Trust the evidence, not a label.
An explicit account of what automated scoring and licence filtering can—and cannot—tell you.
Five dimensions. One weighted composite.
Whole usable unit rather than a fragment
Readability, types, errors and maintainability
How easily it can run in production
How cleanly it can move between projects
Applicability across common use cases
A missing score is not a bad score. Scores are automated heuristics and language-model grading, not manual certification.
Match and quality are different.
Similarity concerns relevance to the user's query. The composite score concerns estimated code quality and reusability. Your current live docs also describe deduplication and a reputation tiebreaker.
What provenance means
Licence filtering is a discovery aid, not legal advice or a guarantee. The production record must supply SPDX ID, relevant copyright notices, exact file reference and any relevant copyleft obligations.
Security signals
Repository advisories may be unrelated to a selected component. Always verify affected packages, versions and exposure. No scanning or penetration testing is performed by this preview.
Source of truth
Point to an exact GitHub file at an immutable commit SHA.
Scoring history
Show grader type, score timestamps and confidence where the API supports it.
Licensing record
Describe repository-level versus file-level evidence and the obligations for each SPDX licence.
Risk caveats
Differentiate heuristic checks from human reviews, execution tests and applicable advisories.