Most tools offer two modes: auto-fix everything, which is dangerous, or report-only, which is useless. Truemend takes a different approach: three tiers of remediation, each with a different safety profile. The classification isn’t an organizational convenience. It’s the safety model.
Tier 1: Deterministic patches
AST-safe transforms that apply automatically with zero risk: var to const, removing unused imports, deleting a catch block that only rethrows. Every Tier 1 fix is verified by re-parsing the AST after application, automatically reverted if verification fails, and logged with a reversible diff.
As of this writing, 37.9% of patterns are Tier 1: automatic, zero-risk fixes verified by re-parse (source:
facts.json, the engine's generated pattern inventory). That share is measured against patterns, not per-audit findings, which vary by codebase, and moves as the pattern library changes — see the product page for the current figure.
Tier 2: Cataloged refactors
Known refactoring patterns from a curated catalog: extract function, replace conditional with polymorphism, decompose nested callbacks. The scope is bounded and the output is predictable. Tier 2 refactors land with your team present, each transform reviewed before it merges.
Tier 3: Structural rewrites
Some issues can’t be fixed with a patch or a refactor. A god class needs decomposition. A tangled dependency graph needs untangling. These require architectural decisions that only humans should make. Tier 3 findings come with evidence-backed recommendations: what’s wrong, why it matters, what the options are, what we’d suggest. The decision is yours.
Why it matters
By separating fixes by risk level, automated remediation never introduces new bugs, and structural changes always get human oversight. The result: teams ship cleaner code faster, with confidence that the fixes are safe, and a ledger that proves it.