Calibrate small-repository danger scores

[tin-computer]

What changed

• Adds a human-labeled one-production-file fixture before the scoring correction.
• Calibrates small-sample absolute ranks against soft metric floors instead of the observed maximum alone.
• Keeps strong absolute danger signals visible and preserves the established percentile behavior for repositories with five or more scored files.

Measured result

The controlled tested leaf moved from a Danger Zone score of 66 to 23, within the human-labeled low-risk ceiling of 25. A one-file production hotspot with strong absolute size, complexity, and missing-test signals remains at or above 50.

Verification

• npm test -- src/analyzer/scoring.small-repository.test.ts src/analyzer/scoring.test.ts (20 tests)
• npm test -- src/analyzer (674 tests)
• npm run lint
• npm run typecheck

Boundary

These are static structural-risk signals, not proof of a bug, vulnerability, or measured runtime risk. The calibration is limited to repositories with fewer than five scored production files.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
repo-atlas	Ready	Preview	Aug 22, 2026 1:45am