claim this tool makes.
-
-One pre-registered experiment has tested the bounded prompt.
-Generic prompting made 2 of 6 repositories worse; bounded prompting made 1 of 6 worse and improved 5 of 6, under this tool's own finding count.
-The *registered* hypothesis was narrower diffs, which did not hold, so the
-registered verdict stands at **INCONCLUSIVE**. Method, limits and raw data:
-[docs/studies.md](docs/studies.md#does-the-bounded-prompt-work-controlled-experiment-pre-registered).
-
-### Who it's for
-
-- Teams running AI agents in the dev loop, tired of unbounded cleanup PRs, who
-  want a CI gate that actively constrains follow-up scope.
-- Repos that want a maintainability gate without a SaaS analyzer or shipping
-  code to a third party.
-- Solo devs who want a single deterministic audit to pin in a Makefile,
-  pre-commit, or local CI script.
+grades it is producing a self-assessment. This writes nothing and runs no model,
+which is what lets its verdict count as evidence. Since 2.1.0 the work order is
+itself checked — scope conformance, a dimension ratchet, and an attestation
+record — and those checks read a diff's **shape**, never whether it works.
+
+The full argument, including what this deliberately does not compete on:
+[why this exists](docs/why-this-exists.md) and
+[philosophy](docs/philosophy.md).
 
 ## The road to 1.0
 
@@ -225,8 +205,8 @@ withheld and the scope is named as the reason.
 ### Checking that the agent did the work
 
 The work order tells an agent to fix exactly these findings and refactor nothing
-else. These flags check that the diff obeyed it — they read its _shape_, not its
-correctness:
+else. Four flags check that the diff obeyed it — reading its _shape_, never
+whether it works:
 
 ```bash
 maintainability-agent \
@@ -237,30 +217,19 @@ maintainability-agent \
   --attestation-output maintainability-attestation.md
 ```
 
-- **`--conformance <revspec>`** compares the diff against the paths the report
-  named, and answers two questions separately: did it **stay in scope**, and did
-  it **silence nothing**. They stay separate because a change can obey the work
-  order and still add a `# noqa` to a finding inside it. A test added for a fix
-  stays in scope even though the work order never named the test file.
-- **`--fail-on-out-of-scope`** turns that into a CI failure.
-- **`--fail-on-regression`** ratchets the _dimension_ scores against scan
-  history, catching a change that improves one dimension while silently
-  regressing another. It has three outcomes, not two — held, regressed, and
-  **not comparable**, because two scans taken under different calibration cannot
-  be differenced.
-- **`--attestation-output`** writes the three into one per-change record: what
-  was measured, what the agent was told to change, whether it stayed inside the
-  work order, and what moved. It is reproducible and **not signed** — nothing
-  here holds a key, and the document says so in its own text. A check nobody ran
-  renders as _not asked_, never as passed.
-- **`--transformation NAME`** names the class of work a scan followed and
-  reports how this run of it compares with earlier ones. **A report, never a
-  gate.** It says one run "moved further" than another, never that it was
-  _better_ — two runs of one codemod land on different code — and it measures
-  the interval, not the transformation.
-
-The [roadmap](docs/roadmap.md#the-remediation-hole-closed-in-210-through-230)
-has the history of why this was the hole under the product's central claim.
+`--conformance` answers two questions separately — did the diff **stay in
+scope**, and did it **silence nothing** — because a change can obey the work
+order and still add a `# noqa` to a finding inside it. `--fail-on-out-of-scope`
+turns that into a CI failure. `--fail-on-regression` ratchets the _dimension_
+scores against history, with three outcomes rather than two: held, regressed,
+and **not comparable**, because two scans taken under different calibration
+cannot be differenced. `--attestation-output` composes them into one per-change
+record, reproducible and **not signed** — a check nobody ran renders as _not
+asked_, never as passed.
+
+Each flag in full, including `--transformation`:
+[docs/cli.md](docs/cli.md). Why this was the hole under the product's central
+claim: [the roadmap](docs/roadmap.md#the-remediation-hole-closed-in-210-through-230).
 
 ### During the loop, not only after it
 
@@ -275,10 +244,16 @@ maintainability-agent --install-precommit-hook             # before committing
 
 **`--check PATH`** answers about content on stdin. No repository, no git, no
 scan; `PATH` names the content and is never opened. Pass file content, not a
-diff — content that does not parse says so rather than reading as clean, as
-does a language with no scanner. In text it is **silent while you have room**
-and speaks once a declaration nears its limit; `--format json` carries the
-remaining budget for every declaration whether or not it is close.
+diff — **a piped diff is refused in every language**, by its format rather
+than by a parser, and says so rather than reading as clean; so does a
+language with no scanner. Beyond that, only Python's content is parsed:
+a brace language's invalid source is not detected, because zero
+declarations is not evidence of a parse failure and marking valid files
+unparsed would be worse than the silence. In text it is **silent while you have room**
+and speaks once a declaration nears its limit — on *any* budget it can be
+failed on, length or cyclomatic or cognitive, not length alone.
+`--format json` carries the remaining budget for every declaration whether
+or not it is close, per budget rather than as one number.
 
 **`--staged`** scans the git index. Stage half a file with `git add -p`, keep
 typing, and what gets measured is what the commit will actually contain —
@@ -297,9 +272,12 @@ The deterministic scanner reads code from your repo (no LLM calls) and produces
 signals on:
 
 - largest files (configurable warn/fail thresholds)
-- function size and complexity — exact ranges for Python via `ast`,
-  brace-bounded for JS/TS/JSX/TSX/HTML — plus **cognitive complexity**
-  (nesting-weighted reading cost)
+- function size and complexity — exact ranges for Python via `ast`, and
+  bounded ranges for every other parsed language, each measured with that
+  language's own reading of what a branch is ([Language
+  support](#language-support) is the list, so this sentence cannot drift
+  out of step with it) — plus **cognitive complexity** (nesting-weighted
+  reading cost)
 - class size, against its own budget (`max_class_lines`)
 - duplicate blocks, and **near-duplicate declarations** compared structurally so
   renaming can't hide a copy, each paired with the original to reuse
@@ -325,9 +303,9 @@ SonarQube, Qlty) rather than replacing them — their SARIF folds in via
 **Be clear-eyed: the tool does not support every language equally, and on an
 unrecognized language it under-reports rather than fails.** Coverage has two layers.
 
-Ten languages are parsed as of **2.7.0**: Python (1.0), Java (1.0), C (1.1),
+Fourteen languages are parsed as of **2.11.0**: Python (1.0), Java (1.0), C (1.1),
 C++ (1.2), C# (1.3), Fortran (free-form 1.4, fixed-form 1.6), Swift (2.4),
-COBOL (2.7), the JS/TS family, and HTML. Each has a scanner written for it and a
+COBOL (2.7), Go (2.11), Rust (2.11), PHP (2.11), Ruby (2.11), the JS/TS family, and HTML. Each has a scanner written for it and a
 documented list of what it misses — a language is claimed only when both exist.
 
 **Built-in scanner (always on, no dependencies)** — reads function/class
@@ -342,6 +320,10 @@ these:
 | C++ (`.cpp`, `.hpp`, `.cc`, `.cxx`, `.hh`) | dedicated brace-bounded scanner — functions, class members, namespaces, templates | Bounded; bodyless declarations are not definitions |
 | C# (`.cs`) | dedicated brace-bounded scanner — methods, constructors, `class`/`interface`/`struct`/`record`/`enum` | Bounded; properties are not declarations |
 | Swift (`.swift`) | dedicated brace-bounded scanner — functions, initialisers, subscripts, `class`/`struct`/`enum`/`protocol`/`actor` | Bounded; extension members carry their type, protocol requirements and computed properties are not declarations |
+| Go (`.go`) | dedicated brace-bounded scanner — functions, methods, `type`/`struct`/`interface` | Bounded; methods carry their receiver type, interface methods are requirements, function literals inside a body are not seen |
+| Rust (`.rs`) | dedicated brace-bounded scanner — functions, `impl` and `trait` members, `struct`/`enum`/`trait`/`union` | Bounded; methods carry the type their `impl` names, trait requirements mint nothing, closures and macro bodies are not read |
+| PHP (`.php`, `.phtml`) | dedicated brace-bounded scanner — functions, methods, `class`/`interface`/`trait`/`enum`; markup outside `<?php` is blanked | Bounded; methods carry their class, bodyless members mint nothing, heredoc bodies are not masked |
+| Ruby (`.rb`, `.rake`, `.gemspec`) | dedicated scanner — methods, classes and modules bounded by `end`, counted by openers | Bounded by depth; methods carry their class, blocks and modifier forms discounted, metaprogrammed methods are not seen |
 | COBOL (`.cbl`, `.cob`, `.cpy`, and `.CBL`/`.COB`/`.CPY`) | dedicated scanner — PROCEDURE DIVISION paragraphs, bounded by the start of whatever follows; fixed-form card columns read where the layout carries them | Bounded by the next header; level numbers and container programs/sections are not declarations |
 | Fortran, free-form (`.f90`, `.f95`, `.f03`, `.f08`, `.F90`, `.F95`, `.F03`, `.F08`, `.pf`) | dedicated **keyword**-bounded scanner — modules, subroutines, functions, derived types | Bounded by `end`; measured with Fortran's own branch and nesting reading |
 | Fortran, fixed-form (`.f`, `.for`, `.ftn`, `.F`, `.FOR`, `.FTN`) | the same scanner over card-column source; continuations joined, labelled `DO` loops understood | Bounded by `end` or by the loop's label |
@@ -349,7 +331,7 @@ these:
 | HTML (`.html`) | same brace scanner (inline `<script>`) | Bounded |
 | TypeScript (semantic) | a recorded analysis or a locally-installed `tsc`, workspace projects included | Type-level facts; `unknown` when no checker is present |
 
-Any language **not** in that table — Go, Rust, Ruby, PHP, Kotlin, and the rest —
+Any language **not** in that table — Kotlin, Scala, Elixir, Zig, and the rest —
 is **not parsed for declarations by the built-in scanner.** Its files still count
 toward repo size, but the built-ins produce no function-size, complexity,
 duplication or dead-code findings for them, and the estimate leans on whatever
@@ -384,54 +366,33 @@ report — so a payload cap can never truncate the prompt.
 
 ## Scoring standard
 
-Based on ISO/IEC 25010 maintainability — modularity, reusability,
-analyzability, modifiability, testability. Scores are **rates calibrated
-against real code**, not counts: every pressure is normalized against the
-median a pinned 112-repo corpus of mature projects actually carries —
-eight of the ten parsed languages (django, angular, spring-framework,
-ghidra, LAPACK, …); Swift and COBOL are parsed but unanchored. How that corpus was selected, what each language actually
-reads, and what the numbers do *not* establish:
-[the calibration study](docs/calibration-2.0-study.md), so `2.5x` means
-"two and a half times what well-maintained real code shows." The corpus median
-earns a **B**; **A+ is gated**, requiring every dimension clean.
-
-The corpus is **selected by query, not taste** — `stars:>3000
-created:<2021-01-01 pushed:>2026-01-01` across Python, TypeScript and
-JavaScript, then filtered to repositories that contain code. The calibration is
-reproducible, not asserted: `python3 tools/calibration/measure.py --check`
-re-measures and fails on drift, and `tests/test_calibration_corpus.py`
-re-derives the constants offline from checked-in measurements. See
-[docs/standard.md](docs/standard.md).
+One rubric, applied uniformly, published in full at
+[docs/standard.md](docs/standard.md): the aspects, their weights, the
+calibration method, and the reference corpus. A score is withheld rather than
+guessed when the evidence does not support one, and the report says which tier
+the evidence came from.
 
 ## Self-audit
 
-This repo eats its own dogfood — the tool runs against this codebase in CI, and
-a report is checked in at [docs/self-audit.md](docs/self-audit.md), **stamped
-with the exact source commit it was generated against** (a provenance record,
-not a claim about HEAD). These figures mirror that stamped report row for row:
+The tool runs against this codebase in CI, and the report is checked in at
+[docs/self-audit.md](docs/self-audit.md), stamped with the exact source commit
+it was generated against — a provenance record, not a claim about HEAD.
 
 | Metric | Value |
 |---|---:|
-| Maintainability estimate | 4.1 / 5 |
+| Maintainability estimate | 4.2 / 5 |
 | Verified grade | B |
-| Files scanned | 391 |
-| File warnings | 120 |
-| File failures | 0 |
-| Function warnings | 65 |
-| Function failures | 0 |
-| Duplicate blocks | 0 |
-| Risk findings | 0 |
+| Files scanned | 476 |
 | Hard gate failures | 0 |
 
-Yes, a **B** — demoted from the A band because warning rates exceed the
-A-grade ceilings, against thresholds this repo sets stricter than the shipped
-defaults. The grade is gated (A+ needs every dimension clean; a
-repo with production code and zero test files cannot earn an A-grade) and banded
-from the evidence floor, so withholding evidence never buys a better letter.
-Every threshold gate — file, function, duplication — is opted **on** for this
-repo's own CI, so drifting below the bar fails the build rather than the README.
-(CI note: `actions/checkout` defaults to `fetch-depth: 1`, which hides history
-and costs roughly a grade — use `fetch-depth: 0`.)
+A **B**, and the report says why: the grade is verified against the evidence
+*floor* of 4.1 rather than the 4.2 point estimate, because an unmeasured aspect
+prices at 0 when a grade has to be defended; and testability is capped at 4.0 by
+an unpaired production unit in the fail band. Those are measured against
+thresholds this repo sets stricter than the shipped defaults, and every threshold
+gate is opted **on** for its own CI, so drifting below the bar fails the build
+rather than the README. The full stamped table — warnings, duplication, risk
+findings — is in the report itself.
 
 ## Platform support
 

{maintainability_agent-2.10.0 → maintainability_agent-2.11.2}/README.md

@@ -5,11 +5,18 @@
 **A deterministic, offline maintainability audit whose output is a _bounded
 work order_ for an AI coding agent** — a copy-paste prompt, per finding, that
 says *fix exactly these and refactor nothing else*. Chat-primary; CLI for CI.
-Version **2.10.0**.
-
-**Languages parsed:** Python, Java, C, C++, C#, Swift, Fortran (free-form
-*and* fixed-form), and the JS/TS family — each by a scanner written for it, and
-measured with that language's own reading of what a branch is.
+Version **2.11.2**.
+
+**Planned, not shipped:** the audit tool will become `maintainability-audit`;
+a new `maintainability-agent` companion will run it and automate human-selected
+work orders within the user's agent chat. The installation commands below
+still describe the current product. See the [planned split](docs/product-intent.md#planned-product-split-and-companion-workflow).
+
+**Languages parsed:** Python, Java, C, C++, C#, Go, Rust, PHP, Ruby, Swift,
+COBOL, Fortran (free-form *and* fixed-form), and the JS/TS/HTML family — each
+by a scanner written for it, and measured with that language's own reading of
+what a branch is, checked construct-by-construct against an independent
+implementation.
 [What that means per language](#language-support).
 
 ```bash
@@ -64,50 +71,22 @@ differ.
 
 ## Why this exists
 
-The ratio of code-written to code-reviewed has collapsed. Unmaintainable code
-that used to accumulate over years can now accumulate in an afternoon:
-duplicated helpers, oversized files, speculative abstractions — the same slop
-hand-written codebases always accrued, now at machine speed.
-
-The same speed is the way out. An agent pointed at specific, deterministic
-findings can fix them at the rate they appear. The loop this tool closes:
-
-1. **Measure** pressure points deterministically, with no LLM involved.
-2. **Score** with one uniform standard, so the verdict is not a debate.
-3. **Emit** a prompt scoped to *those findings only*, with explicit
-   instructions not to refactor beyond them.
-4. **Hand it to the agent.** Review a scoped diff instead of a speculative
-   rewrite.
-
-Step 3 is the product; steps 1 and 2 are in service of it. Every other tool in
-this space stops at "here's a list of findings."
+The ratio of code-written to code-reviewed has collapsed, and the same speed is
+the way out: an agent pointed at specific, deterministic findings can fix them
+at the rate they appear. The loop is **measure** with no model involved,
+**score** against one uniform standard, **emit a prompt scoped to those findings
+only**, and hand it over. Step three is the product.
 
 **Who does the checking matters as much as what it checks.** An author is never
 the independent check on their own work, so a platform that generates code and
-grades it is producing a self-assessment — a property of the arrangement, not a
-criticism of any one of them. This writes nothing and runs no model, which is
-what lets its verdict be evidence ([the principle](docs/philosophy.md#principles)).
-Since 2.1.0 the work order is also **checked**: `--conformance` compares the
-returned diff against the paths the report named, `--fail-on-regression`
-ratchets the dimension scores, and `--attestation-output` composes them into one
-record ([how that hole was closed](docs/roadmap.md#the-remediation-hole-closed-in-210-through-230)).
-The limit, stated in the same breath: those checks read the diff's **shape**,
-never its correctness — whether the change works is not a claim this tool makes.
-
-One pre-registered experiment has tested the bounded prompt.
-Generic prompting made 2 of 6 repositories worse; bounded prompting made 1 of 6 worse and improved 5 of 6, under this tool's own finding count.
-The *registered* hypothesis was narrower diffs, which did not hold, so the
-registered verdict stands at **INCONCLUSIVE**. Method, limits and raw data:
-[docs/studies.md](docs/studies.md#does-the-bounded-prompt-work-controlled-experiment-pre-registered).
-
-### Who it's for
-
-- Teams running AI agents in the dev loop, tired of unbounded cleanup PRs, who
-  want a CI gate that actively constrains follow-up scope.
-- Repos that want a maintainability gate without a SaaS analyzer or shipping
-  code to a third party.
-- Solo devs who want a single deterministic audit to pin in a Makefile,
-  pre-commit, or local CI script.
+grades it is producing a self-assessment. This writes nothing and runs no model,
+which is what lets its verdict count as evidence. Since 2.1.0 the work order is
+itself checked — scope conformance, a dimension ratchet, and an attestation
+record — and those checks read a diff's **shape**, never whether it works.
+
+The full argument, including what this deliberately does not compete on:
+[why this exists](docs/why-this-exists.md) and
+[philosophy](docs/philosophy.md).
 
 ## The road to 1.0
 
@@ -186,8 +165,8 @@ withheld and the scope is named as the reason.
 ### Checking that the agent did the work
 
 The work order tells an agent to fix exactly these findings and refactor nothing
-else. These flags check that the diff obeyed it — they read its _shape_, not its
-correctness:
+else. Four flags check that the diff obeyed it — reading its _shape_, never
+whether it works:
 
 ```bash
 maintainability-agent \
@@ -198,30 +177,19 @@ maintainability-agent \
   --attestation-output maintainability-attestation.md
 ```
 
-- **`--conformance <revspec>`** compares the diff against the paths the report
-  named, and answers two questions separately: did it **stay in scope**, and did
-  it **silence nothing**. They stay separate because a change can obey the work
-  order and still add a `# noqa` to a finding inside it. A test added for a fix
-  stays in scope even though the work order never named the test file.
-- **`--fail-on-out-of-scope`** turns that into a CI failure.
-- **`--fail-on-regression`** ratchets the _dimension_ scores against scan
-  history, catching a change that improves one dimension while silently
-  regressing another. It has three outcomes, not two — held, regressed, and
-  **not comparable**, because two scans taken under different calibration cannot
-  be differenced.
-- **`--attestation-output`** writes the three into one per-change record: what
-  was measured, what the agent was told to change, whether it stayed inside the
-  work order, and what moved. It is reproducible and **not signed** — nothing
-  here holds a key, and the document says so in its own text. A check nobody ran
-  renders as _not asked_, never as passed.
-- **`--transformation NAME`** names the class of work a scan followed and
-  reports how this run of it compares with earlier ones. **A report, never a
-  gate.** It says one run "moved further" than another, never that it was
-  _better_ — two runs of one codemod land on different code — and it measures
-  the interval, not the transformation.
-
-The [roadmap](docs/roadmap.md#the-remediation-hole-closed-in-210-through-230)
-has the history of why this was the hole under the product's central claim.
+`--conformance` answers two questions separately — did the diff **stay in
+scope**, and did it **silence nothing** — because a change can obey the work
+order and still add a `# noqa` to a finding inside it. `--fail-on-out-of-scope`
+turns that into a CI failure. `--fail-on-regression` ratchets the _dimension_
+scores against history, with three outcomes rather than two: held, regressed,
+and **not comparable**, because two scans taken under different calibration
+cannot be differenced. `--attestation-output` composes them into one per-change
+record, reproducible and **not signed** — a check nobody ran renders as _not
+asked_, never as passed.
+
+Each flag in full, including `--transformation`:
+[docs/cli.md](docs/cli.md). Why this was the hole under the product's central
+claim: [the roadmap](docs/roadmap.md#the-remediation-hole-closed-in-210-through-230).
 
 ### During the loop, not only after it
 
@@ -236,10 +204,16 @@ maintainability-agent --install-precommit-hook             # before committing
 
 **`--check PATH`** answers about content on stdin. No repository, no git, no
 scan; `PATH` names the content and is never opened. Pass file content, not a
-diff — content that does not parse says so rather than reading as clean, as
-does a language with no scanner. In text it is **silent while you have room**
-and speaks once a declaration nears its limit; `--format json` carries the
-remaining budget for every declaration whether or not it is close.
+diff — **a piped diff is refused in every language**, by its format rather
+than by a parser, and says so rather than reading as clean; so does a
+language with no scanner. Beyond that, only Python's content is parsed:
+a brace language's invalid source is not detected, because zero
+declarations is not evidence of a parse failure and marking valid files
+unparsed would be worse than the silence. In text it is **silent while you have room**
+and speaks once a declaration nears its limit — on *any* budget it can be
+failed on, length or cyclomatic or cognitive, not length alone.
+`--format json` carries the remaining budget for every declaration whether
+or not it is close, per budget rather than as one number.
 
 **`--staged`** scans the git index. Stage half a file with `git add -p`, keep
 typing, and what gets measured is what the commit will actually contain —
@@ -258,9 +232,12 @@ The deterministic scanner reads code from your repo (no LLM calls) and produces
 signals on:
 
 - largest files (configurable warn/fail thresholds)
-- function size and complexity — exact ranges for Python via `ast`,
-  brace-bounded for JS/TS/JSX/TSX/HTML — plus **cognitive complexity**
-  (nesting-weighted reading cost)
+- function size and complexity — exact ranges for Python via `ast`, and
+  bounded ranges for every other parsed language, each measured with that
+  language's own reading of what a branch is ([Language
+  support](#language-support) is the list, so this sentence cannot drift
+  out of step with it) — plus **cognitive complexity** (nesting-weighted
+  reading cost)
 - class size, against its own budget (`max_class_lines`)
 - duplicate blocks, and **near-duplicate declarations** compared structurally so
   renaming can't hide a copy, each paired with the original to reuse
@@ -286,9 +263,9 @@ SonarQube, Qlty) rather than replacing them — their SARIF folds in via
 **Be clear-eyed: the tool does not support every language equally, and on an
 unrecognized language it under-reports rather than fails.** Coverage has two layers.
 
-Ten languages are parsed as of **2.7.0**: Python (1.0), Java (1.0), C (1.1),
+Fourteen languages are parsed as of **2.11.0**: Python (1.0), Java (1.0), C (1.1),
 C++ (1.2), C# (1.3), Fortran (free-form 1.4, fixed-form 1.6), Swift (2.4),
-COBOL (2.7), the JS/TS family, and HTML. Each has a scanner written for it and a
+COBOL (2.7), Go (2.11), Rust (2.11), PHP (2.11), Ruby (2.11), the JS/TS family, and HTML. Each has a scanner written for it and a
 documented list of what it misses — a language is claimed only when both exist.
 
 **Built-in scanner (always on, no dependencies)** — reads function/class
@@ -303,6 +280,10 @@ these:
 | C++ (`.cpp`, `.hpp`, `.cc`, `.cxx`, `.hh`) | dedicated brace-bounded scanner — functions, class members, namespaces, templates | Bounded; bodyless declarations are not definitions |
 | C# (`.cs`) | dedicated brace-bounded scanner — methods, constructors, `class`/`interface`/`struct`/`record`/`enum` | Bounded; properties are not declarations |
 | Swift (`.swift`) | dedicated brace-bounded scanner — functions, initialisers, subscripts, `class`/`struct`/`enum`/`protocol`/`actor` | Bounded; extension members carry their type, protocol requirements and computed properties are not declarations |
+| Go (`.go`) | dedicated brace-bounded scanner — functions, methods, `type`/`struct`/`interface` | Bounded; methods carry their receiver type, interface methods are requirements, function literals inside a body are not seen |
+| Rust (`.rs`) | dedicated brace-bounded scanner — functions, `impl` and `trait` members, `struct`/`enum`/`trait`/`union` | Bounded; methods carry the type their `impl` names, trait requirements mint nothing, closures and macro bodies are not read |
+| PHP (`.php`, `.phtml`) | dedicated brace-bounded scanner — functions, methods, `class`/`interface`/`trait`/`enum`; markup outside `<?php` is blanked | Bounded; methods carry their class, bodyless members mint nothing, heredoc bodies are not masked |
+| Ruby (`.rb`, `.rake`, `.gemspec`) | dedicated scanner — methods, classes and modules bounded by `end`, counted by openers | Bounded by depth; methods carry their class, blocks and modifier forms discounted, metaprogrammed methods are not seen |
 | COBOL (`.cbl`, `.cob`, `.cpy`, and `.CBL`/`.COB`/`.CPY`) | dedicated scanner — PROCEDURE DIVISION paragraphs, bounded by the start of whatever follows; fixed-form card columns read where the layout carries them | Bounded by the next header; level numbers and container programs/sections are not declarations |
 | Fortran, free-form (`.f90`, `.f95`, `.f03`, `.f08`, `.F90`, `.F95`, `.F03`, `.F08`, `.pf`) | dedicated **keyword**-bounded scanner — modules, subroutines, functions, derived types | Bounded by `end`; measured with Fortran's own branch and nesting reading |
 | Fortran, fixed-form (`.f`, `.for`, `.ftn`, `.F`, `.FOR`, `.FTN`) | the same scanner over card-column source; continuations joined, labelled `DO` loops understood | Bounded by `end` or by the loop's label |
@@ -310,7 +291,7 @@ these:
 | HTML (`.html`) | same brace scanner (inline `<script>`) | Bounded |
 | TypeScript (semantic) | a recorded analysis or a locally-installed `tsc`, workspace projects included | Type-level facts; `unknown` when no checker is present |
 
-Any language **not** in that table — Go, Rust, Ruby, PHP, Kotlin, and the rest —
+Any language **not** in that table — Kotlin, Scala, Elixir, Zig, and the rest —
 is **not parsed for declarations by the built-in scanner.** Its files still count
 toward repo size, but the built-ins produce no function-size, complexity,
 duplication or dead-code findings for them, and the estimate leans on whatever
@@ -345,54 +326,33 @@ report — so a payload cap can never truncate the prompt.
 
 ## Scoring standard
 
-Based on ISO/IEC 25010 maintainability — modularity, reusability,
-analyzability, modifiability, testability. Scores are **rates calibrated
-against real code**, not counts: every pressure is normalized against the
-median a pinned 112-repo corpus of mature projects actually carries —
-eight of the ten parsed languages (django, angular, spring-framework,
-ghidra, LAPACK, …); Swift and COBOL are parsed but unanchored. How that corpus was selected, what each language actually
-reads, and what the numbers do *not* establish:
-[the calibration study](docs/calibration-2.0-study.md), so `2.5x` means
-"two and a half times what well-maintained real code shows." The corpus median
-earns a **B**; **A+ is gated**, requiring every dimension clean.
-
-The corpus is **selected by query, not taste** — `stars:>3000
-created:<2021-01-01 pushed:>2026-01-01` across Python, TypeScript and
-JavaScript, then filtered to repositories that contain code. The calibration is
-reproducible, not asserted: `python3 tools/calibration/measure.py --check`
-re-measures and fails on drift, and `tests/test_calibration_corpus.py`
-re-derives the constants offline from checked-in measurements. See
-[docs/standard.md](docs/standard.md).
+One rubric, applied uniformly, published in full at
+[docs/standard.md](docs/standard.md): the aspects, their weights, the
+calibration method, and the reference corpus. A score is withheld rather than
+guessed when the evidence does not support one, and the report says which tier
+the evidence came from.
 
 ## Self-audit
 
-This repo eats its own dogfood — the tool runs against this codebase in CI, and
-a report is checked in at [docs/self-audit.md](docs/self-audit.md), **stamped
-with the exact source commit it was generated against** (a provenance record,
-not a claim about HEAD). These figures mirror that stamped report row for row:
+The tool runs against this codebase in CI, and the report is checked in at
+[docs/self-audit.md](docs/self-audit.md), stamped with the exact source commit
+it was generated against — a provenance record, not a claim about HEAD.
 
 | Metric | Value |
 |---|---:|
-| Maintainability estimate | 4.1 / 5 |
+| Maintainability estimate | 4.2 / 5 |
 | Verified grade | B |
-| Files scanned | 391 |
-| File warnings | 120 |
-| File failures | 0 |
-| Function warnings | 65 |
-| Function failures | 0 |
-| Duplicate blocks | 0 |
-| Risk findings | 0 |
+| Files scanned | 476 |
 | Hard gate failures | 0 |
 
-Yes, a **B** — demoted from the A band because warning rates exceed the
-A-grade ceilings, against thresholds this repo sets stricter than the shipped
-defaults. The grade is gated (A+ needs every dimension clean; a
-repo with production code and zero test files cannot earn an A-grade) and banded
-from the evidence floor, so withholding evidence never buys a better letter.
-Every threshold gate — file, function, duplication — is opted **on** for this
-repo's own CI, so drifting below the bar fails the build rather than the README.
-(CI note: `actions/checkout` defaults to `fetch-depth: 1`, which hides history
-and costs roughly a grade — use `fetch-depth: 0`.)
+A **B**, and the report says why: the grade is verified against the evidence
+*floor* of 4.1 rather than the 4.2 point estimate, because an unmeasured aspect
+prices at 0 when a grade has to be defended; and testability is capped at 4.0 by
+an unpaired production unit in the fail band. Those are measured against
+thresholds this repo sets stricter than the shipped defaults, and every threshold
+gate is opted **on** for its own CI, so drifting below the bar fails the build
+rather than the README. The full stamped table — warnings, duplication, risk
+findings — is in the report itself.
 
 ## Platform support