How we measured this
1
Select the reference stack
▶46 representative open-source projects across 4 infrastructure layers, chosen to reflect a realistic compound AI system. Only projects with
status: selected in the stack config are measured.2
Count source lines of code
▶Each repository is analyzed with a language-aware LOC counter (scc). Blank lines and comments are excluded. Only source files count — not generated code or vendored dependencies.
3
Resolve transitive dependencies
▶Per-ecosystem resolvers expand each manifest into its full transitive closure: pip-compile for Python, go list -m all for Go, cargo metadata for Rust, npm ls for Node, mvn dependency:tree for Maven. Projects with no resolver are marked not resolved.
4
Identify cross-layer exposure
▶Direct dependency lists are compared across all four layers. Packages appearing in two or more layers are flagged as cross-layer shared dependencies — a proxy for systemic supply chain risk.
5
Estimate opaque components
▶Proprietary software (cloud services, GPU drivers, OS, internal glue) cannot be measured from source. Ranges in Layer 5 are derived from public disclosures, SDK sizes, and industry benchmarks.
6
Measure transitive LOC
▶
Transitive dependency LOC is measured in two stages, with the deterministic method taking priority per ecosystem.
Deterministic (preferred): each unique (name, version) pair across the full transitive closure is downloaded from the ecosystem registry and analyzed with scc. The total is the sum of measured LOC; packages that fail to download fall back to the median of successfully measured packages in the same ecosystem.
Statistical fallback: when deterministic measurements are not yet available for an ecosystem, a median LOC/package ratio is derived from the cloned repos (project LOC ÷ transitive package count) and applied to each project’s transitive count. This produces a range of ×0.5–×1 of the median as lower and upper bounds.
The dashboard uses the deterministic total where available and falls back to the statistical estimate per ecosystem. The badge on the transitive LOC segment reflects which method is in use: measured, ~ partial, or ~ estimated.
Deterministic (preferred): each unique (name, version) pair across the full transitive closure is downloaded from the ecosystem registry and analyzed with scc. The total is the sum of measured LOC; packages that fail to download fall back to the median of successfully measured packages in the same ecosystem.
Statistical fallback: when deterministic measurements are not yet available for an ecosystem, a median LOC/package ratio is derived from the cloned repos (project LOC ÷ transitive package count) and applied to each project’s transitive count. This produces a range of ×0.5–×1 of the median as lower and upper bounds.
The dashboard uses the deterministic total where available and falls back to the statistical estimate per ecosystem. The badge on the transitive LOC segment reflects which method is in use: measured, ~ partial, or ~ estimated.
Cross-layer shared dependencies
Awaiting shared_deps_report.csv