Multi-repository survivability

Aura's multi-repo assessment analyzes the topology, contracts, and coupling of a workspace that may contain one or many repositories. It is designed to detect survivability risks before they appear during launch, incidents, growth, investment, or acquisition.

What it does

The multi-repo pipeline is read-only: it never writes to, mutates, or opens pull requests against customer repositories. It runs against a workspace root and produces:

• WorkspaceGraph — detected repos, package/workspace relationships, and cross-repo links.
• S_repo score — a provisional 0–100 readiness score from five dimensions.
• Spectral and Markov signals — Fiedler value, propagation cost, and damped spectral radius.
• Strongly-connected cycle detection — clusters of mutually dependent repos.
• Dry-run remediation plan — ordered, explainable, non-destructive recommendations.

Supported topologies

| Topology | Detection signal | |---|---| | Monorepo workspace | package.json workspaces, pnpm-workspace.yaml, turbo.json, or nx.json | | Polyrepo | Multiple isolated .git roots with package manifests | | Hybrid | Mixed isolated repos and nested workspaces |

API

• GET /api/multi-repo?fixture=contracts-fixture — run a fixture through the pipeline.
• GET /api/multi-repo/provenance?fixture=contracts-fixture — export JSON-LD provenance.
• GET /api/multi-repo/graph?fixture=contracts-fixture&query=MATCH%20(n)%20RETURN%20n — query the workspace graph with a Cypher-like dialect.

Evidence and calibration

S_repo is provisional. It is computed as:

S_repo = baseRubricScore × exp(-α·ρ(Q) - β·λ₂)

where baseRubricScore is the mean of CSC, BRI, CCS, RDG, and AHI, ρ(Q) is the spectral radius of the damped Markov transition matrix, and λ₂ is the normalized-Laplacian Fiedler value. We do not market this as a scientifically validated score until it is calibrated against real customer or open-source estates.

Known limits

• Contract scanning currently targets OpenAPI 3.x and Protobuf v3 files.
• Native tree-sitter grammar packages require a build toolchain; deployments use Nixpacks to provide Python, GCC, and Make.
• Remediation output is dry-run only — no repository changes are made automatically.