Terms behind healthier AI-written code

AGENTS.md is an open Markdown convention for a repository file that gives coding agents the commands, conventions, and boundaries they need to work on a project.

AI code review is the use of a large language model to examine a pull or merge request and post findings, questions, or suggested changes for a human reviewer to validate.

An Autofix is an Enji Guard improvement run that selects one bounded candidate, keeps a provider issue as its baseline artifact, and may open one verified pull or merge request for review.

Codebase hygiene is the observable maintainability of a repository: how much dead code, duplication, hardcoded values, and clutter a reader must work around before changing it.

Cognitive debt is the intent, rationale, constraints, and expected behavior of a system that a future maintainer or coding agent cannot recover from the repository without guessing.

DAST (Dynamic Application Security Testing) is black-box security testing that sends requests to a running application and judges its responses without access to the source code.

Dependency hygiene is the practice of knowing which third-party packages a project installs, installing them reproducibly, keeping them patched and maintained, and removing what it does not need.

The green zone is the maintained state in which a project's current audit areas are healthy enough for people and coding agents to keep building without stacking new work on known risks.

A hallucinated package is a package name a code-generating model writes into an import or install line although no such package exists in the registry.

Human approval is the Enji Guard write boundary: Enji Guard prepares evidence, an issue, and one bounded review request; a qualified person keeps code review, risky decisions, and the final merge.

A recurring audit is an Enji Guard audit metric with automatic runs enabled: on its cadence, the audit reruns when newer repository state exists so its score describes the current revision.

SAST (Static Application Security Testing) analyzes source code or compiled code without running the application to find security flaws before the code is deployed.

Slopsquatting is a supply-chain attack where an attacker registers a package name that AI coding tools tend to invent, so that an assistant's or agent's install line resolves to the attacker's code.

Software Composition Analysis (SCA) identifies third-party software components and checks them for known vulnerabilities and, depending on the tool, license or other component risks.

Test quality is how much a test suite proves about behavior that matters: evidential assertions, meaningful coverage, determinism, and maintainability rather than test count or a green status.

Typosquatting is a supply-chain attack where an attacker publishes a package under a name close to a popular one so that a mistyped or confused install pulls the attacker's code.