TRUEMEND · SAMPLE AUDIT REPORT · halyard-api · 2026-07-06phone version → · back to the report page

PAGE 01 · COVER

Truemend

Technical Audit Report

LIVE ANALYSIS · VENDORS.TS

1 // anti-pattern: try/catch-rethrow

2 async function saveVendor(data) {

3 try {

4 const res = await api(data);

5 return res;

6 } catch (e) {

7 throw e; // ← flagged

8 }

9 }

→ deterministic fix applied

async function saveVendor(data) {

const res = await api(data);

return res;

}

HEALTH SCORE · 47 FILES

6.6/ 10

Architecture7.3

Reliability5.4

Concurrency6.2

Errors4.9

Types6.9

Testing4.4

Code Quality Audit

halyard-api

Prepared for Halyard Systems

2026-07-06 · confidential

OVERALL HEALTH SCORE

6.6/ 10

Above the ship threshold, dragged down by two areas: testing and error handling. Nearly half of the 30 findings apply for free.

FILES ANALYZED

512

FUNCTIONS SCORED

47%

OF FIXES COST $0

PAGE 02 · EXECUTIVE SUMMARY

TRUEMEND · HALYARD-APIConfidential

Executive Summary

6.6/ 10

OVERALL HEALTH

A solid core with a thin safety net. Architecture and typing are strong; testing (4.4) and error handling (4.9) are the drag on the score.

47 FILES

512 FUNCTIONS

41% AI-AUTHORED

214 FINDINGS

FINDINGS BY SEVERITY · 214 TOTAL · AUTHORITATIVE COUNTS

Critical · 4%

High · 18%

102

Medium · 48%

Low · 30%

FIX ECONOMICS · WHAT IT COSTS TO CLEAR≈ $4,850 est. remediation · 47% costs $0

1017241

Deterministic

$0 · applies automatically, verified re-parse

Cataloged refactor

≈ $2,400 · constrained LLM, validated

Structural rewrite

≈ $2,450 · human decision required

WEAKEST DIMENSIONS · BOTTOM 5 OF 40 · LOOK HERE FIRST

Test strategy3.8

Logic clarity4.2

Test quality4.4

Error transparency4.5

Timeout discipline4.6

PAGE 03 · SCORECARD · CLUSTERED

TRUEMEND · HALYARD-APIConfidential

40-Dimension Scorecard

Seven families, forty signals

The forty dimensions rolled into named families so the shape reads at a glance. Full per-dimension detail follows overleaf.

Architecture

8 dims

7.3

▼ Abstraction fitness 6.5▲ Package organization 8.2

Reliability

6 dims

5.4

▼ Timeout discipline 4.6▲ Memory pressure 6.2

Concurrency & Data

4 dims

6.2

▼ Transaction boundary 5.6▲ Serialization fidelity 6.8

Errors & Observability

3 dims

4.9

▼ Error transparency 4.5▲ Error consistency 5.2

Types & Contracts

5 dims

6.9

▼ Boundary validation 6.0▲ Type safety 8.5

Testing

3 dims

4.4

▼ Test strategy 3.8▲ Assertion density 4.9

Hygiene & Debt

11 dims

6.5

▼ Logic clarity 4.2▲ Import health 7.8

WEIGHTED OVERALL

6.6/ 10

Testing and Errors & Observability pull hardest against the score.

PAGE 04 · SCORECARD · FULL DETAIL

TRUEMEND · HALYARD-APIConfidential

All 40 Dimensions · Sorted Worst-First

Test strategy3.8

Logic clarity4.2

Test quality4.4

Error transparency4.5

Timeout discipline4.6

Assertion density4.9

Null safety5.0

Logging quality5.0

Graceful degradation5.1

Error consistency5.2

Runtime resilience5.5

Transaction boundary5.6

Resource lifecycle5.8

AI-generated debt5.9

Thread safety6.0

Boundary validation6.0

Authorization consistency6.0

Dead-code risk6.1

Memory pressure6.2

Config consistency6.4

API contract drift6.4

Abstraction fitness6.5

Dependency fragility6.5

API surface coherence6.6

Incomplete migration6.6

Feature completeness6.7

Low-level elegance6.8

Serialization fidelity6.8

Convention drift6.8

Initialization coupling6.9

Design coherence7.0

Contract coherence7.0

Mid-level elegance7.2

Dependency health7.2

Naming quality7.4

High-level elegance7.6

Import health7.8

Cross-module architecture8.0

Package organization8.2

Type safety8.5

OVERALL HEALTH6.6/ 10

PAGE 05 · FINDINGS · GROUPED BY FIX COST

TRUEMEND · HALYARD-APIConfidential

Findings · top 30 of 214

▲Showing the top 30 of 214 findings, ranked by severity. Headline counts above use full totals; the complete list ships in the JSON export.

DETERMINISTIC · FIXABLE FOR $014Applies automatically · verified re-parse · zero risk

HighRedundant try/catch rethrow

saveVendor · src/api/vendors.ts : 42–50

52→78+26

Catch block only rethrows: it swallows nothing and adds nothing. Remove it; the error already propagates.

Mediumconsole.log in a hot request path

processOrder · src/orders/pipeline.ts : 118

66→78+12

Debug logging left in a production path. Strip the statement, no behavioural change.

CATALOGED REFACTOR · LLM-ASSISTED10Constrained prompt · low risk · scoped diff

HighSame validation guard copy-pasted ×7

handlers · src/api/*.ts (7 sites)

58→76+18

An 11-line guard duplicated across seven handlers. Extract to one helper under a constrained prompt.

STRUCTURAL REWRITE · NEEDS A HUMAN6Architecture-level · requires review

CriticalUnbounded context load

buildPrompt · src/llm/context.ts : 64

34→71+37

Loads the entire repo into a single prompt: memory and cost blow up on large trees. Needs an architectural chunking decision.

PAGE 06 · COMPLIANCE & GOVERNANCE

TRUEMEND · HALYARD-APIConfidential

Compliance & Governance · 9 frameworks · evidence-mapped

Findings, cited against real controls

Every audit maps its findings to nine frameworks. Control IDs are genuine citations: a violated control lists the actual finding as evidence. A clean row means verified clean, not unexamined.

SOC 2

4 of 61 controls hit

93%

✗ CC6.1: logical access controls

Authorization consistency (3 findings)

ISO/IEC 27001

5 of 93 controls hit

95%

✗ A.8.28: secure coding

Boundary validation (2 findings)

OWASP Top 10

3 of 10 controls hit

70%

✗ A03:2021: injection

Boundary validation at API surface

HIPAA

0 of 42 controls hit

100%

✓ verified clean

PCI-DSS

2 of 78 controls hit

97%

✗ 6.2.4: software attack prevention

Broad except swallows errors

GDPR

1 of 32 controls hit

97%

✗ Art.32: security of processing

Model output missing PII filter

EU AI ActAI

2 of 12 controls hit

83%

✗ Art.15: accuracy, robustness, cybersecurity

PII filter + unbounded context load

NIST AI RMFAI

2 of 19 controls hit

89%

✗ MS-2: systems evaluated for trustworthiness

PII filter + unbounded context load

ISO/IEC 42001AI

1 of 24 controls hit

96%

✗ A.6.2.4: verification & validation

Model output missing PII filter

The three AI-governance frameworks (EU AI Act, NIST AI RMF, ISO/IEC 42001) appear in every report: a codebase with no AI-relevant findings shows them verified clean. Full per-control detail for the worst-scoring framework follows overleaf.

PAGE 07 · EU AI ACT · CONTROL DETAIL

TRUEMEND · HALYARD-APIConfidential

Framework Detail

EU AI Act: Regulation (EU) 2024/1689

83%

2 OF 12 MAPPED ARTICLES HIT

Art.9Risk management system✓ verified clean

Art.10Data & data governance✓ verified clean

Art.12Record-keeping✓ verified clean

Art.13Transparency & provision of information✓ verified clean

Art.14Human oversight✓ verified clean

Art.15Accuracy, robustness & cybersecurity✗ 2 findings cited

CriticalModel output returned with no PII filtersrc/api/handler.py : 142

CriticalUnbounded context loadsrc/llm/context.ts : 64

Both Art.15 citations are structural findings: they appear in the findings section with full what/why/fix detail, cross-referenced here by page. One layout serves all 9 frameworks; the worst-scoring framework gets this page, others available on request.

PAGE 08 · METHODOLOGY & CLOSE

TRUEMEND · HALYARD-APIConfidential

Methodology & Validation

How this report is made

01

Static analysis, not guesswork

Every score comes from AST analysis running locally, no LLM in the detection loop. Forty quality dimensions are each scored 0–10 by mechanical validators (coupling, slop, type-safety, test-ratio and semantic detectors), then weighted into the overall.

02

Every finding carries its fix cost

Each issue is classified into one of three tiers, so you always know what clearing it takes.

DETERMINISTIC

AST transform. Zero risk: verified re-parse, reverts on failure.

CATALOGED

Constrained, LLM-assisted refactor. Low risk, scoped diff.

STRUCTURAL

Architecture-level. Flagged for a human decision.

03

Fixes are proven before they count

Deterministic fixes are validated by ast-grep re-parse + lint: the transformed source must re-parse cleanly or the original is restored. Score deltas are measured, not estimated. Your code never leaves the machine.

Point it at your repo.
Watch it come true.

$ npx truemend init →

truemend.ai
hello@truemend.ai
code, made true