Nishi Family › Compare › Code Health and Janitor
Nishi Compare · measured, not asserted
Code Health and Janitor
Nishi vs the field — every Nishi cell is measured against real organ source at emit time; each gap names the watch contract that will close it.
Nishi vs SonarQube and Semgrep and Knip and Renovate
Layer 1 · Executive
Where we are. The janitor is a running code-health system with properties the field does not ship: additive-only never-brick cleaning with no delete syscall anywhere in the fleet (exceed), a sovereign zero-dependency fleet on our own substrate (exceed), a whole-tree debt walker (genuine debt 544, purity 892 permil), a unified scorecard, shadow-name and dead-artifact detection, byte-verified migration, reversible retirement, multi-axis locked ratchets, a scratch meter, a freshness caretaker, caller analysis before rename, conductor-governed runs, and -- corrected today -- a gate-proven secrets scanner. Behind the field on breadth: dependency-update automation, SBOM and license, taint rules, multi-language lint, CI and PR and IDE surfaces, auto-fix, a web dashboard, and LLM-assisted repair.
Where we need to go. The security ring first (SBOM and license from the headers we already tag, taint rules over the genealogist's dataflow engine), then the surfaces (a dashboard that is the scorecard, PR and IDE doors, auto-fix that patches CODE with the same byte-verified reversibility the scrub gives DATA), then update automation and LLM-assisted repair verified by the forge's judge.
The unit. 1 u = one measured session-leg (estate calibration: graphics R21 in one leg 2026-08-15). Local evidence: the scorecard gate 5/5 and the retire organ gate 5/5 each landed in one leg; estimates are relative to those.
Where we are: 9 open rungs. Cleaning and ratchet culture ahead; security breadth and integration surfaces behind. Counts measured at emit below this line.
Cost to the security ring: 3.5 u. JN3 SBOM and license from the license_tier headers, JN4 taint rules over the genealogist's query engine.
Cost to surfaces: 3.5 u. JN9 the dashboard page emitted from the scorecard, JN6 the PR door, JN7 the IDE diagnostics push.
Cost to automation and repair: 7 u. JN2 dependency-update proposals, JN5 multi-language lint, JN8 reversible auto-fix, JN10 LLM-assisted refactor under the judge.
Research bar. SonarQube 26.7 is measured on quality gates, taint analysis, dashboard, IDE (SonarLint). Theirs: the platform bar. Ours: JN4 JN7 JN9 measured on this page.
Research bar. Semgrep 1.169 is measured on rule engine, taint mode, autofix, 30-plus languages. Theirs: the rule-engine bar. Ours: JN4 JN5 JN8.
Research bar. Renovate 43.257 is measured on scheduled dependency-update PRs. Theirs: the update-automation bar. Ours: JN2 JN6.
Research bar. Knip 6.25 is measured on dead-export detection with fix. Theirs: the dead-code bar. Ours: already matched on detection; JN8 adds the fix, reversibly.
15 of 24 capabilities measured|2 of them measured exceeds|9 open|coverage 625/1000|adoption 8 full / 7 partial
Layer 2 · Roadmap
Do this next — computed by the ranker, never chosen by a seat
Order from nx_compare_rank (nx_dr_ocm: (deficit + cost-of-delay + option + enables) x sponsor x self-sufficiency x momentum / cost). FINISH rows are rungs whose symbol is present but whose organ is short of full adoption: the cheapest closures on this board, listed before any new work. Stamp: # asof=1787883513 domain=janitor target_version=0.1 rungs=13 done=4 open=9 finish=3 ranker=nx_dr_ocm
| # | Stage | Rung | Priority | Derivation |
|---|---|---|---|---|
| F | FINISH | Whole-tree debt walker (JR0) func sav_class_of | SOURCE-ONLY | source exists, never compiled: /api/build it |
| F | FINISH | Locked multi-axis ratchet (JR1) func spr_check_all | LIB-GATE-ONLY importers=1 | imported only by validation organs (gates, tests, benches): wire it into a shipping program |
| F | FINISH | Secrets scanner (JR3) func main(argc | PROMOTED-UNREGISTERED | a real binary nobody can call over MCP: /api/tools/register it; no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked); only referenced by nx_secret_scan_gate -- a mention, not a run |
| #1 | 0.1 | SBOM and license compliance (JN3) sbom_emit | 1200 | v=9 m=2 c=15 |
| #2 | 0.1 | Security taint rules (JN4) tn_taint_rule | 700 | v=7 m=2 c=20 |
| #3 | later | Web dashboard (JN9) hdj_emit_page | 3000 | v=15 m=2 c=10 |
| #4 | later | Reversible auto-fix (JN8) afx_apply_fix | 2300 | v=23 m=2 c=20 |
| #5 | later | Multi-language lint (JN5) mll_lint_lang | 2000 | v=15 m=2 c=15 |
| #6 | later | CI and PR door (JN6) ci_pr_comment | 1200 | v=6 m=2 c=10 |
| #7 | later | Dependency-update automation (JN2) du_propose_update | 933 | v=7 m=2 c=15 |
| #8 | later | LLM-assisted refactor (JN10) llr_propose_refactor | 450 | v=9 m=1 c=20 |
| #9 | later | IDE diagnostics push (JN7) idl_diag_push | 200 | v=3 m=1 c=15 |
Critical path — contract, done-rule, executor, cost
| Rung | Closes with | Definition of done (pre-declared) | Executor | Est. |
|---|---|---|---|---|
| Whole-tree debt walker (JR0) | func sav_class_of | 89,742 files walked, KILL MIGRATE REVIEW classes -- LANDED | Organ | 0 u |
| Locked multi-axis ratchet (JR1) after JR0 | func spr_check_all | Debt, collisions, scratch ratchet down and lock -- LANDED | Organ | 0 u |
| Reversible no-delete retirement (JR2) | func jan_retire_dest | Store-verified renameat to _retired, unretire proves reversal -- LANDED gated 5/5 | Organ | 0 u |
| Secrets scanner (JR3) | func main(argc | nx_secret_scan, KAT 5 of 5 plus production sweep GREEN -- LANDED (row corrected 2026-08-19) | Organ | 0 u |
| SBOM and license compliance (JN3) after JR0 | sbom_emit | A bill of materials for any organ closure from the license_tier headers and the import graph, with a license-policy check read as data; gate proves a closure containing a disallowed tier is refused with the organ named and our own stack lists zero third-party deps | Organ | 1.5 u |
| Security taint rules (JN4) after JR0 | tn_taint_rule | Vulnerability-pattern rules (source to sink) evaluated over the genealogist's dataflow engine (the cq_dataflow_query contract on /compare/genealogy); gate proves a planted unsanitized argv-to-exec path fires and the sanitized twin does not | Organ | 2 u |
| Web dashboard (JN9) after JR1 | hdj_emit_page | The scorecard emitted as a page behind the operator login: debt, collisions, scratch, ratchet floors, each number linking to its detector's log; gate proves the page numbers equal the scorecard's and a missing zone reads -1 not 0 | Organ | 1 u |
| CI and PR door (JN6) after JR1 | ci_pr_comment | The ratchet verdict posted as a comment on a sovereign-git change with the offending rows named; gate proves a change that raises debt gets a RED comment and a clean change gets GREEN | Organ | 1 u |
| IDE diagnostics push (JN7) after JN9 | idl_diag_push | Scorecard and lint findings pushed as diagnostics through the lang lane's LSP door (lsp_serve) so they appear in-editor; gate proves a shadow-collision finding appears at the right file:line | Organ | 1.5 u |
| Dependency-update automation (JN2) after JR0 | du_propose_update | Proposed updates for organ-version staleness (the staleness caretaker already measures it) as reviewable change sets, never auto-applied; gate proves a stale organ yields one proposal and a current tree yields none | Organ | 1.5 u |
| Multi-language lint (JN5) after JR0 | mll_lint_lang | Real lint for at least one foreign file class beyond extension-level classification (sharing the genealogist's ml_parse_lang grammar table); gate proves a planted JS lint failure is found | Organ | 1.5 u |
| Reversible auto-fix (JN8) after JR2 | afx_apply_fix | Patches CODE for the mechanical classes (dead import, shadow rename) with the same law as the scrub: original banked, byte-verified, unretire-style reversal; gate proves apply then reverse returns byte-identical source and a fix that fails to build is auto-reversed | Organ | 2 u |
| LLM-assisted refactor (JN10) after JN8 | llr_propose_refactor | The sovereign model proposes a refactor for a scorecard finding, VERIFIED by the forge's byte-exact judge and applied only through JN8's reversible path; gate proves a proposal the judge rejects is never applied | Organ | 2 u |
Milestones
| Milestone | Rungs | Cumulative |
|---|---|---|
| M1 · Security ring | JN3,JN4 | 3.5 u |
| M2 · Surfaces | JN9,JN6,JN7 | 7 u |
| M3 · Automation and repair | JN2,JN5,JN8,JN10 | 14 u |
Layer 3 · Engineering
How this is scored. Every Nishi mark is measured: the generator reads the real organ source on disk and requires the implementing symbol to exist (no self-grading). A watching tag names the organ and symbol contracted to close a gap — the mark flips itself on the next compare beat when that workstream ships, and the
comparewatch- plane row flips with it. The flip is necessary, not sufficient: it proves the symbol exists, never that the capability is good. The bar is the rung's pre-declared done-rule, proven by its gate — a symbol shipped without the behaviour behind it is a defect, and the flip is exactly what makes that defect visible instead of quiet. Competitor marks record documented capability presence — presence, not depth or scale. Adoption is measured too: every measured row carries where its organ stands on the estate's ladder (source → built → promoted → registered → invoked; libraries by importer reach minus validation importers; gates by the execution surfaces that run them). A row is fully adopted only at the top of its ladder; anything short is tagged partial with the exact remedy, so a build nobody promoted can no longer read as shipped. Census stamps: importers asof 1787849099, gate census asof 1787855507 (unix seconds; -1 = census absent).Capability matrix — measured against source
◉ leads / measured exceed● present◐ partial○ absent · click any capability for its evidence
| Capability | Nishi | SonarQube | Semgrep | Knip | Renovate |
|---|---|---|---|---|---|
Whole-tree debt walker with 3-way debt classificationMeasured:func sav_class_of exists in runtime/nx_sovereignty_audit.nx, verified at emit. LIVE 2026-07-10: 89742 files walked, genuine_debt=544 verdict GREEN, purity 892 permil (was 7071 on 2026-06-23); classes KILL, MIGRATE, REVIEW [cunningham92]; SonarQube is the platform bar for debt dashboards [sonarqube-qgates] Adoption: SOURCE-ONLY — PARTIAL: source exists, never compiled: /api/build it. | ● | ◉ | ● | ◐ | ○ |
Unified cleanliness scorecard (debt + collisions + scratch)Measured:func ssc_debt exists in runtime/_hdl_build/nx_sovereignty_scorecard.nx, verified at emit. LIVE 2026-07-10 gate 5/5: debt=544, shadow_collisions=19, scratch=627 -- one observable, each axis grounded in its own detector Adoption: LIB-WIRED importers=2 nonval=1 — fully adopted (top of its ladder). | ● | ◉ | ○ | ○ | ○ |
Duplicate and shadow-name detectionMeasured:func jdn_scan exists in runtime/_hdl_build/nx_janitor_dupname.nx, verified at emit. LIVE: 19 shadow collisions (organs that run the WRONG code by name); June resolutions took 22 to 14, five NEW ones crept in since -- the creep the ratchet exists to catch; SonarQube CPD finds copy-paste, not name-shadowing Adoption: LIB-WIRED importers=12 nonval=6 — fully adopted (top of its ladder). | ● | ◐ | ○ | ◐ | ○ |
Dead and orphan artifact detectionMeasured:func js_referenced exists in runtime/_hdl_build/nx_janitor_sprawl.nx, verified at emit. Registry artifacts referenced by ZERO organs get flagged for reversible quarantine; Knip is the dead-export bar for JS/TS [knip-docs] Adoption: SOURCE-ONLY — PARTIAL: source exists, never compiled: /api/build it. | ● | ◐ | ○ | ◉ | ○ |
In-content sovereignty lint (imports + exec targets)Measured:func sa_audit exists in runtime/_hdl_build/nx_sov_import_lint.nx, verified at emit. Flags non-sovereign imports and exec-target literals inside source; Semgrep the rule-engine bar [semgrep-taint] Adoption: SOURCE-ONLY — PARTIAL: source exists, never compiled: /api/build it. | ● | ● | ◉ | ○ | ○ |
Byte-verified additive migrationMeasured:func jan_migrate exists in runtime/_hdl_build/nx_janitor_scrub.nx, verified at emit. Any non-sov data file to seg_store, BYTE-VERIFIED, original INTACT; peers report problems, none carry a verified data-migration action Adoption: LIB-WIRED importers=3 nonval=2 — fully adopted (top of its ladder). | ● | ○ | ○ | ○ | ○ |
Reversible no-delete retirementMeasured:func jan_retire_dest exists in runtime/_hdl_build/nx_janitor_retire.nx, verified at emit. REFUSES unless bytes are store-verified; renameat to _retired/, jan_unretire proves reversal; gate 5/5 Adoption: LIB-WIRED importers=2 nonval=1 — fully adopted (top of its ladder). | ● | ○ | ○ | ○ | ○ |
Multi-axis ratchet with locked floorsMeasured:func spr_check_all exists in runtime/_hdl_build/nx_sprawl_ratchet.nx, verified at emit. Debt, collisions, scratch each ratchet DOWN and LOCK -- any rise is RED; SonarQube quality gates fail-on-worse [sonarqube-qgates] is the closest peer idea; floors need re-lock at today's 544/19/627 Adoption: LIB-GATE-ONLY importers=1 — PARTIAL: imported only by validation organs (gates, tests, benches): wire it into a shipping program. | ● | ◐ | ○ | ○ | ○ |
Scratch and artifact accumulation meterMeasured:func jsc_count exists in runtime/_hdl_build/nx_janitor_scratch.nx, verified at emit. LIVE: 627 scratch files (was 258 on 2026-06-23 -- 2.4x creep); missing zone reads -1 not 0 (absent is not empty) Adoption: LIB-WIRED importers=2 nonval=1 — fully adopted (top of its ladder). | ● | ○ | ○ | ○ | ○ |
Staleness and freshness caretakerMeasured:func jn_surface exists in runtime/_hdl_build/nx_janitor.nx, verified at emit. Are surfaces regenerating, is the system alive -- STALE = silent death; Renovate [renovate-docs] covers the dependency-staleness slice only Adoption: SOURCE-ONLY — PARTIAL: source exists, never compiled: /api/build it. | ● | ○ | ○ | ○ | ◐ |
Caller and impact analysis before renameMeasured:func oc_grep exists in runtime/_hdl_build/nx_organ_callers.nx, verified at emit. Sovereign whole-tree reference search (no timeout on 89k files); powers the checked collision-resolution method that took 22 to 14 with zero functionality lost Adoption: LIB-WIRED importers=6 nonval=4 — fully adopted (top of its ladder). | ● | ◐ | ◐ | ◐ | ○ |
Governed autonomous runs (conductor-owned pulses)Measured:cr_seed exists in runtime/_hdl_build/nx_conductor_registry.nx, verified at emit. Ratchet gates registered as warden-owned conductor pulses -- governed, never ad-hoc; Renovate is the bar for fully-scheduled autonomous hygiene [renovate-docs] Adoption: LIB-WIRED importers=5 nonval=4 — fully adopted (top of its ladder). | ● | ◐ | ○ | ○ | ◉ |
Dependency update automationOpen — watchingruntime/nx_dep_update.nx : du_propose_update, re-measured on every compare beat. Ship that symbol and this mark flips itself; the comparewatch- plane row flips with it. Renovate 43.257.2 (released 2026-07-10) is the field bar [renovate-docs]; sovereign imports are vendored by doctrine but organ-version staleness has no automation | ○ | ◐ | ○ | ○ | ◉ |
Secrets and credential scanningMeasured:func main(argc exists in runtime/_hdl_build/nx_secret_scan.nx, verified at emit. STALE-ABSENT CORRECTED 2026-08-19: the scanner EXISTS (nx_secret_scan, its KAT gate 5 of 5 plus a production sweep GREEN over 15,566 files on 2026-08-14); this row carried a bare _ABSENT_ on a file name that was never the organ's. The fs reader deny-lists the scanner's own source by name, so the measured symbol is the program itself; gitleaks remains the breadth bar [gitleaks] Adoption: PROMOTED-UNREGISTERED — PARTIAL: a real binary nobody can call over MCP: /api/tools/register it; no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked); only referenced by nx_secret_scan_gate -- a mention, not a run. | ● | ● | ◐ | ○ | ○ |
SBOM and license complianceOpen — watchingruntime/nx_sbom.nx : sbom_emit, re-measured on every compare beat. Ship that symbol and this mark flips itself; the comparewatch- plane row flips with it. license_tier tags exist in organ headers; no bill-of-materials or license-audit organ reads them [spdx-spec] | ○ | ◐ | ◐ | ○ | ○ |
Security taint-analysis rulesOpen — watchingruntime/nx_taint.nx : tn_taint_rule, re-measured on every compare beat. Ship that symbol and this mark flips itself; the comparewatch- plane row flips with it. SonarQube commercial taint analysis leads; Semgrep taint mode [semgrep-taint] partial; we have no vulnerability-pattern rules | ○ | ◉ | ◐ | ○ | ○ |
Multi-language analysisOpen — watchingruntime/nx_multilang_lint.nx : mll_lint_lang, re-measured on every compare beat. Ship that symbol and this mark flips itself; the comparewatch- plane row flips with it. Peers analyze 30+ languages; our lint depth is NishiLang-only (the auditor classifies every file type but only by extension) | ○ | ◉ | ● | ◐ | ◐ |
CI and PR integrationOpen — watchingruntime/nx_ci_hook.nx : ci_pr_comment, re-measured on every compare beat. Ship that symbol and this mark flips itself; the comparewatch- plane row flips with it. Every peer comments on pull requests; our pulses are internal -- no PR surface | ○ | ● | ● | ● | ◉ |
IDE integrationOpen — watchingruntime/nx_ide_lint.nx : idl_diag_push, re-measured on every compare beat. Ship that symbol and this mark flips itself; the comparewatch- plane row flips with it. SonarLint in-editor is the bar; we ship none | ○ | ◉ | ● | ○ | ○ |
Automated fix generationOpen — watchingruntime/nx_autofix.nx : afx_apply_fix, re-measured on every compare beat. Ship that symbol and this mark flips itself; the comparewatch- plane row flips with it. Renovate auto-PRs updates, Semgrep autofix, Knip --fix removes dead exports [knip-docs]; our scrub migrates DATA but never patches CODE | ○ | ◐ | ◐ | ◐ | ◉ |
Web dashboard UIOpen — watchingruntime/nx_health_dashboard_jan.nx : hdj_emit_page, re-measured on every compare beat. Ship that symbol and this mark flips itself; the comparewatch- plane row flips with it. SonarQube dashboard is the bar; our scorecard is console-only (this /compare page is the first public surface) | ○ | ◉ | ◐ | ○ | ◐ |
LLM-assisted repair and refactoringOpen — watchingruntime/nx_llm_refactor.nx : llr_propose_refactor, re-measured on every compare beat. Ship that symbol and this mark flips itself; the comparewatch- plane row flips with it. SonarQube AI CodeFix class features arriving across the field; connects to our LLM-assisted-compiler-testing radar gap (mom 145) | ○ | ◐ | ◐ | ○ | ○ |
Never-brick cleaning by construction (additive-only, no delete syscall, reversible)Measured exceed:jan_unretire in runtime/_hdl_build/nx_janitor_retire.nx, verified at emit. The janitor CANNOT destroy: no sys_unlink anywhere in the fleet, byte-verified store before any move, unretire proves reversal, gates 5/5 x4 organs; knip --fix deletes code, Renovate rewrites manifests -- none are reversible-by-construction Adoption: LIB-WIRED importers=2 nonval=1 — fully adopted (top of its ladder). | ◉ | ○ | ○ | ○ | ○ |
Sovereign zero-dependency fleet on own substrateMeasured exceed:func sav_class_of in runtime/nx_sovereignty_audit.nx, verified at emit. Whole fleet is NishiLang organs on our own compiler and runtime, offline, zero SaaS, zero phone-home; peers self-host but sit on Java, OCaml or Node stacks and center on cloud services Adoption: SOURCE-ONLY — PARTIAL: source exists, never compiled: /api/build it. | ◉ | ◐ | ◐ | ◐ | ◐ |
Risk register
| Risk | Likelihood x impact | Mitigation |
|---|---|---|
| An auto-fix that deletes is the one thing the janitor has never been allowed to do | certain x high | JN8 inherits the no-delete law: bank, verify, reverse -- a fix without a reversal path is refused by its own gate. |
| Taint rules tuned on the planted example fire on everything | possible x medium | JN4 publishes its false-positive rate over the corpus before any rule ships. |
On these two registers. Rows are declared in the domain's plan file and carry the debt id, which is the join key back to the sovereign debt plane — that plane, not this page, is the authority on state. Reconciling them automatically (the regen reading the plane and refreshing these rows) is a named, owed rung; until it lands, treat an id here as a pointer to look up, not a status to trust.
Honest verdict. The Nishi janitor is a REAL, running code-health system with properties the field does not ship: additive-only never-brick cleaning (byte-verified store before any move, reversible unretire, the janitor has NO delete syscall) and locked ratchet floors so cleaned debt cannot silently return. The instruments ran live for this census: genuine debt 544 (down from 7071 on 2026-06-23, purity 892 permil) but shadow collisions crept 14 to 19 and scratch doubled to 627 -- the ratchet floors need conductor-governed re-locking. Against the field it is honestly behind on breadth: no dependency-update automation (Renovate), no secrets scanning, no SBOM or license compliance, no taint-analysis security rules (SonarQube and Semgrep), no CI, PR, or IDE integration, no auto-fix generation, single-substrate only. The climb: wire the detect-clean-ratchet loop autonomous through the conductor, then the security ring (secrets, vuln rules), then integration surfaces.
Person · product · place — not yet measured for this domain
Every compare carries this layer. Declare
knowledge/compare/janitor.ppp (rows surface|nishi or c1..c4|label|url|connect naming OUR live surface and each rival's front door), run nx_ppp_probe domain janitor, and this section fills itself on the next beat: the same ruler on both sides — privacy and CX (third-party hosts, tracker classes, cookies, security headers), design and longevity (design hygiene, computed WCAG contrast, render-blocking resources, unsized media, script weight, theme and motion queries), findability (landmarks, skip link, on-site search, breadcrumb, headings, internal links).References
Beyond a link list. Every reference below resolves twice — the publisher's copy and, where banked, the estate's own non-rottable library mirror with a content pin — and carries its evidence class plus the exact claim on this page it grounds. Keyed marks like [key] in the matrix notes jump here. A dash means honestly absent, never assumed.
- [sonarqube-qgates] Sonar. SonarQube Server documentation: Understanding quality gates -- a set of conditions on new or overall code metrics that a project must pass to be release-ready. publisher · read in our library
knowledge/fetched/cmp_janitor_sonarqube-qgates.html· pinh22e98a5d4284c7e473df745eaca989efe573d3373900e4716f6d6c0920f95736· accessed 2026-08-18 · vendor-docGrounds: The SonarQube column: "Multi-axis ratchet with locked floors" names SonarQube quality gates fail-on-worse as the closest peer idea to our DOWN-and-LOCK ratchets, and "Whole-tree debt walker" and "Web dashboard UI" grade SonarQube as the platform bar; this is the vendor's own definition of that gate. - [semgrep-taint] Semgrep documentation: Taint analysis overview (taint mode) -- tracking untrusted data from sources through propagators to sinks without sanitization. publisher · read in our library
knowledge/fetched/cmp_janitor_semgrep-taint.html· pinh7c15e8955c033765749a3a8848839e9be4e051af019960cf5e6cad64f34e2a68· accessed 2026-08-18 · vendor-docGrounds: The Semgrep column: "Security taint-analysis rules" (Semgrep taint mode partial, 3; Nishi _ABSENT_) and "In-content sovereignty lint (imports + exec targets)" where Semgrep is the rule-engine bar (2); this is what taint mode is per the vendor. - [knip-docs] Knip documentation: Declutter your JavaScript and TypeScript projects -- finds and removes unused files, dependencies and exports. publisher · read in our library
knowledge/fetched/cmp_janitor_knip-docs.html· pinhc46229f255ac6744d683d80a4b1771508b54c5f7abf56ad43a212be7dac1830f· accessed 2026-08-18 · vendor-docGrounds: The Knip column: "Dead and orphan artifact detection" (Knip is the dead-export bar for JS/TS, 2) and "Automated fix generation" (knip --fix removes dead exports); the EXCEED row notes knip --fix DELETES code where our retirement is reversible by construction. - [renovate-docs] Renovate documentation (docs.renovatebot.com): automated dependency updates, multi-platform and multi-language, delivered as pull requests. publisher · read in our library
knowledge/fetched/cmp_janitor_renovate-docs.html· pinh4164ac65c65681c208f37fe9af96096ee07e91d6e15824d0e843776e13f2740d· accessed 2026-08-18 · vendor-docGrounds: The Renovate column: "Dependency update automation" (Renovate is the field bar, 2; Nishi _ABSENT_), "Governed autonomous runs" (Renovate is the bar for fully-scheduled autonomous hygiene) and "Staleness and freshness caretaker" (dependency-staleness slice only). - [cunningham92] Cunningham. The WyCash Portfolio Management System. OOPSLA 1992 experience report -- the origin of the technical-debt metaphor ("shipping first time code is like going into debt"). publisher · read in our library
knowledge/fetched/cmp_janitor_cunningham92.html· pinh7bb0ebbd6e99b96cb15229de39e810dd7644ea56a755a22668663f68b09de5d5· accessed 2026-08-18 · published-paperGrounds: The "Whole-tree debt walker with 3-way debt classification" row and the genuine_debt 544 figure: the debt vocabulary the janitor measures (KILL, MIGRATE, REVIEW; purity permil) descends from this report's metaphor, including its warning that unrepaid debt brings an organization to a standstill. The mirror is the complete short report (4,311 bytes), not a stub. - [gitleaks] Gitleaks (gitleaks/gitleaks): a secret-detection tool for passwords, API keys and tokens in git repositories, files and stdin, driven by regex rules (GitHub repository README). publisher · read in our library
knowledge/fetched/cmp_janitor_gitleaks.html· pinh038472de2aecbca2257ae5c1e985961042796bd1432474a9b63ffeebcb745782· accessed 2026-08-18 · vendor-docGrounds: The "Secrets and credential scanning" row (Nishi _ABSENT_ at census time; the vault doctrine keeps credentials out of source by convention but nothing SCANS): what a leak scanner is in the field, the bar for the named security ring. - [spdx-spec] SPDX (System Package Data Exchange) Specification 3.0.1, The Linux Foundation: the software bill of materials data model and serialization. publisher · read in our library
knowledge/fetched/cmp_devguardrails_spdx-spec.html· pinha905ca11b54700955ba92b4dbdf9d35553852b82bfddf2fabc06cabc194e120a· accessed 2026-08-18 · published-standardGrounds: The "SBOM and license compliance" row (Nishi _ABSENT_; license_tier tags exist in organ headers but no bill-of-materials organ reads them): the interchange format such an organ would emit. Mirror shared with devguardrails.refs.
generated by nx_swcompare_matrix (sovereign NishiLang organ) from knowledge/compare/janitor.matrix · every Nishi cell verified against organ source at emit time · watch cells re-measured on every compare beat · zero JS, zero trackers