We ran the check on 29 open-source repositories. It was right about one.

Until mid-September, the evidence that the architecture check worked was that it read Wyro's own generated backends perfectly. It does — the generator inlines queries into handlers and emits pgTable, which is exactly what the parser was written against. That is evidence the parser agrees with its author, not that it can read anyone else's code.

So we cloned 29 real open-source backends and ran the check on all of them. One produced a result we would stand behind. Of the twelve where routes and tables were both found, nine resolved not a single route-to-table edge — which means the most important rule could not fire, and the CLI printed "No problems found".

That is the one failure mode that makes a checker worthless rather than merely imperfect: reporting less than the truth while looking exactly like a pass.

Four defects, all fixed

• No cross-file call following. A handler that delegated to lib/ touched no tables as far as the parser could see. Imports are now resolved and followed two levels deep, cycle-safe, including @/ and ~/ aliases.
• Only one Drizzle dialect. mysqlTable and sqliteTable were invisible, so repositories with 40 schema files read as zero tables. Every Drizzle table builder is now recognised.
• Auth wrappers unrecognised. export const GET = withWorkspace(...) is a common way to protect a route handler, and one repository declares 401 of its 505 routes that way. The check reported 253 false authentication errors on it. A wrapper imported from the project's auth module now counts as a guard: 253 became 26.
• A silent file cap. Eight of the 29 repositories hit the 5,000-file limit exactly, and nothing said so — a partial read rendered as a clean pass. Truncation is now reported in every output format.

Two smaller ones fell out of the same work: namespaced table references (db.insert(schema.attendance)) were skipped, and joins were not counted as reads. Each fix has regression tests, including two that check it does not over-correct.

What is still not read

The remaining misses are not defects in what the parser reads, but dialects it does not read at all: tRPC procedures, Hono routers, cross-module calls in Python, and ORMs such as MikroORM and Kysely or raw SQL. Those repositories are reported as partially readable, not as clean.

SAP CAP

Every SAP CAP project used to score 0 routes and 0 tables — the same answer a stylesheet gets. .cds files are now read, and the parser works across the whole file set, because CAP routinely declares a service in one file and its authorization in another. A parser that looked only at service definitions would report every SAP service as unauthenticated.

Checked by A/B on SAP's own sample application: as shipped, 60 routes and 0 findings; remove its three capabilities files and auth-before-data fires on every route. Across SAP's samples the check now reads 201 routes and 33 tables over 8 apps. ABAP, RAP and UI5 are not read, and the report says so.

100 repositories, pre-checked

The bench became a directory. /scan now lists 100 popular Express, NestJS, FastAPI, Next.js and CAP repositories that pass a minimum bar of at least three routes and one table, each with its own report page and a README badge. Any other public repository is one URL away: wyro.in/scan/<owner>/<repo>.

The lesson we are keeping: a zero-finding result is not trusted until something has been broken on purpose and the check has caught it. The bench is re-run after every parser change.

• verification
• parser
• sap-cap
• scan

Author

Dominic PaulCEO | Founder