Most tools offer two modes: auto-fix everything, which is dangerous, or report-only, which is useless. Truemend takes a different approach: three tiers of remediation, each with a different safety profile. The classification isn’t an organizational convenience. It’s the safety model.
Tier 1: Deterministic patches
AST-safe transforms that apply automatically as diffs: var to const where the binding is never reassigned, and removing unused imports. Every Tier 1 fix is verified by re-parsing the AST after application, automatically reverted if verification fails, and logged with a reversible diff.
As of this writing, 37.9% of patterns are Tier 1: automatic fixes verified by re-parse (source:
facts.json, the engine's generated pattern inventory). That share is measured against patterns, not per-audit findings, which vary by codebase, and moves as the pattern library changes: see the product page for the current figure.
Tier 2: Cataloged refactors
Known refactoring patterns from a curated catalog: extract function, replace conditional with polymorphism, decompose nested callbacks. The scope is bounded and the output is predictable. Tier 2 refactors land with your team present, each transform reviewed before it merges.
Tier 3: Structural rewrites
Some issues can’t be fixed with a patch or a refactor. A god class needs decomposition. A tangled dependency graph needs untangling. These require architectural decisions that only humans should make. Tier 3 findings come with evidence-backed recommendations: what’s wrong, why it matters, what the options are, what we’d suggest. The decision is yours.
Why it matters
By separating fixes by risk level, each tier carries a different amount of review. Structural changes always get human oversight, and every automatic fix is re-parsed, logged and reversible. Re-parsing checks syntax, not behaviour, so review the diffs and run your tests before merging.