Cyclomatic Complexity (CC) measures the quantitative count of linearly independent control-flow paths through a program's source code. It represents the structural branching complexity and determines the minimum number of unit test cases required to achieve 100% decision branch coverage.

Cognitive Complexity (COG) assesses how difficult code is for human developers to comprehend and maintain. Unlike Cyclomatic Complexity, Cognitive Complexity does not increment for simple multi-condition structures, but heavily penalizes nested control structures, recursion, and breaks in linear reading flow.

• Base Value: Starts at CC = 1 for every analyzed file and function scope.
• Decision Point Increments (+1 CC): Evaluates AST nodes and regex pattern rules for decision keywords: if, elif, else if, for, while, do, catch, case, ternary ?, and logical operators (&&, ||, and, or).
• Cognitive Nesting Weight: Increments Cognitive Complexity by 1 for each control flow statement, plus an additional +1 for each level of enclosing nesting depth (e.g., an if statement inside 2 nested loops receives a cognitive weight of 1 + 2 = 3).

The Maintainability Index (MI) is an SEI (Software Engineering Institute) standard composite metric that quantifies the relative maintainability of source code files on a 0 to 100 scale.

Technical Debt Score estimates the accumulated remediation work required to resolve code smells, architectural flaws, and security findings across the codebase.

• Grade A (MI ≥ 80): Highly maintainable, excellent modular structure, minimal debt.
• Grade B (65 ≤ MI < 80): Good maintainability, minor refactoring recommended.
• Grade C (50 ≤ MI < 65): Moderate maintainability, moderate code smells present.
• Grade D (20 ≤ MI < 50): Low maintainability, elevated bug risk during modifications.
• Grade F (MI < 20): Critical technical debt, requires comprehensive architecture overhaul.

Archon One implements a high-performance file signature fingerprinting engine designed for sub-second incremental scans on large repositories.

• Fast Scan Mode: Utilizes multi-threaded regex line parsing to skip heavy full AST parsing for unchanged non-critical files, reducing scan times by up to 90%.
• Incremental Scan Mode: Checks file signatures against .archon_cache.json. If the fingerprint matches, cached metrics and security results are re-used instantly.

Cross-references source implementation files against test files across Python, Java, Go, Rust, TypeScript, C++, Kotlin, and PHP.

• Test Folders: /tests/, /__tests__/, /test/.
• Test Files: test_*.py, *_test.go, *.test.js, *.spec.ts, Test*.java, *.test.rs.
• Risk Scoring: Assigns High Risk to untested files located inside core/, security/, auth/, or engine/ modules.

Parses AST declaration nodes to verify symbol compliance against language standards.

• Class Declarations: Validates PascalCase (e.g., UserManager). Snake-case class names like user_manager are flagged as Medium severity violations.
• Function & Method Declarations: Validates snake_case for Python/Rust and camelCase for JavaScript/Java/Go.
• Constants: Global variables in uppercase must match UPPER_CASE (e.g., MAX_RETRY_COUNT).

Analyzes function body call-graphs for self-invocations ($f(x) \to f(x-1)$) and mutual recursive loops ($A \to B \to A$), evaluating base case guard statements to prevent call stack overflow crashes.

Detects unclosed file descriptors (e.g., open() calls lacking with context managers), malloc() allocations without free(), and unclosed database connection pools.

Identifies raw string formatting (`f"SELECT ... {var}"`, `%s`, `+ input`, `${id}`) inside database query execution contexts (`cursor.execute`, `db.query`), flagging High severity SQL injection risks.

Scans configuration files and socket binds for global exposure (`0.0.0.0`), unencrypted HTTP endpoints, and disabled SSL/TLS certificate verification (`verify=False`, `InsecureSkipVerify: true`).

Inspects web API route definitions for CORS wildcard headers (`Access-Control-Allow-Origin: *`), missing authentication decorators, and exposed internal debug endpoints.

Identifies bare `except: pass`, empty `catch (e) {}` blocks, ignored error return values in Go, and unhandled promise rejections.

Detects thread lock acquisitions missing `finally` or context manager releases, blocking synchronous I/O inside `async def` routines, and raw global state mutations.

Flags God Methods (> 100 LOC), Large Classes (> 500 LOC), Deep Inheritance Trees (depth > 3), and Long Parameter Lists (> 5 parameters).

Uses `scrypt(N=32768, r=8, p=1)` to derive a 256-bit encryption key from a master password. Encrypts sensitive workspace files with AES-256-GCM generating 12-byte IVs and 16-byte authentication tags.

Constructs a multi-tiered graph schema with nodes (Repository, Folder, File, Class, Function, API, DB, Package) and directed edges (`CONTAINS`, `IMPORTS`, `CALLS`, `EXTENDS`, `EXPOSES`).

Parses codebase AST, imports, class hierarchies, and database calls to dynamically generate 14 Mermaid (`.mmd`) and PlantUML (`.puml`) architecture diagrams.

Builds an adjacency matrix $G=(V,E)$ of module imports and runs Tarjan's Strongly Connected Components (SCC) algorithm to detect circular import chains ($A \to B \to C \to A$).

Tokenizes source code, strips comments and whitespace, and applies a sliding window MD5 hash across line sequences ($W \ge 5$) to detect duplicate code blocks across files.