The architecture check: a panel on every GitHub repo, and a URL for every result

Generating a backend is easy. Checking one isn't — and most new backend code is now written by a machine, while the number of people available to read it has not changed. The last two weeks were spent turning Wyro's compiler around: instead of only emitting an architecture, it now reads one out of code that Wyro never wrote, and checks it.

Three things shipped: a widget that runs on any GitHub repository page, a public page for every check, and a much wider set of frameworks the reader understands.

The widget

The Wyro extension is live on the Chrome Web Store. Install it, open any repository on GitHub, and a Check with Wyro button appears. Press it and a panel slides in over the page with the result — no tab switch, no paste, no account.

It is not a link to a report; it is the report. The panel reads the file tree from GitHub, fetches the source it needs, builds the architecture graph and runs the rules — all inside your browser. There is no Wyro server in that path and nothing is uploaded. On a public repository you never sign in to anything.

What it shows, top to bottom: a plain-English verdict, a strip plotting one point per route at the height of how many findings name that route (a clean repository is a flat line, and the spikes are the routes worth looking at), then ROUTES, TABLES and FILES READ. Below that, each finding names the rule that fired, the path it walked from the route to the data, and the line of code that caused it.

• NewChrome extension, published to the Chrome Web Store — a check button on every GitHub repository page.
• NewThe panel runs the whole engine locally in the extension's service worker; the only network calls are to GitHub for the source.
• NewFindings carry the line that produced them, so a claim about your code can be checked against your code.
• NewA settings menu behind the gear: store a GitHub token to go from 60 repository reads an hour to 5,000 and to check private repositories you can already access. The token stays in that browser.
• NewA severity filter for the findings list. It deliberately does not change the counts above it — hiding warnings must never make a repository read as though it has fewer problems than it has.
• ImprovedReads roughly twice as much of a repository in fewer round trips, with every request bounded so a slow repository fails visibly instead of hanging.
• ImprovedIn a monorepo, opening a subdirectory first scopes the check to it — the /tree/<branch>/<path> URL is read and honoured.

Every check now has a URL

A check that lives in one browser tab dies with that tab. It can't be linked in a pull request, sent to the person who owns the code, or found by anyone searching. So every check is now also a page: wyro.in/scan/<owner>/<repo>, server-rendered, crawlable, and open without an account.

• NewPublic scan pages at /scan/<owner>/<repo>, with ?path= for a subdirectory of a monorepo.
• NewThe widget's footer links to the page for the repository you just checked, so any result is one click from being shareable.
• ImprovedThe widget and the page compute their report from one shared function. Two surfaces disagreeing about the same repository would be a reason to trust neither.
• FixedOpening a repository on the canvas twice created a second project and spent a plan slot. Importing the same repository is now idempotent.

What Wyro can read now

Coverage is the whole product here: a checker that silently skips your framework reports a calm result about a repository it never read.

• NewPython: FastAPI routes and SQLAlchemy / SQLModel tables — including multi-line decorators, nested include_router mounts, and Annotated[..., Depends(...)] dependency aliases, which is how modern FastAPI declares auth without writing Depends() in the signature at all.
• NewNext.js: App Router route.ts handlers and pages/api, where the URL is the file's location and the method is the export's name. Wyro's own repository went from 0 routes read to 129.
• NewMongoose schemas and model queries, TypeORM entities and repository access, and decorator routing for NestJS and routing-controllers.
• ImprovedRoutes are connected to the tables they actually reach in real repositories, rather than only in generated ones.
• FixedLogin and signup endpoints were being reported as unauthenticated data paths. An endpoint that issues a credential cannot be required to present one.

Every one of these was broken by an idiom no fixture contained, and each failure was silent — a route that is never seen cannot be reported as unguarded, so the output looked clean and was wrong. The parsers are now validated by running them against published repositories after every change, not against test data written to match them.

Refusing to be reassuring

The most dangerous thing a checker can do is say nothing is wrong when it could not look. Several changes this cycle exist only to make that impossible.

• FixedZero routes can never be a pass. A repository where nothing parsed now says so — that is not a clean report, it is a report that could not be produced.
• NewAn unreadable repository is diagnosed rather than refused: Wyro says what the repository appears to be, why it could not be read, and what would work. "This is not a backend" and "this is a backend I cannot read yet" are different sentences, and collapsing them blames you for our gap.
• ImprovedRules with nothing to look at are listed as not having run, never folded into a pass. If no schema parsed, every rule that needs a table is named.
• ImprovedA partial read is declared next to the findings it undermines, including which files went unread.
• FixedA parse gap was producing 100 spurious warnings on one large repository. Suppressing them made that repository render "All rules passed" — a false clean verdict, which is strictly worse than a hundred false warnings. Both are fixed.

From a finding to a change

When the panel finds something, Open the architecture hands the repository to the Wyro canvas, laid out as the graph that produced it — routes, guards, tables and the edges between them. The extension has read-only access and never edits your code: adding a guard stays a change you make and can see.

• NewImport a repository Wyro never generated and get its real architecture on the canvas, laid out so it reads as connected rather than as a pile of blocks.
• ImprovedWyro checks the code it writes with the same rules it applies to yours — the diagram is no longer the only thing that gets checked.
• FixedThe hand-off was a dead end for logged-out visitors; sign-in now returns you to the repository you started from, not to the dashboard.