Products and portfolios

A scan measures one repository. Almost nothing anyone cares about is one repository. Products and portfolios are how a measurement becomes a statement about a thing that is actually bought, sold or owned.

A product is a curated set of repositories that together constitute a delivered thing — the specific "X of Y repositories" a contract attests to. A product of a single repository is perfectly ordinary.

Membership is deliberate and stated, not inferred. Nothing joins a product because it looks related, shares a naming convention, or lives beside it. That is the entire point: a product whose membership drifts cannot be the subject of a claim, because the thing being claimed about keeps changing.

Why curation is the important property. If membership were automatic, a supplier could weaken a product's result by adding repositories, or strengthen it by having some quietly fall out of scope. Declared membership makes the scope of every claim explicit and stable.

A portfolio is the roll-up across products — the aggregate view for an organisation or a scope within it. It answers a different question from a product report: not "is this thing good enough" but "where does our estate stand, and which way is it moving".

Roll-ups are weighted by size rather than counting repositories equally, so a large system is not outvoted by several small ones. Alongside the aggregate line, the spread is shown — the best, the worst, and the middle — because an average alone hides whether an estate is uniformly acceptable or contains something serious.

• Assessing something specific — a supplier's deliverable, an acquisition target, a contractual obligation — use a product. It has defined boundaries and can carry a verdict.
• Steering — where to invest, whether last quarter's effort worked, which teams need support — use the portfolio. It shows direction and distribution rather than a pass or a fail.

A product is the unit a contract attests to, and a buyer assessing that product does so against a standard they set themselves — see acceptance profiles.

• Code rots even when no one commits — covers why a codebase that nobody edits still changes score.