VibeCop runs nine architectural detector agents against every pull request — three LLM-powered, two embedding-powered, three graph-powered, and one history-powered. Each agent is calibrated to your codebase's Stack Profile, and every finding it produces carries an entropy weight that feeds the Architecture Integrity Index across four axes.
| Agent | Catches | Axis |
|---|---|---|
| Hallucinated Abstractions | Layers, wrappers, interfaces adding indirection without value | Simplicity |
| Semantic Duplication | Logic re-implemented in parallel paths instead of shared | Reuse |
| Over-Engineering | Premature generalization, unused flexibility, config-for-config's-sake | Simplicity |
| Pattern Drift | Same problem solved differently across the codebase | Consistency |
| Reinvented Utilities | Hand-rolled logic duplicating an existing library or internal utility | Reuse |
| Structure | Dependency-graph cycles, high coupling, and excessive fan-out | Structure |
| Layer Violations | Imports that cross a declared architectural layer boundary | Structure |
| Orphaned Modules | Files with zero in-edges and zero out-edges in the code graph | Structure |
| Reintroduced Bugs | Findings matching a previously resolved issue — a regression against review history | Consistency |
Dependency Health used to sit on the Structure axis. It is now a hygiene layer alongside its sibling dependency-CVE check: it carries no axis, so it no longer moves the index. Architectural Complexity is the three graph agents above.
Nine deterministic static checks run first, fast and free of false positives from hallucinated rules — eight hygiene layers and one error-handling check. The eight hygiene layers are dependency CVE scanning against the live osv.dev database with EPSS and CISA KEV enrichment, dependency-health checks, secret detection (24 patterns), static application security testing (SAST) across 24 CWE- and OWASP-tagged rules, infrastructure-as-code checks (22 rules), vendored-drift detection, magic-number detection, and migration-safety checks.
| Check | Catches | Axis |
|---|---|---|
| Dependency CVEs | Known vulnerabilities in your dependency tree, enriched with EPSS and CISA KEV data | Hygiene |
| Dependency Health | Deprecated or unmaintained packages, missing source provenance, and weak OpenSSF Scorecard posture | Hygiene |
| Secrets | API keys, tokens, and other credentials committed to source | Hygiene |
| SAST | Injection, XSS, path traversal, and other risky code shapes | Hygiene |
| Infrastructure as Code | Security misconfigurations in Dockerfiles, Compose files, and Kubernetes manifests | Hygiene |
| Vendored Drift | Vendored copies of your own packages that no longer match the original | Hygiene |
| Magic Numbers | Unexplained numeric literals that read better as named constants | Hygiene |
| Migration Safety | SQL migration steps that are fine on a small table and risky on a large one | Hygiene |
| Error Handling | Empty catches, caught errors that go unused, catches that only log, and throws inside finally | Consistency |
Migration safety reads the SQL migrations a pull request changes (or every migration, on a full scan) and points out the steps that can hurt on a large table: dropping a column or table, building an index without CONCURRENTLY, adding NOT NULL without a default, narrowing a column type, and renaming. It is there to help you plan the rollout, so it warns and never blocks — no migration finding goes above P2. Like the other hygiene layers, it carries no axis.
The error-handling check reads TypeScript and JavaScript for four patterns that quietly lose errors: an empty catch block, a caught error that is never used, a catch that only logs to the console, and a throw inside finally. Consistent error handling is part of how a codebase solves the same problem the same way, so these findings count toward the Consistency axis and move the index.
No — hygiene findings carry no axis. They matter for security and compliance, but only findings with an axis carry an entropy weight that affects the index: those from the nine architectural detector agents and from the error-handling check. See the Architecture Integrity Index doc for the full scoring formula.