How the Code Assurance Index is constructed

A code assurance score compresses a large body of technical evidence into a form that can be compared, discussed and tracked. The value of that compression depends on making the construction visible: a strong area should not be able to erase a serious weakness, a missing measurement should not silently become a failure, and interpretive judgement should not be allowed to move a deterministic score.

Measuring a repository and aggregating that measurement into a score are separate processes in CAI: an implementation emits structured evidence, and a reference scorer folds that evidence into a result. Wherever several scores are combined they are ordered from weakest to strongest, and the parameters place the greatest weight on the weakest measured area so that it keeps material influence rather than being averaged away. Those parameters live in the versioned rubric rather than in the scorer, which is why a rubric version identifies the scoring semantics a result was produced under.

CAI is therefore best understood as an inspectable aggregation standard whose assumptions are exposed rather than hidden. The paper sets out those assumptions and the scoring mechanics, and it marks the research questions that would be required only for stronger empirical claims about robustness, calibration or external validity.