# Scores & ranking

Every result carries five sub-scores and a composite, all from 0 to 10, plus a `similarity` to your query.

## The five sub-scores

| score | weight in composite | asks |
| --- | --- | --- |
| `completeness` | 25% | Is it a whole, working unit or a fragment? |
| `code_quality` | 20% | Is it readable, typed, handles errors? |
| `deployability` | 20% | Could it run in production with little change? |
| `reusability` | 25% | Can it be lifted into another project cleanly? |
| `strategic_value` | 10% | Is it something many projects need? |

`composite` is the weighted sum. Filter on it with `min_composite`.

## Where scores come from

Scores come from an automated grading pipeline. Components first get a heuristic baseline score, and a growing share is re-graded by language-model graders against the same rubric. Scores are a guide for choosing between results, not a review or a guarantee: read the code before you rely on it. A `null` composite means "not scored yet", not "scored badly".

## How results are ranked

1. **Retrieval.** Your query is embedded and matched against component descriptions (semantic search). Language, licence and `min_composite` filters are applied inside the database query, so filtered searches still return full pages.
2. **Re-ranking.** The candidates are re-ordered by a blend of similarity (80%) and composite score (20%). Unscored components count as a 5 here.
3. **Clean-up.** Locale files, tests and vendored copies are pushed down; forks and copies of the same file are collapsed to the best-ranked one; and by default at most 3 results come from one repository (`max_per_repo`).

## The reputation tiebreaker

A small set of widely used repositories also has an external reputation signal: how often the repository is recommended and mentioned on the web. In ranking only, their composite is nudged by 5%: `0.95 × composite + 0.05 × signal`. The signal is positive-only, so it can lift a well-known repository's component slightly above an otherwise equal one, but it never pushes anything down. The composite you see in results is the real, unmodified score. Repositories without reputation data rank exactly as they would otherwise.

Security advisories are deliberately **not** part of this signal; they are returned as a separate warning. See [Security advisories](/docs/security-advisories).