# Weekly Health Digest, 2026-05-13

**Coverage:** First run, no prior baseline. Regenerated 2026-05-15 with
verified-current measurements after the original cells went stale or wrong.

## What got worse

First run, no prior baseline.

## What got better

First run, no prior baseline.

## New untested routes

First run, no prior baseline.

## Current state concerns

- **Untested routes: 89.** Largest concrete code-quality signal. Each
  untested route is a place a regression can land in production without
  a failing test pulling the alarm. Tackle in batches; even five per
  week clears it in ~4 months.
- **109 files over 300 lines.** Up from 104 at the 2026-04-20 baseline
  (+5 in 23 days). Slow drift, not yet a fire — but the trajectory
  matters. Five files in `organism.json`'s `long_file_allowlist` are
  intentional (legacy SDK, schema, docs, fixtures, hand-curated SDK
  source). The other 104 are organic growth — most of those are
  reasonable for a Next.js App Router + governance routes layout.
- **Bus factor of 1.** Wes Sander authored 44 of 50 commits in the last
  30 days; the next contributor is dependabot. Expected for an
  open-source solo project, but worth keeping in mind for governance:
  any single-day outage stops all forward motion. PR #104 (@piiiico's
  Phase 2 agent identity) shipped this week — a real outside contributor
  push that the bus-factor metric doesn't capture, because the merge
  commit is authored by the maintainer.

## One thing to do this week

Pick **5 untested routes** from the inventory at `docs/api-inventory.md`
and add minimal happy-path + error-path tests for each. Goal: drive the
89 number down each week. Pair with `npm run api:inventory:check` to
confirm every newly-tested route is reflected.

(Original recommendation was "patch 2 JS vulnerabilities via `npm
audit`" — verified moot: `npm audit --json` reports `total: 0` as of
2026-05-15. Either the collector miscounted at original digest time, or
the issues got patched in the intervening days. Either way, no action
needed there.)

## Raw deltas

| Metric | This week | Last week | Delta | Notes |
|---|---|---|---|---|
| CI pass rate (30d) | ~100% | n/a | n/a | Verified via `gh run list` — all recent CI runs green. Original cell read 0.0% / `gate_count=0`; that's a digest-collector bug, not a missing CI. CI workflow at `.github/workflows/ci.yml` runs 13 gates per push to main. |
| Last 10 CI runs | 10/10 success | n/a | n/a | Including today's 4 commits all green |
| Files over 300 lines | 109 | 104 (2026-04-20) | +5 | Slow drift |
| Untested routes | 89 | n/a | n/a | The actionable signal |
| JS vulnerabilities | 0 | n/a | n/a | Original cell read 2 (stale or transient) |
| Lockfile age (days) | 0 | n/a | n/a | Fresh |
| Commits in last 7 days | 12 | n/a | n/a | Plus 5 more today (2026-05-15) — Phase 2 PR #104, todo-001/002, version-drift fixes |
| TODO count | 1 | n/a | n/a | Now 0 — todo-001 + todo-002 resolved 2026-05-14 |

## Digest pipeline issues to fix upstream

These are bugs in whatever generates this file, not in DashClaw's code:

1. **`gate_count=0` is wrong.** `.github/workflows/` exists and contains
   nine workflows (ci, claude, codeql, demo-image, hosted-cleanup,
   integration-health, outcome-sweep, refresh-model-pricing, sdk-live).
   The collector is presumably trying to read CI run data via
   GitHub API but failing — likely an auth or API-call issue.
2. **`ci_pass_rate_30d: 0.0%` is wrong** for the same reason.
3. **Cycle counter says 3 but only 1 digest file exists.** Cycles 1
   and 2 either ran without writing, were pruned, or failed silently.
4. **Recommendation generator picked the wrong signal.** Two zero-day
   patchable vulnerabilities ranked above 89 untested routes in the
   "one thing to do" — should weight code coverage gaps more heavily
   when vuln count is low.
5. **Recommendation against `sdk/legacy/dashclaw-v1.js` (split or
   quarantine) ignored that the file is ALREADY in
   `organism.json`'s `long_file_allowlist`.** The check should respect
   the project's own allowlist before flagging.
