# SQCM v3.0 - supplementary validation note

Author: Erik Fernandes, ScaleQuality. Audit date: 2026-10-02. License: CC BY 4.0.

This note accompanies paper v3.0, which describes two scoring calibrations: `v2.2` for the default profile and `mainframe-v1.0` for the Mainframe profile. It records the scope of an internal implementation audit of the additions in v3.0 (the Mainframe profile and license evidence), not an independent certification or a population study. The audit of the default profile recorded in the v2.1 validation note is not repeated here.

## Audited implementation

| Component | Source revision inspected |
|---|---|
| Diagnostic/scoring service (production) | 9c00c8187d77 |
| Insights/persistence service (production) | 4a81e4055953 |
| Published CI client | @scalequality/check 0.5.4 |

The mainframe reader and scoring files were confirmed identical between the production revision and the development branch on the audit date. A source revision is a code observation; it is not evidence that every supported integration was exercised end to end. The proprietary source repositories are not distributed here.

## Executed regression groups

Existing Jest suites were selected by exact file paths and executed on isolated checkouts of the production revisions, with type checking disabled in the test runner.

1. Mainframe reader and profile scoring: 2 suites, 25 tests, all passed.
2. Mainframe level with continuous measurement, and score versions: 1 suite, 3 tests, all passed.
3. License inventory, registry resolution, normalization, notices, file index, and copied-code scanning: 8 suites, 62 tests, all passed.
4. License policy, exceptions, exported documents, and the pull-request check: 4 suites, 37 tests, all passed.

Total: 15 suites and 127 passing tests. The total does not imply 127 independent observations or complete system test coverage.

## Mainframe calibration reproduction

The nine calibration repositories were cloned at the revisions recorded in the paper and in the accompanying CSV, and read with the production reader and scoring code. On 2 October 2026 every domain score, score, and level matched the values recorded when the bands were set on 30 September 2026. Two repositories received new commits on 1 October 2026; the recorded revisions are their last commits on or before 30 September 2026.

The CSV lists, per repository, the revision, size, every metric used by the profile, the domain scores, the score, the level by score, the level without and with continuous measurement, and the locks. One repository, a synthetic benchmark generated with a language model and published without a license file, is listed without its name or revision.

## Copied-code test

On 2 October 2026 the SCANOSS client (scanoss.py 1.54.2, the version bundled by the platform) was run with path obfuscation against the free open knowledge base:

| Input | Result |
|---|---|
| An unmodified file of a widely used JavaScript library | Whole-file match, 100%, correct component identified |
| A 200-line fragment of the same library inside an otherwise original file | No match |
| A 120-line fragment of the unmodified file above inside an otherwise original file | No match |

The test supports the paper's claim of whole-file identification on the free base and its decision not to claim fragment identification there. It does not measure the commercial knowledge base or a private SCANOSS server.

## SPDX format check

A document generated by the production `spdxDocument` code from a test inventory (two repositories, eight packages, including an OR expression, multiple declared licenses, a LicenseRef, a non-SPDX string, and an unknown license) was parsed and converted to tag-value without errors by the official SPDX tools (spdx-tools 0.8.5). The same document with a deliberately malformed license expression was rejected. This checks the format, not the completeness or correctness of any inventory.

## Evidence not newly collected

No customer mainframe estate was measured, and no outcome data (incidents, migration cost) was linked to the mainframe bands. No library-manager connection (Endevor, ChangeMan) was validated against a customer installation. No legal review of license decisions was performed; the license evidence reports declared licenses and an organization's own policy decisions.

## Availability and reproduction limits

The conceptual method, this note, and the calibration CSV are public. The calibration repositories are public and can be read at the recorded revisions; full reproduction of the scores requires the proprietary reader and scoring code, which this publication does not distribute. License evidence depends on external services (deps.dev, OSV, public registries, SCANOSS) whose data changes over time.