Package Health/jessegall/code-commandments

jessegall/code-commandments

An architecture compiler — judges a PHP, Vue, TypeScript, Python and C# codebase against architectural disciplines and points every violation at the skill that fixes it

Latest v5.18.29

Packagist

68%

Total Score

caution

Strong maintenance activity is offset by a single-contributor bus factor, install hooks, a license mismatch, and weak workflow pinning.

Health Score Breakdown

License

The manifest declares MIT and the artifact contains a BSD-3-Clause license file, so the release is licensed but the declarations do not match. That mismatch warrants checking the intended licensing before adoption.

Lifecycle scripts

The package runs post-install and post-update Composer commands. Install-time code execution increases adoption and upgrade risk, even though no specific malicious behavior is established here.

Project backing

The registry namespace and repository are owned by the same individual account, so the package's continuity depends directly on that maintainer rather than an organization with visible handoff capacity.

Repo bus factor

All 1,156 recent commits came from one contributor, with a contributor count of one and a 100% top-contributor share. This creates a meaningful continuity risk for a user-owned project.

Repo tooling

Composer is used as a build tool, which fits the package ecosystem, but no security scanning tools were detected. The missing scanning is a modest transparency gap rather than evidence of abandonment.