Code Maturity Model: why we built SQCM (and published the methodology)

Software organizations are shipping AI-generated code at a pace their quality practices were not designed for. Assessing whether a repository can be trusted has become an engineering leadership concern, and any assessment is only as strong as the methodology behind it.

Today we are publishing that methodology. The ScaleQuality Code Maturity Model (SQCM) v1.0 is the model behind our repository Diagnosis: open, versioned, and grounded in 27 verified references, from ISO standards to peer-reviewed research.

This post summarizes the model. The full paper, including the method and its declared limitations, is available at scalequality.io/research/sqcm, with a downloadable PDF in English and Portuguese.

The problem that demanded a new ruler

Three facts define the moment:

AI adoption in code writing exploded. In October 2024, Google stated that more than 25% of its new code was AI-generated. By April 2026, the stated figure was 75%. It tripled in 18 months.

The speed is real. In a controlled experiment, developers using AI completed tasks 55.8% faster. We are not speed skeptics: speed is why adoption happened.

But trust did not keep up. Recent research documents AI-generated code carrying vulnerabilities at meaningful rates, developers writing worse code while trusting it more, code duplication growing 8x, refactoring collapsing, and one finding that sums it all up: more than a fifth of the issues AI introduces survive to the current version of the repositories. The 2025 DORA report closed the diagnosis: AI amplifies the system it lands in. Without quality controls, change volume becomes instability.

The practical question left without a ruler: given a concrete repository, today, what can it withstand?

Why the existing rulers do not answer it

Each family of models answers a different question:

• ISO/IEC 25010 defines the quality vocabulary, but it is a taxonomy: it does not measure.
• ISO/IEC 5055 (CISQ) standardized measuring quality straight from code, but it measures the snapshot (violations present today), not the maturity of the practices that produce the next snapshots. And it says nothing about AI code.
• SIG/TÜViT has graded maintainability from static analysis for 15 years, but covers a single domain.
• CMMI measures organizational process maturity, not the code. Two companies at the same CMMI level can host repositories in opposite states.
• DORA measures the team's delivery flow, not the state of the artifact the flow produces.

Quality is a snapshot. Process is the organization. Delivery is the flow. Code maturity is prognosis: the property of a repository that predicts its behavior over time. That was the missing ruler.

What SQCM measures

SQCM evaluates a repository across four domains, exclusively from observable evidence: structure, manifests, git history, tests, automation, and static analysis. No questionnaire. No self-declaration. The score does not depend on what the team believes about itself, and the Stanford study on overconfidence with AI assistants is the argument in one sentence.

Three domains come from the ISO tradition: Security, Reliability, and Maintainability. The fourth is the model's original contribution:

AI code durability: of the AI-generated lines that entered the repository, how many survive? What is the rework rate? How does that compare to human-authored code in the same repository?

The verdict lands on a five-level ladder with published thresholds: Reactive, Initial, Structured, Managed, Optimized. Every domain carries an explicit confidence level. A domain without sufficient evidence is declared unmeasured, never interpolated. And every verdict records the model version that produced it: history is immutable, and the ruler never moves silently.

Transparency by design

Two publication choices define the model's posture:

The limitations are part of the paper. Observable evidence has blind spots. AI authorship attribution is heuristic and treated as such. The v1.0 thresholds are design calibration, and the longitudinal validation agenda (correlating levels with real incidents across a cohort of repositories) is published as a commitment.

The role of AI inside the engine is declared. AI extracts and synthesizes signals, always under an explicit confidence label. Score composition, weights, and thresholds are deterministic. SQCM uses AI to read evidence, not to opine without evidence.

From score to action

A model that ends at the score is a report. In the product, SQCM operates: every identified risk becomes a work agenda with business impact translated, the point-in-time verdict can become continuous (with a maturity line below which the build fails), and the risks feed agents that propose fixes as real pull requests, reviewed by humans.

Read the paper

The full methodology, with all 27 references and the validation agenda, is published and versioned:

→ ScaleQuality Code Maturity Model (SQCM) v1.0 (PDF available in English and Portuguese)

And if you want to see the model running on your own code: app.scalequality.io/register. Point it at a repo and get the verdict in minutes. Free 7-day trial, no credit card.