ADR-144: Monorepo Quality Analysis — Critical Findings

[ruvnet]

ADR-144 Phase 1 Scan Results — Critical Findings

Source: ADR-144-monorepo-quality-analysis-strategy.md | Date: 2026-04-06

Critical (fix now)

1. D3 (Distributed) has zero integration/property/fuzz tests — only inline unit tests
2. 142 unwrap() in D3 production code — consensus can panic
3. Zero fuzz testing across entire monorepo
4. 2 HIGH CVEs: quinn-proto (8.7), lz4_flex (8.2)
5. 55 undocumented unsafe blocks in micro-hnsw-wasm (static mut)
6. No workspace-level CI on PRs — broken crates can merge

High (fix soon)

7. 2 crates block compilation (pgrx-pg-sys, ruvector-decompiler)
8. 284 panic!() in library code (ruvix security paths)
9. No UI/SvelteKit CI for ui/ruvocal
10. ruvector-collections has zero tests

Stats

• 705 unwrap() in P0 lib code, 2166 clippy warnings, 388 unsafe blocks
• 34 files over 500 LOC, 0 fuzz tests, 27/30 CI workflows lack timeouts

PR in progress on feat/adr-143-quality-analysis-strategy