alfred

Date
Run
. @ 7535f625253cc29aed17486e5eae229306459fb9
Rubric
witan-rubric-v17-2026-07-24
3.2/4.0 overall

Conditional

Code 3.1 · Process 3.3

code 5/5 · process 4/6 measured

Criterion profile

Measured scores are plotted on a 0–4 scale. Unknown and not-applicable dimensions remain explicit.

9 measured 0 no data 2 N/A

Code trust

A1Test integrity and regression signal
2.3
A2Data-layer isolation and secrets posture
4.0
A3Production readiness
3.6
A4Dependency hygiene
2.7
A5Claim-vs-reality reconciliation
3.0

Process trust

B1Internal process dimension
N/A
B2PR outcome traceability
4.0
B3CI and QA discipline
4.0
B4Audit trail and report-up completeness
3.9
B5Internal process dimension
N/A
B6Privileged-operation human gating
1.4

Code trust

A1

Test integrity and regression signal

dimension band: verified
2.3
  • Test-to-source file ratio504/846 ratio
  • Static coverage percentage0/100 percent
  • Verification script ratio4 ratio (capped; 6 raw)
  • Non-hollow test share497/504 ratio
  • Detected test file path withheld — private repository · sha256:4089241dc743
  • Detected test file path withheld — private repository · sha256:c69ab62efd1c
  • Detected test file path withheld — private repository · sha256:923de0fe9f61
  • Detected test file path withheld — private repository · sha256:8155ae18fdad
  • Detected test file path withheld — private repository · sha256:a2f2a4b5c7d5
  • Detected test file path withheld — private repository · sha256:8a44073a93d5
  • Detected test file path withheld — private repository · sha256:bf838e8a54ac
  • Detected test file path withheld — private repository · sha256:5423edb4ca38
  • Configured test runner path withheld — private repository · sha256:bb3758e12fb9
  • Configured test runner path withheld — private repository · sha256:6034215528e2
  • Configured test runner path withheld — private repository · sha256:6034215528e2
  • CI workflow runs the test suite path withheld — private repository · sha256:0c35d020b482
  • finding severity info: Test suite files are present, but no coverage configuration was detected. (Detected test file path withheld — private repository · sha256:4089241dc743)
A2

Data-layer isolation and secrets posture

dimension band: verified
4.0
  • Secret cleanliness1/1 clean
  • Environment handling depth3/3 practices
  • .env path detected in git history path withheld — private repository · sha256:7535f625253c
  • .env files are gitignored path withheld — private repository · sha256:8e464ca67fbf
  • Environment template path withheld — private repository · sha256:04442048a76f
  • Environment template path withheld — private repository · sha256:60cae38769ab
  • RLS or tenant migration path withheld — private repository · sha256:eafff306bfd6
A3

Production readiness

dimension band: verified
3.6
  • Production-readiness basic checks5/6 checks
  • Production workflow depth6 signals (capped; 39 raw)
  • Observability depth4 signals (capped; 63 raw)
  • Rollback and migration-safety depth4 signals (capped; 803 raw)
  • Build or typecheck script path withheld — private repository · sha256:6e1b2a1616e7
  • CI workflow path withheld — private repository · sha256:d90a520a3cf7
  • Release deploy configuration path withheld — private repository · sha256:eb4a78361685
  • Container build configuration path withheld — private repository · sha256:69daf8e18330
  • Environment template path withheld — private repository · sha256:04442048a76f
  • Error boundary path withheld — private repository · sha256:cca56c0018e5
A4

Dependency hygiene

dimension band: verified
2.7
  • Pinned dependency ratio64/214 ratio
  • Lockfile coverage1/1 present
  • Dependency automation ratio1/2 ratio
  • Dependency manifest path withheld — private repository · sha256:41c598eef759
  • Dependency lockfile path withheld — private repository · sha256:0290f23350c7
A5

Claim-vs-reality reconciliation

dimension band: info
3.0
  • Claim match rate12/20 ratio
  • Claim source depth4 docs (capped; 15 raw)
  • Reconciliation artifact depth2/3 artifacts
  • Repository claim source path withheld — private repository · sha256:e2bf98bc4697
  • Code presence for claim reconciliation path withheld — private repository · sha256:62f086165db3
  • Dedicated claim-reality reconciliation artifact path withheld — private repository · sha256:f28bdbe5970d
  • Dedicated claim-reality reconciliation artifact path withheld — private repository · sha256:e23d16fb7574

Process trust

B2

PR outcome traceability

dimension band: verified
4.0
  • PR trace basic checks2 signals (capped; 36 raw)
  • Recent PR merge ratio12/12 ratio
  • Pull-request CI workflow path withheld — private repository · sha256:d90a520a3cf7
  • Pull-request CI workflow path withheld — private repository · sha256:c879fd252e4d
  • Pull-request CI workflow path withheld — private repository · sha256:93839ac0380b
  • Review gate configuration path withheld — private repository · sha256:016304abf410
B3

CI and QA discipline

dimension band: verified
4.0
  • CI verification depth4 signals (capped; 5 raw)
  • PR-gate CI workflow count4 workflows (capped; 16 raw)
  • Test script path withheld — private repository · sha256:6e1b2a1616e7
  • Lint script path withheld — private repository · sha256:6e1b2a1616e7
  • CI workflow path withheld — private repository · sha256:d90a520a3cf7
B4

Audit trail and report-up completeness

dimension band: verified
3.9
  • Audit artifact depth3 files (capped; 87 raw)
  • Audit freshness depth78/87 ratio
  • Audit or changelog artifact path withheld — private repository · sha256:b71d90871d8b
  • Audit or changelog artifact path withheld — private repository · sha256:f7f031449857
  • Audit or changelog artifact path withheld — private repository · sha256:d14484199d1a
  • Audit or changelog artifact path withheld — private repository · sha256:ef234e3bb333
  • Audit or changelog artifact path withheld — private repository · sha256:160074df8986
B6

Privileged-operation human gating

dimension band: critical
1.4
  • Human gate documented1/1 present
  • Fail-closed privilege check present1/1 present
  • Privilege-escalation cleanliness0/1 clean
  • Protected-path review gate1/1 present
  • Un-overridable kill-switch present1/1 present
  • Documents privileged operations as human-executed/gated path withheld — private repository · sha256:9170f0e81c3d
  • Fail-closed privilege-membership check before role elevation path withheld — private repository · sha256:64df9a44b3e6
  • Un-overridable kill-switch / fail-safe governance toggle path withheld — private repository · sha256:1b7cb4b2b414
  • CODEOWNERS/required-review gate on protected paths path withheld — private repository · sha256:f7f031449857
  • finding severity critical: Role-membership GRANT or SUPERUSER escalation executes in code with no documented human gate. (Ungated privilege-escalation statement path withheld — private repository · sha256:c839412291f3)
  • finding severity critical: Role-membership GRANT or SUPERUSER escalation executes in code with no documented human gate. (Ungated privilege-escalation statement path withheld — private repository · sha256:8fdd968fd2ed)

Not applicable to this repository

  • B1 Internal process dimension — Substrate-specific: an internal process dimension is not applicable to external code.
  • B5 Internal process dimension — Substrate-specific: an internal process dimension is not applicable to external code.

Verified evidence

  • A1 - Test integrity and regression signalDetected test file path withheld — private repository · sha256:4089241dc743
  • A1 - Test integrity and regression signalDetected test file path withheld — private repository · sha256:c69ab62efd1c
  • A1 - Test integrity and regression signalDetected test file path withheld — private repository · sha256:923de0fe9f61
  • A1 - Test integrity and regression signalDetected test file path withheld — private repository · sha256:8155ae18fdad
  • A1 - Test integrity and regression signalDetected test file path withheld — private repository · sha256:a2f2a4b5c7d5
  • A1 - Test integrity and regression signalDetected test file path withheld — private repository · sha256:8a44073a93d5
  • A1 - Test integrity and regression signalDetected test file path withheld — private repository · sha256:bf838e8a54ac
  • A1 - Test integrity and regression signalDetected test file path withheld — private repository · sha256:5423edb4ca38
  • A1 - Test integrity and regression signalConfigured test runner path withheld — private repository · sha256:bb3758e12fb9
  • A1 - Test integrity and regression signalConfigured test runner path withheld — private repository · sha256:6034215528e2
  • A1 - Test integrity and regression signalConfigured test runner path withheld — private repository · sha256:6034215528e2
  • A1 - Test integrity and regression signalCI workflow runs the test suite path withheld — private repository · sha256:0c35d020b482
  • A2 - Data-layer isolation and secrets posture.env path detected in git history path withheld — private repository · sha256:7535f625253c
  • A2 - Data-layer isolation and secrets posture.env files are gitignored path withheld — private repository · sha256:8e464ca67fbf
  • A2 - Data-layer isolation and secrets postureEnvironment template path withheld — private repository · sha256:04442048a76f
  • A2 - Data-layer isolation and secrets postureEnvironment template path withheld — private repository · sha256:60cae38769ab
  • A2 - Data-layer isolation and secrets postureRLS or tenant migration path withheld — private repository · sha256:eafff306bfd6
  • A3 - Production readinessBuild or typecheck script path withheld — private repository · sha256:6e1b2a1616e7
  • A3 - Production readinessCI workflow path withheld — private repository · sha256:d90a520a3cf7
  • A3 - Production readinessRelease deploy configuration path withheld — private repository · sha256:eb4a78361685
  • A3 - Production readinessContainer build configuration path withheld — private repository · sha256:69daf8e18330
  • A3 - Production readinessEnvironment template path withheld — private repository · sha256:04442048a76f
  • A3 - Production readinessError boundary path withheld — private repository · sha256:cca56c0018e5
  • A4 - Dependency hygieneDependency manifest path withheld — private repository · sha256:41c598eef759
  • A4 - Dependency hygieneDependency lockfile path withheld — private repository · sha256:0290f23350c7
  • B2 - PR outcome traceabilityPull-request CI workflow path withheld — private repository · sha256:d90a520a3cf7
  • B2 - PR outcome traceabilityPull-request CI workflow path withheld — private repository · sha256:c879fd252e4d
  • B2 - PR outcome traceabilityPull-request CI workflow path withheld — private repository · sha256:93839ac0380b
  • B2 - PR outcome traceabilityReview gate configuration path withheld — private repository · sha256:016304abf410
  • B3 - CI and QA disciplineTest script path withheld — private repository · sha256:6e1b2a1616e7
  • B3 - CI and QA disciplineLint script path withheld — private repository · sha256:6e1b2a1616e7
  • B3 - CI and QA disciplineCI workflow path withheld — private repository · sha256:d90a520a3cf7
  • B4 - Audit trail and report-up completenessAudit or changelog artifact path withheld — private repository · sha256:b71d90871d8b
  • B4 - Audit trail and report-up completenessAudit or changelog artifact path withheld — private repository · sha256:f7f031449857
  • B4 - Audit trail and report-up completenessAudit or changelog artifact path withheld — private repository · sha256:d14484199d1a
  • B4 - Audit trail and report-up completenessAudit or changelog artifact path withheld — private repository · sha256:ef234e3bb333
  • B4 - Audit trail and report-up completenessAudit or changelog artifact path withheld — private repository · sha256:160074df8986

Open / unverified

  • B6 - Privileged-operation human gatingfinding severity critical: Role-membership GRANT or SUPERUSER escalation executes in code with no documented human gate. (Ungated privilege-escalation statement path withheld — private repository · sha256:c839412291f3)
  • B6 - Privileged-operation human gatingfinding severity critical: Role-membership GRANT or SUPERUSER escalation executes in code with no documented human gate. (Ungated privilege-escalation statement path withheld — private repository · sha256:8fdd968fd2ed)