Who still understands this codebase?

Dark-code ranking

Modules ranked by comprehension risk: how much of the module lacks a living author, amplified when the code is still changing (heat) and thinly held (bus factor). The green meter is the share written by currently-active humans.

Modules under 200 changed lines in the window are omitted. src/core scores LOW despite 736 recent commits because roughly half its lines have living authors and knowledge is spread across multiple active contributors — heat without darkness is healthy activity.

Review depth — who actually looked at this code?

API-sampled signals joining PR timing with diff sizes from git history: 439 merged PRs timed, with review detail on a size-stratified sample of 34 deliberately weighted toward the largest merges — these figures describe that sample, not all PRs, and describe process patterns, not the diligence of any individual contributor.

Largest fast merge in the sample: PR #11862 — 2,077 lines touching apps/ and sdk/, merged 24 minutes after opening. Baseline latencies scale sanely with size (median 34 min for ≤50-line PRs, 31 hours for 1,000+ lines), which makes the exceptions the signal, not the norm. Note that legitimate workflows produce these patterns too — pre-coordinated changes, pairing, generated files, release automation, and review conducted outside GitHub's review feature are all invisible to this record.

Contrast scan — two repos, two failure modes

The same engine run on pallets/flask (16 years old, pre-AI era, 3,812 commits) shows the Index distinguishes different kinds of knowledge risk rather than flattering old code or damning new code.

Flask's headline numbers look healthier — until you see that its living knowledge is concentrated in a single active contributor. The two repos carry risk in opposite shapes, and a velocity dashboard would flag neither.

State of Comprehension Debt — 22-repo benchmark

The same engine run across 22 public repositories in five cohorts: AI-era agents and apps, AI vendor SDKs, modern human-led projects, and pre-AI controls. Sorted darkest first by living knowledge.

What the corpus shows. Cohort medians: modern human-led 78% · pre-AI controls 73% · AI-era agents 55% · AI-era apps 32% · AI SDK cohort 5% (two of its three members — the OpenAI and Anthropic Python SDKs — score 3% and 5%; the third, vercel/ai, is largely hand-written and scores 72%). An essential reading note on the SDK repos: both are produced by automated code-generation pipelines from API specifications — a deliberate, industry-standard engineering choice. Low living commit-authorship in a generated repo reflects that workflow; the relevant human comprehension plausibly resides in the generator and the API specification, which repository-level metrics structurally cannot observe. These scores describe public commit history only — they are not a claim that any organization's engineers do not understand their products, and not a claim about the quality, security, or fitness of any software. Elsewhere the pattern is starker: comprehension debt predates AI. Express — 15 years old and foundational to the npm ecosystem — shows 85% of its recent lines authored by contributors no longer active, while 25-year-old curl is the healthiest repository in the corpus. Age determines nothing; living maintenance does.

Two weighting modes, one conclusion

The engine measures living knowledge two ways, and the two proxies err in opposite directions — which is why we run both. Line-weighting (this report) weights authorship by lines added: it matches "what fraction of the code by volume has a living author," but lets verbose authorship — especially generated code — dominate. Touch-weighting weights each file-touching commit equally: it better matches how comprehension actually forms (repeated engagement, not text volume), but counts a 3,000-line generated commit the same as a one-line fix. Scores are comparable only within a mode, and every Grasp report states which mode produced it. The corpus was computed in both modes, and the findings hold in both: the codegen SDK repos score 3–5% line-weighted and 1–4% touch-weighted; curl scores 94% and 95%; the cohort gradient is unchanged. When two differently-biased instruments agree, the conclusion is stronger than either alone.

Scope of claims

All data in this report derives from publicly available repository metadata (commit history and pull-request records) analyzed with the disclosed method. Every metric is a defined proxy computed from that record; living commit-authorship is an indicator of comprehension risk, not a measurement of any person's or organization's understanding. Nothing here asserts misconduct, negligence, or lack of competence by any contributor, maintainer, or company, and nothing here is a claim about the quality, security, or fitness for purpose of any software. Repository and project names identify public data sources; all trademarks belong to their owners, and no affiliation or endorsement is implied. Believe a number is wrong? Contact support@graspscore.com — we correct verified errors and version this report.