alfred

Date
Run
. @ 95e05c337db0e43f3a59f5ab73fb73f7715326ef
Rubric
witan-rubric-v17-2026-07-24
3.2/4.0 overall

Conditional

Code 3.1 · Process 3.3

code 5/5 · process 4/6 measured

How to read this certificate

This certificate describes the repository tree at the pinned revision. Evidence outside that tree, including a test suite in another repository or CI checks in a different working directory, is neither seen by this scan nor claimed to be absent.

Produced by Cejel 0.4.9 under witan-rubric-v17-2026-07-24. Read the report JSON.

Rubric behaviour fingerprint: sha256:ff0f01abe8c12daa60375d0e18c1aca4a1135a55ab2a80b15f4c037bfc18b4b1. This identifies measured behaviour on the synthetic corpus; it is not a coverage claim.

Criterion profile

Measured scores are plotted on a 0–4 scale. Unknown and not-applicable dimensions remain explicit.

9 measured 0 no data 2 N/A

Code trust

A1Test integrity and regression signal
2.3
A2Data-layer isolation and secrets posture
4.0
A3Production readiness
3.6
A4Dependency hygiene
2.7
A5Claim-vs-reality reconciliation
3.0

Process trust

B1Internal process dimension
N/A
B2PR outcome traceability
4.0
B3CI and QA discipline
4.0
B4Audit trail and report-up completeness
3.9
B5Internal process dimension
N/A
B6Privileged-operation human gating
1.4

Code trust

A1

Test integrity and regression signal

dimension band: verified
2.3
  • Test-to-source file ratio533/870 ratio
  • Static coverage percentage0/100 percent
  • Verification script ratio4 ratio (capped; 6 raw)
  • Non-hollow test share526/533 ratio
  • Detected test file path withheld — private repository · sha256:4089241dc743
  • Detected test file path withheld — private repository · sha256:c69ab62efd1c
  • Detected test file path withheld — private repository · sha256:923de0fe9f61
  • Detected test file path withheld — private repository · sha256:8155ae18fdad
  • Detected test file path withheld — private repository · sha256:a2f2a4b5c7d5
  • Detected test file path withheld — private repository · sha256:8a44073a93d5
  • Detected test file path withheld — private repository · sha256:bf838e8a54ac
  • Detected test file path withheld — private repository · sha256:5423edb4ca38
  • Configured test runner path withheld — private repository · sha256:bb3758e12fb9
  • Configured test runner path withheld — private repository · sha256:6034215528e2
  • Configured test runner path withheld — private repository · sha256:6034215528e2
  • CI workflow runs the test suite path withheld — private repository · sha256:2e453a2e1114
  • finding severity info: Test suite files are present, but the tracked scan-eligible inventory matched no coverage configuration. (Detected test file path withheld — private repository · sha256:4089241dc743)
A2

Data-layer isolation and secrets posture

dimension band: verified
4.0
  • Secret cleanliness1/1 clean
  • Environment handling depth3/3 practices
  • .env path detected in git history path withheld — private repository · sha256:95e05c337db0
  • .env files are gitignored path withheld — private repository · sha256:8e464ca67fbf
  • Environment template path withheld — private repository · sha256:04442048a76f
  • Environment template path withheld — private repository · sha256:60cae38769ab
  • RLS or tenant migration path withheld — private repository · sha256:eafff306bfd6
A3

Production readiness

dimension band: verified
3.6
  • Production-readiness basic checks5/6 checks
  • Production workflow depth6 signals (capped; 39 raw)
  • Observability depth4 signals (capped; 73 raw)
  • Rollback and migration-safety depth4 signals (capped; 753 raw)
  • Build or typecheck script path withheld — private repository · sha256:eb68ecd5442b
  • CI workflow path withheld — private repository · sha256:d90a520a3cf7
  • Release deploy configuration path withheld — private repository · sha256:eb4a78361685
  • Container build configuration path withheld — private repository · sha256:69daf8e18330
  • Environment template path withheld — private repository · sha256:04442048a76f
  • Error boundary path withheld — private repository · sha256:cca56c0018e5
A4

Dependency hygiene

dimension band: verified
2.7
  • Pinned dependency ratio65/215 ratio
  • Lockfile coverage1/1 present
  • Dependency automation ratio1/2 ratio
  • Dependency manifest path withheld — private repository · sha256:41c598eef759
  • Dependency lockfile path withheld — private repository · sha256:c9fb0c301fda
A5

Claim-vs-reality reconciliation

dimension band: info
3.0
  • Claim match rate12/20 ratio
  • Claim source depth4 docs (capped; 15 raw)
  • Reconciliation artifact depth2/3 artifacts
  • Repository claim source path withheld — private repository · sha256:e2bf98bc4697
  • Code presence for claim reconciliation path withheld — private repository · sha256:62f086165db3
  • Dedicated claim-reality reconciliation artifact path withheld — private repository · sha256:f28bdbe5970d
  • Dedicated claim-reality reconciliation artifact path withheld — private repository · sha256:e23d16fb7574

Process trust

B2

PR outcome traceability

dimension band: verified
4.0
  • PR trace basic checks2 signals (capped; 36 raw)
  • Recent PR merge ratio12/12 ratio
  • Pull-request CI workflow path withheld — private repository · sha256:d90a520a3cf7
  • Pull-request CI workflow path withheld — private repository · sha256:c879fd252e4d
  • Pull-request CI workflow path withheld — private repository · sha256:93839ac0380b
  • Review gate configuration path withheld — private repository · sha256:016304abf410
B3

CI and QA discipline

dimension band: verified
4.0
  • CI verification depth4/4 signals
  • PR-gate CI workflow count4 workflows (capped; 16 raw)
  • Test script path withheld — private repository · sha256:eb68ecd5442b
  • Lint script path withheld — private repository · sha256:eb68ecd5442b
  • CI workflow path withheld — private repository · sha256:d90a520a3cf7
B4

Audit trail and report-up completeness

dimension band: verified
3.9
  • Audit artifact depth3 files (capped; 88 raw)
  • Audit freshness depth79/88 ratio
  • Audit or changelog artifact path withheld — private repository · sha256:b71d90871d8b
  • Audit or changelog artifact path withheld — private repository · sha256:f912c3add212
  • Audit or changelog artifact path withheld — private repository · sha256:d14484199d1a
  • Audit or changelog artifact path withheld — private repository · sha256:ef234e3bb333
  • Audit or changelog artifact path withheld — private repository · sha256:160074df8986
B6

Privileged-operation human gating

dimension band: critical
1.4
  • Human gate documented1/1 present
  • Fail-closed privilege check present1/1 present
  • Privilege-escalation cleanliness0/1 clean
  • Protected-path review gate1/1 present
  • Un-overridable kill-switch present1/1 present
  • Documents privileged operations as human-executed/gated path withheld — private repository · sha256:3f4d0fdcc8d8
  • Fail-closed privilege-membership check before role elevation path withheld — private repository · sha256:1ecd734f68d0
  • Un-overridable kill-switch / fail-safe governance toggle path withheld — private repository · sha256:1b7cb4b2b414
  • CODEOWNERS/required-review gate on protected paths path withheld — private repository · sha256:f912c3add212
  • finding severity critical: This file executes a role-membership GRANT or SUPERUSER escalation and does not itself contain text matching the human-gate marker pattern. (Ungated privilege-escalation statement path withheld — private repository · sha256:c839412291f3)
  • finding severity critical: This file executes a role-membership GRANT or SUPERUSER escalation and does not itself contain text matching the human-gate marker pattern. (Ungated privilege-escalation statement path withheld — private repository · sha256:8fdd968fd2ed)

Not applicable to this repository

  • B1 Internal process dimension — Substrate-specific: an internal process dimension is not applicable to external code.
  • B5 Internal process dimension — Substrate-specific: an internal process dimension is not applicable to external code.

Verified evidence

  • A1 - Test integrity and regression signalDetected test file path withheld — private repository · sha256:4089241dc743
  • A1 - Test integrity and regression signalDetected test file path withheld — private repository · sha256:c69ab62efd1c
  • A1 - Test integrity and regression signalDetected test file path withheld — private repository · sha256:923de0fe9f61
  • A1 - Test integrity and regression signalDetected test file path withheld — private repository · sha256:8155ae18fdad
  • A1 - Test integrity and regression signalDetected test file path withheld — private repository · sha256:a2f2a4b5c7d5
  • A1 - Test integrity and regression signalDetected test file path withheld — private repository · sha256:8a44073a93d5
  • A1 - Test integrity and regression signalDetected test file path withheld — private repository · sha256:bf838e8a54ac
  • A1 - Test integrity and regression signalDetected test file path withheld — private repository · sha256:5423edb4ca38
  • A1 - Test integrity and regression signalConfigured test runner path withheld — private repository · sha256:bb3758e12fb9
  • A1 - Test integrity and regression signalConfigured test runner path withheld — private repository · sha256:6034215528e2
  • A1 - Test integrity and regression signalConfigured test runner path withheld — private repository · sha256:6034215528e2
  • A1 - Test integrity and regression signalCI workflow runs the test suite path withheld — private repository · sha256:2e453a2e1114
  • A2 - Data-layer isolation and secrets posture.env path detected in git history path withheld — private repository · sha256:95e05c337db0
  • A2 - Data-layer isolation and secrets posture.env files are gitignored path withheld — private repository · sha256:8e464ca67fbf
  • A2 - Data-layer isolation and secrets postureEnvironment template path withheld — private repository · sha256:04442048a76f
  • A2 - Data-layer isolation and secrets postureEnvironment template path withheld — private repository · sha256:60cae38769ab
  • A2 - Data-layer isolation and secrets postureRLS or tenant migration path withheld — private repository · sha256:eafff306bfd6
  • A3 - Production readinessBuild or typecheck script path withheld — private repository · sha256:eb68ecd5442b
  • A3 - Production readinessCI workflow path withheld — private repository · sha256:d90a520a3cf7
  • A3 - Production readinessRelease deploy configuration path withheld — private repository · sha256:eb4a78361685
  • A3 - Production readinessContainer build configuration path withheld — private repository · sha256:69daf8e18330
  • A3 - Production readinessEnvironment template path withheld — private repository · sha256:04442048a76f
  • A3 - Production readinessError boundary path withheld — private repository · sha256:cca56c0018e5
  • A4 - Dependency hygieneDependency manifest path withheld — private repository · sha256:41c598eef759
  • A4 - Dependency hygieneDependency lockfile path withheld — private repository · sha256:c9fb0c301fda
  • B2 - PR outcome traceabilityPull-request CI workflow path withheld — private repository · sha256:d90a520a3cf7
  • B2 - PR outcome traceabilityPull-request CI workflow path withheld — private repository · sha256:c879fd252e4d
  • B2 - PR outcome traceabilityPull-request CI workflow path withheld — private repository · sha256:93839ac0380b
  • B2 - PR outcome traceabilityReview gate configuration path withheld — private repository · sha256:016304abf410
  • B3 - CI and QA disciplineTest script path withheld — private repository · sha256:eb68ecd5442b
  • B3 - CI and QA disciplineLint script path withheld — private repository · sha256:eb68ecd5442b
  • B3 - CI and QA disciplineCI workflow path withheld — private repository · sha256:d90a520a3cf7
  • B4 - Audit trail and report-up completenessAudit or changelog artifact path withheld — private repository · sha256:b71d90871d8b
  • B4 - Audit trail and report-up completenessAudit or changelog artifact path withheld — private repository · sha256:f912c3add212
  • B4 - Audit trail and report-up completenessAudit or changelog artifact path withheld — private repository · sha256:d14484199d1a
  • B4 - Audit trail and report-up completenessAudit or changelog artifact path withheld — private repository · sha256:ef234e3bb333
  • B4 - Audit trail and report-up completenessAudit or changelog artifact path withheld — private repository · sha256:160074df8986

Open / unverified

  • B6 - Privileged-operation human gatingfinding severity critical: This file executes a role-membership GRANT or SUPERUSER escalation and does not itself contain text matching the human-gate marker pattern. (Ungated privilege-escalation statement path withheld — private repository · sha256:c839412291f3)
  • B6 - Privileged-operation human gatingfinding severity critical: This file executes a role-membership GRANT or SUPERUSER escalation and does not itself contain text matching the human-gate marker pattern. (Ungated privilege-escalation statement path withheld — private repository · sha256:8fdd968fd2ed)