Stackwright

One operator. ~450 hours. 133,762 lines of code.

AI-compressed development, honestly accounted: ~$135K–$220K in operator time versus a $4.6M COCOMO equivalent — a 21–34x compression ratio. Every number on this page traces to a command you can run yourself.

Measured June 2026 using scc v3.7.0. Three separate repos. No rounding in a flattering direction.

The Honest Accounting

The all-in honest number: Operator time at a senior architect rate ($300–490/hr x ~450 hours) costs $135,000–$220,500. The COCOMO-estimated cost for a conventional team writing the same 133,762 lines from scratch: $4,615,775. That gives a compression ratio of 21–34x — and that's the number we lead with, because it's the honest one.

Labor compression: COCOMO estimates ~410 person-months (24.59 months x 16.67 engineers) for a conventional team. The actual build: roughly 1 person x ~3 months of active work (131 active commit days, ~450 operator hours). The 410-to-1 compression in labor units is wage-independent — it holds regardless of what you pay engineers.

Hard cash: ~$0 metered build cost. The flat Claude Code Max subscription (~$100/mo) is excluded the same way a tool subscription is excluded on comparable receipts pages — it's overhead, not a per-project charge. This number is real, but it ignores operator time. We call it out separately and label it 'real but unfair.'

COCOMO is a model, not a measurement

The $4,615,775 figure is produced by COCOMO (organic mode) as implemented in scc v3.7.0. COCOMO (Boehm, 1981) models the effort required for a conventional team writing this codebase from scratch. Its two most sensitive inputs are: (1) the average wage assumption (scc default ~$56K/yr) and (2) the overhead multiplier (default 1.0). We also provide a loaded alternative at $180K/yr, 2x overhead = $12,302,174. The wage-independent metrics — 24.59 months, 16.67 engineers — survive any wage dispute.

COCOMO Detail — Two Scenarios

bash

# PRIMARY figure — reproducible with default scc settings
# Tool: scc v3.7.0 (github.com/boyter/scc)
# Clone the repos, then run:
scc --include-ext ts,tsx,py,js,jsx,sh,go,rs oss/ pro/ services/
 
# Output (abbreviated):
# ──────────────────────────────────────────────────────────────
# Language       Files     Lines      Code  Comments    Blanks
# TypeScript       957   177,303   130,724    23,874    22,705
# JavaScript        27     2,283     1,743       258       282
# Shell             10     1,294     1,016       153       125
# Python             1       237       186        29        22
# ──────────────────────────────────────────────────────────────
# Estimated Cost to Develop (organic):  $4,615,775
# Estimated Schedule (organic):          24.59 months
# Estimated Average Team Size:           16.67 people
# Total Lines of Code:                  133,762

The Numbers That Survive Any Wage Debate

Regardless of wage assumption, two COCOMO outputs are identical: ~25 months of estimated schedule and ~17 engineers of estimated team size. That is ~410 person-months of conventional-team effort — compared to 1 person x ~450 hours. The compression in labor units is wage-independent and holds under any costing model.

What Got Built

OSS Framework

17 packages (16 published). Rendering engine, CLI, MCP server, theme system, SBOM generator, MapLibre integration, icon registry, build pipeline, Zod-validated schemas.

Pro Framework

19 packages (18 published). OpenAPI integration, CAC/PIV + OIDC auth, 4-layer compliance engine, Pulse live data, workflow engine, Cesium 3D globe, deck.gl.

Services Tier

9 packages (8 published). Backend compiler, capability registry, Hono runtime, dual-target build (Lambda + Helm), typed predicate schema, closed 10-operator set.

Compliance Engine

NIST 800-53, CMMC L2 (110 practices), NIST 800-171r3 (130 controls), FedRAMP (103 annual controls), NIST SSDF. OSCAL v1.1.2 export for FedRAMP ATO packages.

Security Architecture

MCP structural confinement (26+ tools, no shell/write-arbitrary). SHA-256 otter integrity with constant-time comparison. safe_write chokepoint with path traversal rejection and symlink guards.

Production Output

2 live sites (peraspera.llc, trystackwright.dev). 5,671 tests across 287 test files. 179 Markdown docs (64,877 lines). 1,501 commits across 3 repos over ~10.8 months.

Our Receipts — How We Measured

Every metric on this page was produced by a reproducible command. Measurement date: June 2026. The commands below assume you have cloned the three repos (oss/, pro/, services/) and installed scc v3.7.0.

bash

# Reproducible — clone the repos and run this yourself
scc --include-ext ts,tsx,py,js,jsx,sh,go,rs oss/ pro/ services/
 
# Results: 133,762 code lines / 177,303 total lines / 996 files

bash

# Three separate repos — sum the counts
git -C oss rev-list --count HEAD       # 736
git -C pro rev-list --count HEAD       # 656
git -C services rev-list --count HEAD  # 109
# Total: 1,501

bash

# Active commit days — per-repo count of unique calendar days
git -C oss log --format='%ad' --date=short | sort -u | wc -l       # 60
git -C pro log --format='%ad' --date=short | sort -u | wc -l       # 65
git -C services log --format='%ad' --date=short | sort -u | wc -l  # 6
# Per-repo sum: 131 active days
# ~450 operator hours / 131 days ~= 3.4h/day (self-estimate, not instrumented)

bash

# Run in each tier root
pnpm test --run
# OSS:      1,472 tests / 84 test files
# Pro:      2,677 tests / 126 test files
# Services: 1,522 tests / 77 test files
# Total:    5,671 tests / 287 test files

Self-assessed, not independently audited

We claim 'aligned,' not 'certified.' Every item below is implemented in source code — verify by reading the files cited. No third-party audit has been performed.

Security Posture

Structural Confinement

MCP tool surface is the security boundary. No shell access, no write-arbitrary. 26+ registered tools — exhaustively enumerable. Agents can only do what the tool list permits.

Agent Integrity

SHA-256 checksums on all 9 otter definitions. Constant-time comparison via timingSafeEqual. Symlink rejection, binary validation (setuid/setgid via fstatSync, TOCTOU-resistant), O_EXCL atomic POSIX pipeline lock.

Compliance Engine

NIST 800-53, CMMC L2, FedRAMP, and NIST SSDF assessment engines. OSCAL v1.1.2 export implemented (exportAsOSCAL). 4-layer assessment framework. Aligned — not certified.

Supply Chain

SBOM in SPDX 2.3, CycloneDX 1.5, and Build Manifest with Zod-validated schemas. CVE enrichment via OSV.dev (real HTTPS calls). Sigstore signing (real cosign; verification has a TODO). SLSA L3 provenance attestation schema implemented; hermetic runner is external.

Authentication

CAC/PIV: PKI header signing, revocation checking — 3,617 lines in auth package. OIDC: discovery, PKCE, token exchange. RBAC and audit logging. Allowlist-only environment stripping via buildCodePuppyEnv().

Backend Safety

Typed predicate schema with closed 10-operator set. No eval, no regex, no expression strings. Least-privilege permission derivation. projectOnly: true mode. safe_write per-otter allowlists with foreman blocked.

Methods and Honesty

Hard cash vs. operator time. The ~$0 metered build cost is kept separate from imputed operator time ($135K–$220K). The flat Claude Code Max subscription (~$100/mo) is excluded the same way a tool subscription is excluded on comparable receipts pages — it is overhead, not a per-project charge.

Operator hours. The 450-hour figure is a self-estimate, not instrumented. There are no session logs. It is bounded by 131 active commit days at ~3.4 hours/day. Git commit density provides a rough bound; the actual number could be lower.

COCOMO sensitivity. The model has two sensitive inputs: (1) the average wage assumption (scc default ~$56K/yr vs. our loaded $180K) and (2) the overhead multiplier (default 1.0 vs. our loaded 2.0). The reproducible-default figure ($4,615,775) is primary; the loaded figure ($12,302,174) is a labeled alternative.

What COCOMO measures. COCOMO (organic mode, Boehm 1981) estimates effort for a conventional team writing the same codebase from scratch. It does not distinguish hand-authored logic from generated config and schema files. The actual codebase includes both — COCOMO counts all lines equally.

Compression ratio robustness. The 21–34x compression holds even if you vary the operator's hourly rate within the senior architect band ($300–490/hr), because both the numerator (COCOMO floor) and denominator (operator cost) move proportionally.

The two numbers this model is most sensitive to

The operator's hourly rate and the share of the codebase that is hand-authored logic vs. generated artifacts. We report both levers; you decide the weights.

Sources

• scc v3.7.0 — github.com/boyter/scc — COCOMO model (Boehm, 1981; organic mode)

• NIST SP 800-53 Rev 5 — Security and Privacy Controls for Information Systems and Organizations

• CMMC Level 2 Assessment Guide v2.0 — 110 practices

• NIST SP 800-171 Rev 3 — Protecting Controlled Unclassified Information (130 controls)

• FedRAMP Annual Assessment Controls Selection Worksheet — 103 annual controls

• OSCAL v1.1.2 — Open Security Controls Assessment Language (NIST)

• NIST SP 800-218 — Secure Software Development Framework (SSDF)

• SLSA v1.0 specification — slsa.dev

• OSV.dev — Open Source Vulnerability database

• Sigstore — sigstore.dev — software signing and transparency

This page is its own proof point

This page was composed by the framework's own agents, against its own schema, validated by its own build pipeline. The proof page being built by the tool it documents is itself one of the proof points.

One operator. ~450 hours. 133,762 lines of code.

Measured June 2026 using scc v3.7.0. Three separate repos. No rounding in a flattering direction.

The Honest Accounting

# PRIMARY figure — reproducible with default scc settings # Tool: scc v3.7.0 (github.com/boyter/scc) # Clone the repos, then run: scc --include-ext ts,tsx,py,js,jsx,sh,go,rs oss/ pro/ services/ # Output (abbreviated): # ────────────────────────────────────────────────────────────── # Language Files Lines Code Comments Blanks # TypeScript 957 177,303 130,724 23,874 22,705 # JavaScript 27 2,283 1,743 258 282 # Shell 10 1,294 1,016 153 125 # Python 1 237 186 29 22 # ────────────────────────────────────────────────────────────── # Estimated Cost to Develop (organic): $4,615,775 # Estimated Schedule (organic): 24.59 months # Estimated Average Team Size: 16.67 people # Total Lines of Code: 133,762

The Numbers That Survive Any Wage Debate

# Active commit days — per-repo count of unique calendar days git -C oss log --format='%ad' --date=short | sort -u | wc -l # 60 git -C pro log --format='%ad' --date=short | sort -u | wc -l # 65 git -C services log --format='%ad' --date=short | sort -u | wc -l # 6 # Per-repo sum: 131 active days # ~450 operator hours / 131 days ~= 3.4h/day (self-estimate, not instrumented)

# Run in each tier root pnpm test --run # OSS: 1,472 tests / 84 test files # Pro: 2,677 tests / 126 test files # Services: 1,522 tests / 77 test files # Total: 5,671 tests / 287 test files

Methods and Honesty

Sources

• scc v3.7.0 — github.com/boyter/scc — COCOMO model (Boehm, 1981; organic mode)

• NIST SP 800-53 Rev 5 — Security and Privacy Controls for Information Systems and Organizations

• CMMC Level 2 Assessment Guide v2.0 — 110 practices

• NIST SP 800-171 Rev 3 — Protecting Controlled Unclassified Information (130 controls)

• FedRAMP Annual Assessment Controls Selection Worksheet — 103 annual controls

• OSCAL v1.1.2 — Open Security Controls Assessment Language (NIST)

• NIST SP 800-218 — Secure Software Development Framework (SSDF)

• SLSA v1.0 specification — slsa.dev

• OSV.dev — Open Source Vulnerability database

• Sigstore — sigstore.dev — software signing and transparency