Cremona
Cremona turns Python structural-debt signals into an agent-ready refactoring queue and CI regression gate.
It combines ruff C901, lizard, complexipy, vulture, git history, and optional coverage data so you can answer two questions quickly:
- Is structural debt regressing?
- Which files should be refactored next?
60-second quickstart
Run Cremona against a repository without cloning this repo first:
uvx cremona scan /path/to/repo
Keep it installed for repeated use:
pipx install cremona
cremona scan /path/to/repo
By default, Cremona writes these files in the target repository:
output/refactor-audit/report.mdoutput/refactor-audit/report.jsonoutput/refactor-audit/raw/
Start with report.md. It gives you the repo verdict, the file queue, the top hotspots, and the baseline diff in one pass.
Why Cremona
rufftells you where control flow is growing.lizardandcomplexipyshow which functions are hard to change safely.- Git history shows churn and coupling.
- Coverage data shows where change risk is still high.
- Cremona turns those signals into a refactoring queue instead of a pile of unrelated warnings.
Example verdict and queue
This excerpt comes from Cremona's current self-host report.
- Repo verdict:
stable - Routing pressure:
watch_only - Signal health:
full
| Priority | Score | File | Why it stays visible |
|---|---|---|---|
watch |
33 | src/cremona/core/engine.py |
5 commits, 2444 churn, branch coverage 0.82, coupled with tests/test_cremona_scan.py |
watch |
32 | tests/test_cremona_scan.py |
8 commits, 4168 churn, branch coverage 1.00, coupled with src/cremona/core/engine.py |
watch |
27 | src/cremona/scan.py |
2 commits, 5870 churn, line coverage 1.00, coupled with src/cremona/core/__init__.py |
On a repository with active structural pressure, the same queue will surface investigate_soon and investigate_now rows.
Codex and agent workflow
Use the bundled Codex skill when you want an agent to turn the report into a concrete refactor plan.
- Run
uvx cremona scan /path/to/repo. - Open
report.mdand choose the top file fromagent_routing_queue. - Ask Codex to make the smallest safe refactor.
- Run Cremona again.
- Update the baseline only when debt actually dropped or the schema changed.
When you start Codex inside this repository, it discovers the repo-scoped skill automatically from .agents/skills/cremona-proactive-refactor-audit.
To install the same skill into your personal Codex setup:
$skill-installer install the skill from https://github.com/NeapolitanIcecream/cremona/tree/main/.agents/skills/cremona-proactive-refactor-audit
Read docs/codex-skill.md for the full workflow.
CI gate
Bootstrap the first baseline:
uvx cremona scan /path/to/repo --update-baseline
git add quality/refactor-baseline.json
Use coverage in the gate so routing can score change risk:
uv run coverage run -m pytest -q
uv run coverage json -o coverage.json
uvx cremona scan --baseline quality/refactor-baseline.json --coverage-json coverage.json --fail-on-regression
Read docs/reusable-workflow.md for the fastest GitHub Actions integration, or docs/ci-gate.md if you want the full custom recipe.
The reusable workflow can also maintain a sticky PR comment with the repo verdict, top routing rows, and top hotspots. See comment-on-pr in docs/reusable-workflow.md for the same-repository pull_request constraints and required caller permissions: actions: read and pull-requests: write.
Install from source for contributors
Use the source install when you are changing Cremona itself.
git clone https://github.com/NeapolitanIcecream/cremona.git
cd cremona
uv sync --group dev
uv run cremona --help
Read next
Metadata
Release files for cremona 0.1.2
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| cremona-0.1.2.tar.gz | 38.0 kB | Without provenance | Details for cremona-0.1.2.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| cremona-0.1.2-py3-none-any.whl | Python 3 | none | any | Details for cremona-0.1.2-py3-none-any.whl |
Total release size: 81.1 kB
Release files / cremona-0.1.2.tar.gz
| Download URL | cremona-0.1.2.tar.gz |
|---|---|
| Size | 38.0 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
a116366262441f67abc5a189948daa073f9c014b7e4307ef70f39c861380d7d4
|
|
BLAKE2b-256 checksum How to use checksums |
7669b1b61acfd07d01b3d6d5dd8192ead723038701fa079db2e37ec00bc9782d
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
uv/0.11.1 {"installer":{"name":"uv","version":"0.11.1","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"macOS","version":null,"id":null,"libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":null}
|
Release files / cremona-0.1.2-py3-none-any.whl
| Download URL | cremona-0.1.2-py3-none-any.whl |
|---|---|
| Size | 43.1 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
1de88fd77080e339faaa5808489d5b9bf6e66854b0cdec439600a4214ee82471
|
|
BLAKE2b-256 checksum How to use checksums |
ef678a784eaaa6dea07223171c596309991a4d8c8813bb5e50c097a76b726f77
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
uv/0.11.1 {"installer":{"name":"uv","version":"0.11.1","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"macOS","version":null,"id":null,"libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":null}
|
Security for cremona 0.1.2
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.