CodeQual

Evolution Advisory

Project: demo-repo

Period: Dec 01, 2025 at 12:00 AM to Mar 21, 2026 at 10:00 AM

Advisory ID: evo-demo-2026-03-21

Generated: Mar 21, 2026 at 10:00 AM

Executive Summary

3
Significant Changes
3
Areas Affected
5
Patterns Matched
5
New Observations

Affected areas: 📝 Version Control ⚙️ CI / Build 📦 Dependencies

Based on 2 prior commits

What Evolution Engine Can See

5 connected, 3 available

📝
Version Control
via Git
Active
⚙️
CI / Build
via GitHub Actions
Active
🚀
Deployment
via GitHub Releases
Connected
Token set. This data is analyzed automatically when running via GitHub Action or GitLab CI. Setup guide →
📦
Dependencies
via pip
Active
🔒
Security
via GitHub Security
Connected
Token set. This data is analyzed automatically when running via GitHub Action or GitLab CI. Setup guide →
🧪
Testing
Not Connected
Generate test results: pytest --junitxml=junit.xml or equivalent, then re-run analysis. Setup guide →
📊
Code Coverage
Not Connected
Generate coverage reports: pytest --cov --cov-report=xml or equivalent, then re-run analysis. Setup guide →
🚨
Error Tracking
Not Connected
Set SENTRY_AUTH_TOKEN to pull error tracking data from Sentry. Setup guide →
📈
Fix Verification: Progress detected
Comparing against previous analysis
✅ 2 resolved📈 2 improving➖ 1 not improving
AreaSignalBeforeAfter / NormalTrend
Version ControlChange DispersionResolved
DeploymentRelease CadenceResolved
Version ControlFiles Changed478 / 3📉 improving
CI / BuildBuild Duration892340 / 165📉 improving
DependenciesTotal Dependencies104104 / 86➖ still actively deviating
Active deviation: This metric is still actively deviating in the latest data. Investigation recommended.

Key Findings

What Changed in Your Codebase

We've detected 3 changes that differ from your project's normal patterns. Each change shows what typically happens versus what we observed this time.

0 of 3 resolved
📝
Files Changed
Version Control
What this means: More files changed than usual in this commit.
Typical:
3.00
This Time:
8
2.1x above typical range
Trigger: a1b2c3d4 refactor: split auth migration into focused modules
Supporting Evidence
👁️ Worth Monitoring

When many files change in a single commit, CI build times increase proportionally due to broader test coverage being triggered.

What this means: Commits are touching more files than usual, increasing review burden and risk of regressions.
Recommendation: Monitor PR sizes. If this persists, investigate whether large refactors need better decomposition.
👁️ Worth Monitoring

Large commits that touch many files tend to also introduce new dependencies, suggesting feature branches that bundle dependency additions with implementation.

What this means: Commits are touching more files than usual, increasing review burden and risk of regressions.
Recommendation: Monitor PR sizes. If this persists, investigate whether large refactors need better decomposition.
Drift Investigation Prompt
Development pattern shift detected in Version Control.\n\nSIGNAL: Files Changed is 2.1x above the typical baseline (observed: 8, typical: 3.00).\nTRIGGER COMMIT: a1b2c3d4 — refactor: split auth migration into focused modules\n\nRECENT COMMITS (2 total, showing top 5):\n  a1b2c3d4 — refactor: split auth migration into focused modules

Broke t (8 files)\n  b2c3d4e5 — fix: optimize CI pipeline caching for auth deps (2 files)\n\nCORRELATED PATTERNS:\n  [WATCH] When many files change in a single commit, CI build times increase proportionally due to broader test coverage being triggered.\n    → Monitor PR sizes. If this persists, investigate whether large refactors need better decomposition.\n  [WATCH] Large commits that touch many files tend to also introduce new dependencies, suggesting feature branches that bundle dependency additions with implementation.\n    → Monitor PR sizes. If this persists, investigate whether large refactors need better decomposition.\n\nINVESTIGATE:\n1. Was this change intentional or did the AI drift from goals?\n2. Review commit a1b2c3d4 — what specifically caused the deviation?\n3. Suggest a course correction (not a bug fix — a realignment).\n\nAFTER FIX:\nRun `evo analyze . --verify` to re-analyze and compare against this run.\nIf the change was intentional, no fix needed — accept it in the report.
Use with: Cursor — paste in chat Claude Code — paste in terminal Copilot — paste in chat panel
After investigation:
  1. AI suggests fixes → apply the changes to your code
  2. Run evo analyze . --verify to re-analyze and compare against this run
  3. If the change was intentional, click Accept above to dismiss it
Show technical details

The files touched for this change was 8. Historically, similar changes had a value of 3.00 ± 1.50.

⚙️
Build Duration
CI / Build
What this means: Build took longer than usual.
Typical:
165.0
This Time:
340
3.9x above typical range
Trigger: a1b2c3d4 refactor: split auth migration into focused modules
Supporting Evidence
👁️ Worth Monitoring

When many files change in a single commit, CI build times increase proportionally due to broader test coverage being triggered.

What this means: Commits are touching more files than usual, increasing review burden and risk of regressions.
Recommendation: Monitor PR sizes. If this persists, investigate whether large refactors need better decomposition.
👁️ Worth Monitoring

When CI pipelines run longer, the time between releases shortens — teams may be rushing releases to meet deadlines despite slower builds.

What this means: Builds are taking longer. Slower CI feedback loops reduce developer productivity and delay catching issues.
Recommendation: Profile the build pipeline to identify bottlenecks. Check for newly added expensive tests or build steps.
👁️ Worth Monitoring

Adding dependencies increases CI build time as package installation and resolution steps take longer.

What this means: The dependency count is growing, expanding the supply-chain attack surface and potential for version conflicts.
Recommendation: Audit new dependencies for necessity, maintenance status, and known vulnerabilities.
Drift Investigation Prompt
Development pattern shift detected in CI / Build.\n\nSIGNAL: Build Duration is 3.9x above the typical baseline (observed: 340, typical: 165.0).\nTRIGGER COMMIT: a1b2c3d4 — refactor: split auth migration into focused modules\n\nRECENT COMMITS (2 total, showing top 5):\n  a1b2c3d4 — refactor: split auth migration into focused modules

Broke t (8 files)\n  b2c3d4e5 — fix: optimize CI pipeline caching for auth deps (2 files)\n\nCORRELATED PATTERNS:\n  [WATCH] When many files change in a single commit, CI build times increase proportionally due to broader test coverage being triggered.\n    → Monitor PR sizes. If this persists, investigate whether large refactors need better decomposition.\n  [INFO] When CI pipelines run longer, the time between releases shortens — teams may be rushing releases to meet deadlines despite slower builds.\n    → Confirm test coverage hasn't decreased alongside faster builds.\n  [WATCH] Adding dependencies increases CI build time as package installation and resolution steps take longer.\n    → Audit new dependencies for necessity, maintenance status, and known vulnerabilities.\n\nINVESTIGATE:\n1. Was this change intentional or did the AI drift from goals?\n2. Review commit a1b2c3d4 — what specifically caused the deviation?\n3. Suggest a course correction (not a bug fix — a realignment).\n\nAFTER FIX:\nRun `evo analyze . --verify` to re-analyze and compare against this run.\nIf the change was intentional, no fix needed — accept it in the report.
Use with: Cursor — paste in chat Claude Code — paste in terminal Copilot — paste in chat panel
After investigation:
  1. AI suggests fixes → apply the changes to your code
  2. Run evo analyze . --verify to re-analyze and compare against this run
  3. If the change was intentional, click Accept above to dismiss it
Show technical details

The run duration for this change was 340. Historically, similar changes had a value of 165.0 ± 30.00.

📦
Total Dependencies
Dependencies
What this means: Dependency count increased.
Typical:
86.00
This Time:
104
4.0x above typical range
Trigger: a1b2c3d4 refactor: split auth migration into focused modules
Supporting Evidence
👁️ Worth Monitoring

Large commits that touch many files tend to also introduce new dependencies, suggesting feature branches that bundle dependency additions with implementation.

What this means: Commits are touching more files than usual, increasing review burden and risk of regressions.
Recommendation: Monitor PR sizes. If this persists, investigate whether large refactors need better decomposition.
👁️ Worth Monitoring

Adding dependencies increases CI build time as package installation and resolution steps take longer.

What this means: The dependency count is growing, expanding the supply-chain attack surface and potential for version conflicts.
Recommendation: Audit new dependencies for necessity, maintenance status, and known vulnerabilities.
Drift Investigation Prompt
Development pattern shift detected in Dependencies.\n\nSIGNAL: Total Dependencies is 4.0x above the typical baseline (observed: 104, typical: 86.00).\nTRIGGER COMMIT: a1b2c3d4 — refactor: split auth migration into focused modules\n\nRECENT COMMITS (2 total, showing top 5):\n  a1b2c3d4 — refactor: split auth migration into focused modules

Broke t (8 files)\n  b2c3d4e5 — fix: optimize CI pipeline caching for auth deps (2 files)\n\nCORRELATED PATTERNS:\n  [WATCH] Large commits that touch many files tend to also introduce new dependencies, suggesting feature branches that bundle dependency additions with implementation.\n    → Monitor PR sizes. If this persists, investigate whether large refactors need better decomposition.\n  [WATCH] Adding dependencies increases CI build time as package installation and resolution steps take longer.\n    → Audit new dependencies for necessity, maintenance status, and known vulnerabilities.\n\nINVESTIGATE:\n1. Was this change intentional or did the AI drift from goals?\n2. Review commit a1b2c3d4 — what specifically caused the deviation?\n3. Suggest a course correction (not a bug fix — a realignment).\n\nAFTER FIX:\nRun `evo analyze . --verify` to re-analyze and compare against this run.\nIf the change was intentional, no fix needed — accept it in the report.
Use with: Cursor — paste in chat Claude Code — paste in terminal Copilot — paste in chat panel
After investigation:
  1. AI suggests fixes → apply the changes to your code
  2. Run evo analyze . --verify to re-analyze and compare against this run
  3. If the change was intentional, click Accept above to dismiss it
Show technical details

The dependency count for this change was 104. Historically, similar changes had a value of 86.00 ± 3.00.

Additional Insights

All Clear

Patterns detected are informational or healthy. No issues require attention at this time.

ℹ️ 1 Informational

What are patterns? Patterns are recurring correlations between different areas of your project. When a change in one area (e.g. a deployment) consistently coincides with unusual behavior in another (e.g. code dispersion), we flag it so you can decide if it needs attention.

What should you do? Focus on items marked ⚠️ Action Required or 🔍 Needs Attention first. These indicate patterns that are most likely to affect code quality, stability, or security. Items marked 👁️ Worth Monitoring don't need immediate action but should be reviewed if they persist. ✅ Healthy Pattern and ℹ️ Informational confirm that things are working as expected.

Known Pattern ℹ️ Informational

Version Control, Deployment

Change Dispersion, Release Cadence

When code changes are scattered across many directories, releases tend to be pushed out faster — possibly to ship hotfixes before the next planned release.

What this means: Releases are happening more frequently. Faster releases reduce batch size risk but may skip review steps.
Recommendation: Verify that quality gates (testing, review) are still being applied to faster releases.

Next Steps

1
Investigate

Copy the prompt below and paste it into your AI assistant (Claude Code, Cursor, Copilot, ChatGPT). It will identify root causes and suggest fixes.

2
Fix

Apply the suggested changes. If a deviation was intentional, click Accept on its card above instead.

3
Verify

Run evo analyze . --verify to re-analyze and compare. A verification banner will show which deviations resolved, improved, or persist.

Investigation Prompt

Development drift analysis for demo-repo (Dec 01, 2025 at 12:00 AM to Mar 21, 2026 at 10:00 AM). DEVIATIONS FROM BASELINE: - Version Control: Files Changed — 3.00 -> 8 - CI / Build: Build Duration — 165.0 -> 340 - Dependencies: Total Dependencies — 86.00 -> 104 Click "Show Full Prompt" to see the complete investigation prompt with evidence...
Development drift analysis for demo-repo (Dec 01, 2025 at 12:00 AM to Mar 21, 2026 at 10:00 AM).

DEVIATIONS FROM BASELINE:

- Version Control / Files Changed: 8 (typical: 3.00, 2.1x above)
- CI / Build / Build Duration: 340 (typical: 165.0, 3.9x above)
- Dependencies / Total Dependencies: 104 (typical: 86.00, 4.0x above)

RISK PATTERNS (actionable only):

- [Worth Monitoring] 2 patterns:
    * When many files change in a single commit, CI build times increase proportionally due to broader test coverage being triggered.
    * Large commits that touch many files tend to also introduce new dependencies, suggesting feature branches that bundle dependency additions with implementation.
  Impact: Commits are touching more files than usual, increasing review burden and risk of regressions.
  Action: Monitor PR sizes. If this persists, investigate whether large refactors need better decomposition.

- [Worth Monitoring] Adding dependencies increases CI build time as package installation and resolution steps take longer.
  Impact: The dependency count is growing, expanding the supply-chain attack surface and potential for version conflicts.
  Action: Audit new dependencies for necessity, maintenance status, and known vulnerabilities.


COMMITS (2):

  a1b2c3d4 — refactor: split auth migration into focused modules (8 files)
  b2c3d4e5 — fix: optimize CI pipeline caching for auth deps (2 files)

SOURCE FILES CHANGED (4):

  - src/auth/oauth2.py (modified)
  - src/auth/middleware.py (modified)
  - .github/workflows/test.yml (modified)
  - requirements.txt (modified)

TASKS:

1. ROOT CAUSE: For each deviation, identify the commit(s) that caused it.
   Focus on [Action Required] and [Needs Attention] items first.

2. FIXES: Provide concrete fixes with file paths and code changes.
   Goal: bring metrics back toward baseline without disrupting velocity.

3. PRIORITY: Rank fixes by urgency (immediate vs. next sprint).

4. AFTER FIXING: Run `evo analyze . --verify` to confirm deviations decreased.
   If a change was intentional, accept it: `evo accept . <N>`.

5. FINDING SUMMARIES: At the end, include a section like this:
   ## Finding Summaries
   - [family/metric]: One plain-English sentence for a non-technical reader.
   (This lets the user run `evo enrich . --from response.txt` to store friendly descriptions.)

Expand Your Coverage

Evolution Engine has 44 universal patterns learned from 200+ open-source repositories. The more signal families you connect, the more cross-family patterns can be detected.

Coming soon: CI / Build, Deployment, Feature Flags, Incidents, Monitoring, Quality Gate, Security Scan, Work Items