Code Quality Review

Metrics below were generated from the 1.0.0-rc.9 source tree. Do not treat 0.13/0.14 historical counts as current.

Current scale

Generated from src/dynosai_flow/*.py and tests/test_*.py on 2026-09-05 after the RC9 Codex MCP preflight work:

66 Python modules in src/dynosai_flow.
24,701 source lines.
74 test modules and 12,487 test lines.
Stable suite: 603 passed (python scripts/release_gate.py).
SQLite schema v6.
Frozen unique MCP names: 31.
Supported MCP revisions: 2026-07-28, 2025-11-25, 2025-06-18.

Largest production modules by LOC (hotspots, not a hit list):

Module	LOC
`engine.py`	1,649
`acceptance.py`	1,523
`mcp.py`	1,407
`token_usage.py`	1,052
`debug.py`	1,031
`cli.py`	921

Strengths

Clear authority model

The architecture separates workflow authority (SQLite), code truth (Git), and transient provider reasoning. This reduces reliance on unstructured chat state.

Strong evidence boundaries

Scope, Git diff, validation, human gates, provider routing, and retry evidence are persisted and testable. Success does not automatically rewrite historical failure attribution. MATRIX_1.0 trials are append-only.

Failure hygiene

The code explicitly distinguishes model failures from provider/tool/ orchestration/validation-precondition conditions.

Protocol eras are explicit

MCP 2026-07-28 is shaped in mcp_protocol_2026.py. Cursor/Codex 2025 initialize behaviour stays in mcp_protocol_legacy.py. mcp.py remains the stdio server and tool dispatcher.

Maintainability hotspots

These modules accumulated stable orchestration behaviour. They are tested. They are not being split in RC7 except for the MCP protocol-era and human-gate transport extraction required by the current spec.

Future modularization, only after characterization tests exist for the boundary being extracted:

engine.py
acceptance.py
mcp.py
token_usage.py
debug.py
cli.py

Extract real conceptual services (protocol adapters, certification evidence, execution runtime, eval/release/telemetry). Do not extract functions solely to reduce LOC. Do not impose a project-wide formatter rewrite.

Deliberately deferred

splitting the remaining orchestration hotspots
converting compact legacy statements into a formatting rewrite
activating Predictive Router authority
a mandatory independent second-model reviewer
plugin runtime / marketplace
OS sandbox, Docker/VM/remote execution