Nishi Family › Ops › Ecosystem Scorecard

Sovereign Ecosystem Health Scorecard

Operator mandate (2026-07-20): "industry benchmarking of ecosystems … sovereign versions of state of the art tooling … proper non‑navel‑gazing grading and evidence, from god up." So we do not invent a ruler. We take the real external battery — SQALE/SonarQube, OpenSSF Scorecard, CISQ ISO/IEC 5055, ISO/IEC 25010, DORA, CHAOSS — carry their published thresholds as data, and build our own sovereign implementation of each. Served live by the nx_eco_scorecard MCP tool. Zero third-party code, all-integer.

437‰BATTERY COVERAGE — the headline

16,774organs graded (self-measured, from god up)

738‰OpenSSF-equivalent (7.4/10, 18 checks)

ASQALE maintainability — read the caveat

Why coverage is the headline, and the letter is not. 437‰ means we have built a sovereign version of roughly four ninths of the industry battery: 0 standards fully HAVE, 7 PARTIAL, 1 outright GAP. It rose from 375‰ because a real sovereign CWE scanner now exists — earned by shipping a tool, never by moving a goalpost. A clean SQALE A sitting on a battery we barely implement is precisely the navel-gazing this scorecard exists to prevent — so the letter never travels without the coverage next to it. Both numbers ship together, always.

The external battery — every threshold is theirs, not ours

industry standard	what it measures	published threshold	our sovereign version	status
SQALE / SonarQube TD-ratio	maintainability debt density	A≤5% B≤10% C≤20% D≤50% E>50% (30 min/LOC dev cost)	nx_eco_scorecard sovereign SQALE	PARTIAL
SonarQube duplication gate	duplicated code ratio	quality gate ≤3% duplicated lines	nx_dup_source_check + scorecard ratio	PARTIAL
ISO/IEC 25010	8 product-quality characteristics	conformance quality model	nx_ecosystem_maturity_rollup (22 domains)	PARTIAL
CISQ / ISO/IEC 5055	CWE structural weaknesses across Reliability, Security, Performance, Maintainability	weakness count → 0	nx_cwe_scan — sovereign scanner, gate 6/6	PARTIAL
OpenSSF Scorecard	18 supply-chain / security checks	risk-weighted aggregate /10 (Crit 10 · High 7.5 · Med 5 · Low 2.5)	scorecard openssf map (18/18 mapped)	PARTIAL
Maintainability Index	Halstead + cyclomatic + LOC	>19 healthy (Microsoft)	— not built —	GAP
DORA / Accelerate	deploy freq, lead time, CFR, MTTR	Elite performer bands	nx_dora + /dora	PARTIAL
CHAOSS	ecosystem / community health	metric-model set	standup + coordination planes	PARTIAL

Every GAP is a filed rung with an owner, never an omission — per the standing law that anything below state of the art is a backlog item, not a design choice.

SQALE maintainability — A, and exactly what that does and does not mean

Computed in SonarQube's own form: 11,940 remediation minutes / (30 min-per-LOC × 16,774 organs × 120 LOC) = 0‰ debt density → rating A. Constants are disclosed in the output, not buried. The honest reading: SQALE measures debt density against total development effort, not absolute hazard — and our CWE weakness detectors are a declared GAP, so undetected debt is not in the numerator. An A here means our named debt is small relative to a large codebase, not that the code is clean.

Duplication — passes the industry gate, still a sev-8 hazard

39 duplicate basenames over 16,774 organs = 2‰, comfortably inside SonarQube's 30‰ gate — PASS. We do not let that flatter us: SonarQube counts duplicated lines, whereas ours are whole-file collisions in the build tree, and each one is a build-resolution landmine (a rebuild can silently pick the stale twin — one already detonated the management control plane). Passing the line-ratio gate does not clear the hazard, so it stays separately graded at severity 8.

OpenSSF Scorecard — 7.4/10, where sovereignty wins and where it does not

Where zero-dependency sovereignty structurally wins: Pinned-Dependencies 10 and Dependency-Update-Tool 10 (there are no third-party dependencies to pin or update), Binary-Artifacts 10 (everything builds from source), Dangerous-Workflow 9 (no CI-YAML injection surface at all), Token-Permissions 9 (capability tokens are least-authority by construction), Maintained 10.

Where we are genuinely weak — printed, not hidden: Fuzzing 3, Contributors 3 (knowledge concentrated in few sessions), SAST 4, CII-Best-Practices 4, Code-Review 5 (single-operator), Signed-Releases 6, Vulnerabilities 6. Scores are our own assessment carried as editable data — an upstream Scorecard run is the triangulating rung we have not yet done.

Graded from god up

The denominator is the whole organ population, not a flattering subset: the scorecard walks the live source tree itself and counted 16,774 organs — independently corroborating the atlas from-god graph (~16.6k nodes / ~42.9k edges at last ingest), where every organ traces its lineage root-to-god. Self-measured scope is what makes the grade auditable rather than asserted.

Honest envelope

Thresholds are the published external ones, carried as rows in the native sovereign seg-store plane knowledge/store/ecobench- (with openssf- and favela-) — zero .tsv, per the standing “no tsv, nishi formats” law. Migrated data-lossless and round-trip-verified by nx_tsv_migrate; the live grade was byte-for-byte unchanged across the migration, which is how we know it was faithful. OpenSSF scores are self-assessed, not an upstream run. SQALE constants are disclosed estimates. A value of −1 means the evidence file was absent = UNMEASURED, never a silent zero. The scorecard fails closed: no battery manifest → RED, no grade without data. Gate nx_eco_scorecard_gate GREEN 7/7 — every formula checked against a hand-computed answer, including the failing direction of the duplication gate. Companion lens: the graphics board applies the same presence-versus-reality discipline to rendering.

Measured, never asserted · external-anchored, never self-invented · generated 2026-07-20.