Reproducible software audits: Python import graphs, eager cycles, test discovery and CI signals. Every result is tied to a specific object and scope.
Verifiable samples from public repositories. Summaries do not replace full audit records; each gives the pinned commit, measured result and what remained unmeasured.
45 files · 459 test functions · 3.35% of the corpus
At the audited commit, reconstructing shards, aggregators and direct calls left 45 files without an execution path: 33 omitted by an aggregator and 12 in a declared exclusion. Twenty-five candidates were removed before the verdict.
Limit: static reachability at one pinned commit; this does not measure test execution or infer negligence.
3 cycles · 5 failing entry probes · 3 passing controls
The import matrix reproduced failures when selected SQLite, PostgreSQL and Oracle modules were imported first; control entry points passed. The symptom depends on load order.
Limit: SQL, migrations, live database engines and exploitability were not tested. The record explicitly says this is not a vulnerability.
12 of 13 nodes hidden after aborting with -x
The case reconstructed a setup failure (TT_FATAL), separated expected hardware skips from the finding and tracked the upstream fix. The raw skip count is not presented as an orphan-test rate.
Limit: historical result for a specific window and commits; it does not describe the repository's current state.
Breakage · tenstorrent/tt-metal#59955 (7d399796) · Fix · tenstorrent/tt-metal#61470 (78957cf0)
0 eager cycles · 0 of 8 changed source paths intersected
The full graph contained six strongly connected components, but none were eager and none intersected the eight source paths in the audited change.
Limit: structural analysis of one commit; runtime, security, performance and the PR test suite were not measured.
0 eager cycles in vllm_omni/platforms/
Five components in scope included deferred imports. A separate eager cycle outside the contracted scope was disclosed as out of scope.
Limit: static graph at the pinned commit; accelerator runtime and unresolved dependencies remained NOT MEASURED.
1 mixed SCC · 0 eager cycles
The changed path belongs to an 18-module component in the full graph. Eager/deferred separation found no eager cycle; fan-in was treated as static centrality, not fragility.
Limit: runtime import could not complete because Werkzeug was missing; behavior and security remained NOT MEASURED.
A number without a subject, denominator and scope is not a finding. The records separate static structure, execution and limits instead of collapsing them into one label.
Each summary names the repository and commit observed; it does not extrapolate to a moving branch.
Results are limited to the files, tests or layers contracted for that run.
Where applicable, controls and conditions that would change the verdict are declared.
“Zero in scope” is a result; it does not certify the entire system as defect-free.
Boundary: these samples are structural and CI analyses, not a general security certification. The PyTorch report here concerns test reachability, not dependency cycles; there is no Scrapy audit in this published selection yet.
Reproducible audit proposals for public repositories.
Ask about an audit Editorial project · El Arquitecto Cuántico