The rubric contract

A score is only meaningful if the rules behind it are fixed and published. A rubric is those rules, frozen and named, so that a result can be checked by whoever receives it.

A rubric is the complete definition of how scoring works at a point in time: which dimensions exist, which lenses they belong to, how they are weighed, and what counts as good. Every result names the rubric version it was measured under.

Rubric versions are dated, in the form rubric-YYYY.MM.N. A result and its rubric version travel together — a score without one would be a number with no definition behind it.

A new rubric version is published whenever something changes that could move a score for code that has not changed: adding or removing a dimension, altering how something is detected, or changing how results are weighed.

Changes that cannot move a score — clearer wording in a finding, a faster implementation, a cosmetic fix in a report — do not create a new version. The version marks a change in meaning, not a release number.

How this is enforced. The system keeps a fixed reference project and re-scores it continuously. If those scores move while the rubric version stays the same, the build fails. Forgetting to declare a change is therefore an error that stops work, rather than a quiet inconsistency that reaches a customer.

Once a rubric version is published, it is never edited. Someone holding a report scored under it must be able to fetch that exact definition later and get the same thing. Improving a rubric always means publishing a new version alongside the old one, never revising one that results already refer to.

Rubrics are published to an open, public archive at codeassuranceindex.info, separate from the product that uses them. This is deliberate: the definition of the measurement should not be private to the party doing the measuring.

To find — Fetch

• Every published rubric version — codeassuranceindex.info/api/rubrics
• The full catalogue of one version — codeassuranceindex.info/api/rubrics/<version>/catalog

No account is needed. A recipient of a report can look up the rubric it names and read, in full, what was measured and how it was scored.

By default a scan uses the current rubric. It is also possible to pin scans to a specific version, so that a series of results stays strictly comparable over time even as the rubric moves on.

This matters where a score is part of an agreement — a supplier contract, an acceptance criterion, a procurement threshold. Pinning means the target cannot move underneath either party.

Three properties together make a score checkable rather than merely asserted:

• The result names the exact commit it measured.
• The result names the exact rubric version it was scored under.
• That rubric is published openly and never changes.

Anyone can therefore take the same commit, apply the same published rules, and arrive at the same number.