#16 Cursor · Grok 4.5 (Multi-Model Sub-Agents)

Quality

2026-07-18-cursor-grok-4-5 · Cursor

Orchestrator Tool Calls

187

9 unique tools

Sub-agent Tool Calls

704

ApplyPatch / Read / Write

Sub-agents

5

model-pinned Task agents

Estimated Cost

$41.10

84.0M tokens

Tool Usage per Sub-agent

5 agents
Storefront Livewire UI · claude-sonnet-5
307
Phase 3-5 Services · gpt-5.6-sol
189
Admin Panel UI · gpt-5.6-sol
114
Demo Seeders · gpt-5.6-sol
93
Phase 1-2 Schema & Models · gpt-5.6-sol (Codex bg task)
1

Code Quality Assessment

PHPMetrics

Code Quality Assessment

PHPMetrics 2.9.1

Classes

155

Lines of Code

4.4K

Avg MI

79.9

Avg Complexity

3.6

Est. Bugs

11.2

max 0.7 in Show

Violations

0

0 errors, 0 warnings

Complexity Distribution

Low (CCN <= 5)
125 (80.6%)
Medium (6-10)
15 (9.7%)
High (> 10)
15 (9.7%)

Maintainability Distribution

Excellent (>= 85)
40 (25.8%)
Good (70-84)
42 (27.1%)
Moderate (55-69)
50 (32.3%)
Low (< 55)
23 (14.8%)

Most Complex Classes

DiscountService

App\Services

CCN 27

Show

App\Livewire\Storefront\Checkout

CCN 26

ProductService

App\Services

CCN 23

RefundService

App\Services

CCN 21

ShippingCalculator

App\Services

CCN 20

Least Maintainable

OrderService

CCN 18 · 59 LOC

PricingEngine

CCN 17 · 53 LOC

CartService

CCN 17 · 93 LOC

SearchService

CCN 6 · 46 LOC

ResolveStore

CCN 8 · 49 LOC

Most Coupled Classes

Order

19

Store

18

User

18

CheckoutService

17

Product

16

Max Efferent

15

Max LCOM

5

Notes

  • •PHPMetrics flags 0 rule violations across 155 classes, with a healthy average MI of 79.9 - the class-level metrics are clean and low-complexity.
  • •SonarCloud tells a different story: 68 unresolved issues on PR #26 (10 critical, 52 major, 6 minor) = 3 bugs, 7 vulnerabilities, and 58 code smells. The quality gate FAILED on new-code reliability (C) and security (C).
  • •All 7 vulnerabilities are the same rule (php:S2245) - a non-cryptographic pseudorandom generator used where secure randomness is expected - which alone produces the C security rating. Separately, QA found a runtime information disclosure: a handle-collision on admin page-create throws an unhandled exception rendered as a raw Laravel debug page, leaking the stack trace, SQL, and session cookies.
  • •4.4K class-LOC (9.0K ncloc) across 155 classes - one of the leanest codebases on this spec, built in 71 minutes by a Grok orchestrator plus GPT-5.6-sol and Claude Sonnet 5 sub-agents.

SonarCloud Analysis

PR #26 - Quality Gate Failed
FAIL

Quality Gate: Failed

PR #26 · 2026-07-18-cursor-grok-4-5 → main

5.8h technical debt

68 issues total

View on SonarCloud ↗

Quality Gate Conditions

Reliability on New Code
C> 1
Security on New Code
C> 1
Maintainability on New Code
A> 1
Duplicated Lines on New Code
0.4%> 3.0%
Security Hotspots Reviewed
100.0%< 100%

Bugs

3

C

Reliability

Vulnerabilities

7

C

Security

Code Smells

58

A

Maintainability

Hotspots

0

100% reviewed

Lines of Code

9.0K

PHP

Duplication

0.6%

of all code

Coverage

0%

not configured

Issues by Severity

Critical
10
Major
52
Minor
6
Total68

Issues by Type

Code Smells
58 (85.3%)
Bugs
3 (4.4%)
Vulnerabilities
7 (10.3%)
Security Hotspots
0 (0.0%)
50 bugs (mostly minor logic-flow findings, not confirmed defects) and 1 vulnerability drag Reliability and Security down to C; Maintainability holds at A across 139 smells over 18.9K NCLOC.

Top Issue Rules

Unused function parameters should be removedphp:S1172
29
MAJOR
String literals should not be duplicatedphp:S1192
8
CRITICAL
Using pseudorandom number generators (PRNGs) is security-sensitivephp:S2245
7
MAJOR
Files should contain an empty newline at the endphp:S113
5
MINOR
Landmarks should be used to improve accessibilityWeb:S6819
4
MAJOR
Ternary operators should not be nestedphp:S3358
4
MAJOR
Cognitive Complexity of functions should not be too highphp:S3776
2
CRITICAL
Image tags should have an alt attributeWeb:S6851
2
MAJOR
Inputs should be associated with a labelWeb:InputWithoutLabelCheck
2
MAJOR
Pages should have a titleWeb:PageWithoutTitleCheck
1
MAJOR

Quality gate failed on two of five conditions: Reliability (C) and Security (C) on new code. Duplication (0.7%) and hotspot review (100%) both pass comfortably. The single biggest rule is missing table header id/scope attributes (39 hits) across admin data tables, followed by cognitive-complexity warnings concentrated almost entirely in one class, App\Services\ProductService (CCN 107) - the same class PHPMetrics independently flags as the codebase's worst offender.