The CAI algorithm.

How the numbers fold up

Each of the 127 dimensions scores 0–10, by documented per-dimension formulas (density-scored, not volume-scored — the same finding count scores better in a larger codebase). Dimensions roll into their lens; the lenses fold into the headline. Both folds are a rank-weighted ordered weighted average (Yager OWA) — never an equal-weight mean.

• Within a lens — the i-th worst dimension weighs q^(i-1) with q = 0.75. A lens carries many dimensions, so the gentler decay keeps the rest earning their score instead of collapsing to the minimum.
• Across lenses — the headline weighs the i-th worst lens q^(i-1) with q = 0.55 (≈46% on the worst of six lenses, ≈2% on the best). A weak area drags the score it feeds instead of being averaged away; a lens with no data is excluded, never counted as zero.
• Critical gate — a measured, non-advisory contributor below 4.0/10 caps its lens's displayed band at Adequate. The gate changes the band, never the number.

Model-assisted (LLM) dimensions are advisory — excluded from the deterministic number, shown band-only. Same commit + same rubric ⇒ the same score, byte-for-byte.

Read from the git history — four dimensions the source alone can't show

Some of the most predictive signals aren't in any single file — they're in how the code has changed over time. These are mined deterministically from git history (by tool, never the LLM) and fold into the same CAI through the Maturity and Architecture lenses. No history, no measurement: where history is shallow or absent, these dimensions abstain rather than guess (a confidence-0 dimension is absent, never a raw 0).

The evidence bundle

A score is computed from an evidence bundle — the open, portable record of what was measured. It carries the rubric version, the measured lenses (score + OWA weight), and the per-dimension results. Producing a bundle is the analyzer's job; scoring one is open. A dimension measured at confidence 0 is absent, never a raw 0.0 — "not assessed" must not read as "failed".

{
  "rubricVersion": "rubric-2026.08.17",
  "headlineScore": 72.2,
  "lenses": [
    { "lens": "securityCompliance", "score": 58, "owaWeight": 0.24 },
    { "lens": "maturity",           "score": 65, "owaWeight": 0.20 },
    ...
  ]
}

Because the weights are published inside the evidence, the fold is exact and reproducible by anyone — no access to the analyzer required. The reference scorer does exactly this.

The bands

A 0–100 lands in one of five fixed-valence bands (the canonical RatingScale.TierFor table). Thresholds are part of the standard and don't move between rubric versions.

What lowers the CAI — and what never can

The score isn't a black box. Here's what actually costs points, by lens — and, just as important, what never moves the number.