[saengel]

Some projects found in the wild are now published without explicit consent, so visibility depends on is_published only.

[gitvelocity-reviewer]

📊 Code Quality Score: 9/100

Base Score 23 (S4 + A1 + I3 + R8 + Q7 + P0) × 0.4 (Small ESF) = 9.2, rounded to 9

Category	Score	Factors
🔭 Scope	4/20	One production line changes in src/lib/project.ts, in normalizeProjects. The other 8 files are test files: browse.spec.ts, filters.spec.ts, support.ts, BrowsePage.test.tsx, ChartsPage.test.tsx, selectors.test.ts, filter.test.ts and project.test.ts.
🏗️ Architecture	1/20	No module boundary, dependency or abstraction changes. The RawProject type and the normalisation pipeline keep their shape.
⚙️ Implementation	3/20	normalizeProjects drops && p.consent_to_display from its filter predicate and keeps p.is_published. In e2e/support.ts, the RICH_PROJECT finder drops the same condition. The rest is replacing 121/133/23/35 with 122/134/24/36 in assertions.
⚠️ Risk	8/20	Projects whose owners set consent_to_display to false are now rendered on the public browse, charts and detail views. A reader outside the repo sees this immediately, and undoing it is a one-line revert. The changed JSDoc says projects found in the wild are published without explicit consent, and no flag gates the change.
✅ Quality	7/15	The project.test.ts case 'keeps only published projects, whatever their consent flag' now expects ids [1, 3], so the new filter behaviour has a direct assertion. Count updates in filter.test.ts, selectors.test.ts, ChartsPage.test.tsx, BrowsePage.test.tsx and the two e2e specs keep the suite consistent with the snapshot. The JSDoc on normalizeProjects records the reason for the change. No test checks that the detail view or any UI shows a project with consent_to_display: false.
🔒 Perf / Security	0/5	No performance or security control is added. The change removes a consent-based visibility filter and adds no replacement control.

Was this score accurate? 👍 Yes · 👎 No

How this was scored →

_{Scored by GitVelocity · How are scores calculated?}

[gitvelocity-reviewer]

📊 Code Quality Score: 10/100

Base 24 (S5 + A1 + I2 + R8 + Q8 + P0) x ESF 0.4 = 9.6, rounded to 10

Category	Score	Factors
🔭 Scope	5/20	One production line changes in src/lib/project.ts. The other eight files (browse.spec.ts, filters.spec.ts, support.ts, BrowsePage.test.tsx, ChartsPage.test.tsx, selectors.test.ts, filter.test.ts, project.test.ts) are tests and fixtures whose expected counts move by one.
🏗️ Architecture	1/20	No module boundary, dependency or data flow changes. The .filter() predicate in normalizeProjects is shortened from two conditions to one.
⚙️ Implementation	2/20	normalizeProjects drops && p.consent_to_display from its filter. RICH_PROJECT in e2e/support.ts drops the same condition. The remaining edits are numeric constants in assertions.
⚠️ Risk	8/20	normalizeProjects feeds the browse list, filters, charts and detail view, so every project with consent_to_display: false becomes publicly visible. The change is a one-line revert, but a project already shown to the public cannot be un-shown to those who saw it. The code does not distinguish an unset consent value from an explicit false.
✅ Quality	8/15	The normalizeProjects visibility test in project.test.ts now expects ids [1, 3], covering the changed rule. Counts are updated consistently in BrowsePage.test.tsx, ChartsPage.test.tsx, selectors.test.ts and filter.test.ts. The JSDoc on normalizeProjects states the new rule but gives no ticket or policy reference. No test covers an undefined consent value.
🔒 Perf / Security	0/5	No performance or security work is added. The only privacy-relevant control, the consent filter in normalizeProjects, is removed.

Was this score accurate? 👍 Yes · 👎 No

How this was scored →

_{Scored by GitVelocity · How are scores calculated?}