The Control Grade: how much control can your repository prove?
With Claude Code and similar tools, getting the first version working is now fast and accessible to almost anyone. The harder part comes a few weeks later, when I need to change it. Can I still prove what the application is meant to do? Can I see which decisions the code follows? Do I know what was tested, and whether the last change quietly undid something that worked before?
Code on its own does not tell me enough. The repository also needs to carry the context behind it: what we intended, the decisions we made, and the evidence that lets us check a change later.
Shipwright, the open source harness I build, was already producing the underlying compliance artifacts: traceability, test evidence, change history and security records. They gave me the evidence, but not one simple answer to the question of how much control I actually have. So I built a way to turn them into one honest measure, the Control Grade.
What it measures
The Control Grade is an A to F assessment, from 0 to 100, of how much control a repository can actually prove. It is not a code quality score. It asks whether changes trace back to requirements, whether test evidence is visible, where changes come from, and what the repository can prove about reconciliation, security, maintainability and dependencies.
The scoring pattern follows the basic method used by the OpenSSF Scorecard: a weighted average across the dimensions that can actually be measured. If the evidence cannot support a dimension, it stays not applicable and is left out of the calculation. No data does not become a zero. Every result shows the evidence behind it and the limit of what it can claim.
I first ran it honestly on Shipwright itself. The result was a B. It exposed weak requirement traceability and two areas the evidence could not measure. Closing those gaps moved the grade to an A. The useful part was not the perfect number. It was turning a vague concern into a concrete work list.
Watch it run
In the video I run it on three real open source repositories by pasting the public GitHub URL. Shipwright makes a shallow clone in a temporary workspace, inspects it and removes the copy afterwards. I also show the report for a project that uses Shipwright, in the Shipwright Command Center.
Try the grade on one of your own repositories. Pay particular attention to what it cannot measure yet. The letter is not the goal. The work list is.
More on Shipwright: svenroth.ai/shipwright. Code on GitHub: Shipwright and the Shipwright Command Center.
© 2026 Sven Roth