{
  "productSlug": "alfred",
  "productDisplayName": "alfred",
  "repo": {
    "headSha": "7535f625253cc29aed17486e5eae229306459fb9",
    "path": "."
  },
  "rubricVersion": "witan-rubric-v17-2026-07-24",
  "criteria": [
    {
      "id": "A1",
      "title": "Test integrity and regression signal",
      "category": "code_trust",
      "score": 2.3,
      "status": "verified",
      "evidence": [
        {
          "kind": "test_run",
          "label": "Detected test file",
          "contentHash": "4089241dc743a3d9f345ed6302c33e04813459d0fb464bf76f522fbed07c2c39",
          "locationWithheld": "path withheld — private repository"
        },
        {
          "kind": "test_run",
          "label": "Detected test file",
          "contentHash": "c69ab62efd1c11758edbb44d42d156bb4c445bba40f3e2dad4bba446e9d2648c",
          "locationWithheld": "path withheld — private repository"
        },
        {
          "kind": "test_run",
          "label": "Detected test file",
          "contentHash": "923de0fe9f616bf16f6153dc2a52247c297f424d937db45380c7b7e94f4bf955",
          "locationWithheld": "path withheld — private repository"
        },
        {
          "kind": "test_run",
          "label": "Detected test file",
          "contentHash": "8155ae18fdad53ae1c17bbfb73cf3e762b32ca966c01eee5f34ac9f47620873a",
          "locationWithheld": "path withheld — private repository"
        },
        {
          "kind": "test_run",
          "label": "Detected test file",
          "contentHash": "a2f2a4b5c7d5a4673bb9f04f63db012d83e0370c5b22156a8738cff8ac7c8d23",
          "locationWithheld": "path withheld — private repository"
        },
        {
          "kind": "test_run",
          "label": "Detected test file",
          "contentHash": "8a44073a93d59be6395017053c6e881168953514bcc50d60f707ffced7ee4393",
          "locationWithheld": "path withheld — private repository"
        },
        {
          "kind": "test_run",
          "label": "Detected test file",
          "contentHash": "bf838e8a54ac23a2df309fc79edeb91277b9a895cd3a1e9fa390e6cdf3323d83",
          "locationWithheld": "path withheld — private repository"
        },
        {
          "kind": "test_run",
          "label": "Detected test file",
          "contentHash": "5423edb4ca389b8b99382380dbd532c5d1c41b093115d35a1f88fc916b5ee80b",
          "locationWithheld": "path withheld — private repository"
        },
        {
          "kind": "test_run",
          "label": "Configured test runner",
          "contentHash": "bb3758e12fb93aafbe9147d907591b2f4d5385fd68213df5ed117228e71b1fb6",
          "locationWithheld": "path withheld — private repository"
        },
        {
          "kind": "test_run",
          "label": "Configured test runner",
          "contentHash": "6034215528e24fafa31f671553506a4f62570408f72f9434387f11b071c32edf",
          "locationWithheld": "path withheld — private repository"
        },
        {
          "kind": "test_run",
          "label": "Configured test runner",
          "contentHash": "6034215528e24fafa31f671553506a4f62570408f72f9434387f11b071c32edf",
          "locationWithheld": "path withheld — private repository"
        },
        {
          "kind": "test_run",
          "label": "CI workflow runs the test suite",
          "contentHash": "0c35d020b482d30373cbd9c05493d42e4c2d3cc2104aa9bb036f60aee666dac8",
          "locationWithheld": "path withheld — private repository"
        }
      ],
      "findings": [
        {
          "severity": "info",
          "summary": "Test suite files are present, but no coverage configuration was detected.",
          "evidence": {
            "kind": "test_run",
            "label": "Detected test file",
            "contentHash": "4089241dc743a3d9f345ed6302c33e04813459d0fb464bf76f522fbed07c2c39",
            "locationWithheld": "path withheld — private repository"
          }
        }
      ],
      "metrics": [
        {
          "name": "test_to_source_ratio",
          "label": "Test-to-source file ratio",
          "value": 504,
          "max": 846,
          "kind": "saturating_count",
          "weight": 0.3,
          "unit": "ratio",
          "description": "Measures how much concrete test surface exists relative to implementation surface."
        },
        {
          "name": "coverage_percent",
          "label": "Static coverage percentage",
          "value": 0,
          "max": 100,
          "weight": 0.3,
          "unit": "percent",
          "description": "Uses a static coverage report value or configured threshold when present, without running tests."
        },
        {
          "name": "verification_script_ratio",
          "label": "Verification script ratio",
          "value": 6,
          "max": 4,
          "kind": "saturating_count",
          "weight": 0.25,
          "unit": "ratio",
          "description": "Measures explicit test/lint/typecheck verification commands (via npm script or CI-invoked tool) plus test runner configuration."
        },
        {
          "name": "non_hollow_test_share",
          "label": "Non-hollow test share",
          "value": 497,
          "max": 504,
          "weight": 0.15,
          "unit": "ratio",
          "description": "Penalizes skipped or placeholder-only test files; test-directory support scaffolding (helpers/fixtures with no test in them) is excluded from the denominator."
        }
      ],
      "notes": "A1 is detected from real test files, test runner configuration, and optional coverage configuration."
    },
    {
      "id": "A2",
      "title": "Data-layer isolation and secrets posture",
      "category": "code_trust",
      "score": 4,
      "status": "verified",
      "evidence": [
        {
          "kind": "secret_scan",
          "label": ".env path detected in git history",
          "contentHash": "7535f625253cc29aed17486e5eae229306459fb9",
          "locationWithheld": "path withheld — private repository"
        },
        {
          "kind": "secret_scan",
          "label": ".env files are gitignored",
          "contentHash": "8e464ca67fbf18bb57383c0f415ad100624e0af0bea48ad2faf6b5bd55de7df2",
          "locationWithheld": "path withheld — private repository"
        },
        {
          "kind": "secret_scan",
          "label": "Environment template",
          "contentHash": "04442048a76f611935b196c87c3ed4f1dcb7e219025409ca82ac337ad88b15b0",
          "locationWithheld": "path withheld — private repository"
        },
        {
          "kind": "secret_scan",
          "label": "Environment template",
          "contentHash": "60cae38769abcdb3c4b2fed6e62d77db21494b151981a03c6a82b7ae1eaac5a6",
          "locationWithheld": "path withheld — private repository"
        },
        {
          "kind": "artifact",
          "label": "RLS or tenant migration",
          "contentHash": "eafff306bfd620bccb9cf616d3cb87160b1142ea5a2e70513d26bb350e6d1e25",
          "locationWithheld": "path withheld — private repository"
        }
      ],
      "findings": [],
      "metrics": [
        {
          "name": "secret_cleanliness",
          "label": "Secret cleanliness",
          "value": 1,
          "max": 1,
          "weight": 0.7,
          "unit": "clean",
          "description": "Credits absence of committed or recent-history secret findings in the static scan."
        },
        {
          "name": "env_handling_depth",
          "label": "Environment handling depth",
          "value": 3,
          "max": 3,
          "weight": 0.3,
          "unit": "practices",
          "description": "Counts three bounded env-handling practices (0–3): template file, gitignore rule, env reads in any supported language."
        }
      ],
      "notes": "History secret scanning covers all reachable git history for credential-pattern paths unless the explicit credential-blob safety valve is reported."
    },
    {
      "id": "A3",
      "title": "Production readiness",
      "category": "code_trust",
      "score": 3.6,
      "status": "verified",
      "evidence": [
        {
          "kind": "prod_check",
          "label": "Build or typecheck script",
          "contentHash": "6e1b2a1616e745e616cf011978375dc695569c8da06be1c721ad157fde04dc52",
          "locationWithheld": "path withheld — private repository"
        },
        {
          "kind": "ci_run",
          "label": "CI workflow",
          "contentHash": "d90a520a3cf7949e9209cc0da6b3d64b64c7bd70ba26dc9e8541996a1bd75265",
          "locationWithheld": "path withheld — private repository"
        },
        {
          "kind": "prod_check",
          "label": "Release deploy configuration",
          "contentHash": "eb4a783616859a1892cc47ffd5a1f4c09c626eb89a82e52a6ccb20fe99ca1346",
          "locationWithheld": "path withheld — private repository"
        },
        {
          "kind": "prod_check",
          "label": "Container build configuration",
          "contentHash": "69daf8e18330d775d91902b7eb99072684595b834f009d3c0fffcc53992dbf63",
          "locationWithheld": "path withheld — private repository"
        },
        {
          "kind": "prod_check",
          "label": "Environment template",
          "contentHash": "04442048a76f611935b196c87c3ed4f1dcb7e219025409ca82ac337ad88b15b0",
          "locationWithheld": "path withheld — private repository"
        },
        {
          "kind": "prod_check",
          "label": "Error boundary",
          "contentHash": "cca56c0018e5427ff172d22cad41e2cf0e7f9819b2b7147e11db96d44041bd2f",
          "locationWithheld": "path withheld — private repository"
        }
      ],
      "findings": [],
      "metrics": [
        {
          "name": "prod_readiness_primitives",
          "label": "Production-readiness basic checks",
          "value": 5,
          "max": 6,
          "weight": 0.55,
          "unit": "checks",
          "description": "Counts distinct static production-readiness checks instead of treating presence as enough."
        },
        {
          "name": "prod_workflow_depth",
          "label": "Production workflow depth",
          "value": 39,
          "max": 6,
          "kind": "saturating_count",
          "weight": 0.2,
          "unit": "signals",
          "description": "Measures CI/deploy configuration depth instead of a single CI-present bit."
        },
        {
          "name": "observability_depth",
          "label": "Observability depth",
          "value": 63,
          "max": 4,
          "kind": "saturating_count",
          "weight": 0.1,
          "unit": "signals",
          "description": "Counts static observability/logging/metrics implementation signals."
        },
        {
          "name": "rollback_safety_depth",
          "label": "Rollback and migration-safety depth",
          "value": 803,
          "max": 4,
          "kind": "saturating_count",
          "weight": 0.15,
          "unit": "signals",
          "description": "Counts static rollback or migration-safety artifacts."
        }
      ]
    },
    {
      "id": "A4",
      "title": "Dependency hygiene",
      "category": "code_trust",
      "score": 2.7,
      "status": "verified",
      "evidence": [
        {
          "kind": "dependency_report",
          "label": "Dependency manifest",
          "contentHash": "41c598eef75986af4828a8eecedd7c4406ca037dfff11194dd051d80c3fc1be0",
          "locationWithheld": "path withheld — private repository"
        },
        {
          "kind": "dependency_report",
          "label": "Dependency lockfile",
          "contentHash": "0290f23350c796ba95c67be219a9abf60596355feb5b467f55e5f3cf56e61f4f",
          "locationWithheld": "path withheld — private repository"
        }
      ],
      "findings": [],
      "metrics": [
        {
          "name": "pinned_dependency_ratio",
          "label": "Pinned dependency ratio",
          "value": 64,
          "max": 214,
          "weight": 0.3,
          "unit": "ratio",
          "description": "Measures exact/static dependency versions in manifests; lower weight because a lockfile is the primary reproducibility guarantee."
        },
        {
          "name": "lockfile_coverage",
          "label": "Lockfile coverage",
          "value": 1,
          "max": 1,
          "weight": 0.45,
          "unit": "present",
          "description": "Credits presence of at least one lockfile; one root lockfile covering a monorepo is sufficient."
        },
        {
          "name": "dependency_automation_ratio",
          "label": "Dependency automation ratio",
          "value": 1,
          "max": 2,
          "weight": 0.25,
          "unit": "ratio",
          "description": "Credits automated dependency updates and package-manager audit hooks."
        }
      ],
      "notes": "A4 scored against app/service norms (deploy surface detected): pinned dependencies and a lockfile are required for reproducible installs."
    },
    {
      "id": "A5",
      "title": "Claim-vs-reality reconciliation",
      "category": "code_trust",
      "score": 3,
      "status": "info",
      "evidence": [
        {
          "kind": "claim_reconciliation",
          "label": "Repository claim source",
          "contentHash": "e2bf98bc4697575ad62e3ce5831c216cc21011542fcd81db46c2655499ffcb3c",
          "locationWithheld": "path withheld — private repository"
        },
        {
          "kind": "artifact",
          "label": "Code presence for claim reconciliation",
          "contentHash": "62f086165db38cc3fe59c74cfed803d3f1d73b5a406a37904f7888682c7a46e3",
          "locationWithheld": "path withheld — private repository"
        },
        {
          "kind": "claim_reconciliation",
          "label": "Dedicated claim-reality reconciliation artifact",
          "contentHash": "f28bdbe5970d92d1d12582ec2e7ebf7dd62601e4c18b7969a53e49458f92b3fc",
          "locationWithheld": "path withheld — private repository"
        },
        {
          "kind": "claim_reconciliation",
          "label": "Dedicated claim-reality reconciliation artifact",
          "contentHash": "e23d16fb7574bb11b853f79e437040cfe9c89843678e7eb1fa3f87e240744350",
          "locationWithheld": "path withheld — private repository"
        }
      ],
      "findings": [],
      "metrics": [
        {
          "name": "claim_match_rate",
          "label": "Claim match rate",
          "value": 12,
          "max": 20,
          "weight": 0.5,
          "unit": "ratio",
          "description": "Uses bounded implementation-to-claim-source depth as a static proxy when no dedicated artifact exists."
        },
        {
          "name": "claim_source_depth",
          "label": "Claim source depth",
          "value": 15,
          "max": 4,
          "kind": "saturating_count",
          "weight": 0.35,
          "unit": "docs",
          "description": "Credits multiple claim-bearing documents without judging unverified prose as truth."
        },
        {
          "name": "reconciliation_artifact_depth",
          "label": "Reconciliation artifact depth",
          "value": 2,
          "max": 3,
          "weight": 0.15,
          "unit": "artifacts",
          "description": "Requires a specific claim-reality artifact to reach full depth."
        }
      ]
    },
    {
      "id": "B1",
      "title": "Internal process dimension",
      "category": "process_trust",
      "score": 0,
      "status": "not_applicable",
      "evidence": [],
      "findings": [],
      "metrics": [],
      "notes": "Substrate-specific: an internal process dimension is not applicable to external code."
    },
    {
      "id": "B2",
      "title": "PR outcome traceability",
      "category": "process_trust",
      "score": 4,
      "status": "verified",
      "evidence": [
        {
          "kind": "ci_run",
          "label": "Pull-request CI workflow",
          "contentHash": "d90a520a3cf7949e9209cc0da6b3d64b64c7bd70ba26dc9e8541996a1bd75265",
          "locationWithheld": "path withheld — private repository"
        },
        {
          "kind": "ci_run",
          "label": "Pull-request CI workflow",
          "contentHash": "c879fd252e4d7e5cc04022066edf4e261c72c6f383d154f8ad816302f249c438",
          "locationWithheld": "path withheld — private repository"
        },
        {
          "kind": "ci_run",
          "label": "Pull-request CI workflow",
          "contentHash": "93839ac0380b345ca102fbe707f24c4a58d4844f2bc0ed553b1c3a7e36932ea5",
          "locationWithheld": "path withheld — private repository"
        },
        {
          "kind": "pull_request",
          "label": "Review gate configuration",
          "contentHash": "016304abf4108d9814c779660e88f6019e84933a208f7f9eb06b08662f544ea3",
          "locationWithheld": "path withheld — private repository"
        }
      ],
      "findings": [],
      "metrics": [
        {
          "name": "pr_trace_primitives",
          "label": "PR trace basic checks",
          "value": 36,
          "max": 2,
          "kind": "saturating_count",
          "weight": 0.8,
          "unit": "signals",
          "description": "Measures CI, PR template, and review-gate evidence for pull-request traceability."
        },
        {
          "name": "pr_merge_ratio",
          "label": "Recent PR merge ratio",
          "value": 12,
          "max": 12,
          "weight": 0.2,
          "unit": "ratio",
          "description": "Uses bounded git history as a deterministic proxy for PR outcome traceability."
        }
      ]
    },
    {
      "id": "B3",
      "title": "CI and QA discipline",
      "category": "process_trust",
      "score": 4,
      "status": "verified",
      "evidence": [
        {
          "kind": "test_run",
          "label": "Test script",
          "contentHash": "6e1b2a1616e745e616cf011978375dc695569c8da06be1c721ad157fde04dc52",
          "locationWithheld": "path withheld — private repository"
        },
        {
          "kind": "ci_run",
          "label": "Lint script",
          "contentHash": "6e1b2a1616e745e616cf011978375dc695569c8da06be1c721ad157fde04dc52",
          "locationWithheld": "path withheld — private repository"
        },
        {
          "kind": "ci_run",
          "label": "CI workflow",
          "contentHash": "d90a520a3cf7949e9209cc0da6b3d64b64c7bd70ba26dc9e8541996a1bd75265",
          "locationWithheld": "path withheld — private repository"
        }
      ],
      "findings": [],
      "metrics": [
        {
          "name": "ci_script_depth",
          "label": "CI verification depth",
          "value": 5,
          "max": 4,
          "kind": "saturating_count",
          "weight": 0.45,
          "unit": "signals",
          "description": "Counts npm verification scripts plus distinct test/lint/typecheck/build command categories detected anywhere in CI workflows; language-agnostic, counted by category not by file."
        },
        {
          "name": "default_branch_ci_depth",
          "label": "PR-gate CI workflow count",
          "value": 16,
          "max": 4,
          "kind": "saturating_count",
          "weight": 0.55,
          "unit": "workflows",
          "description": "Counts CI workflows that target pull requests or the default branch, up to 4."
        }
      ]
    },
    {
      "id": "B4",
      "title": "Audit trail and report-up completeness",
      "category": "process_trust",
      "score": 3.9,
      "status": "verified",
      "evidence": [
        {
          "kind": "audit_log",
          "label": "Audit or changelog artifact",
          "contentHash": "b71d90871d8b05fb68c5ce0d2d43816ace6465dfcd81762f867618a2b77acf36",
          "locationWithheld": "path withheld — private repository"
        },
        {
          "kind": "audit_log",
          "label": "Audit or changelog artifact",
          "contentHash": "f7f031449857f49a85ed60fcc08f3e0237de6291eb98afc58b7230ac5675a1e5",
          "locationWithheld": "path withheld — private repository"
        },
        {
          "kind": "audit_log",
          "label": "Audit or changelog artifact",
          "contentHash": "d14484199d1a46f45539491a709c0b46e96e315fc336f30a598e0e5951410a15",
          "locationWithheld": "path withheld — private repository"
        },
        {
          "kind": "audit_log",
          "label": "Audit or changelog artifact",
          "contentHash": "ef234e3bb33359ac7b1f4a454351d29f951cfcc7f839005973bd5779bb1cee38",
          "locationWithheld": "path withheld — private repository"
        },
        {
          "kind": "audit_log",
          "label": "Audit or changelog artifact",
          "contentHash": "160074df8986737ba220061685dc5194c10bacdcd76435779e2b2cbb2ca8cf99",
          "locationWithheld": "path withheld — private repository"
        }
      ],
      "findings": [],
      "metrics": [
        {
          "name": "audit_artifact_depth",
          "label": "Audit artifact depth",
          "value": 87,
          "max": 3,
          "kind": "saturating_count",
          "weight": 0.8,
          "unit": "files",
          "description": "Measures quantity of audit, security, runbook, incident, status, and changelog artifacts."
        },
        {
          "name": "audit_freshness_depth",
          "label": "Audit freshness depth",
          "value": 78,
          "max": 87,
          "weight": 0.2,
          "unit": "ratio",
          "description": "Credits audit artifacts that carry freshness/current-state markers."
        }
      ]
    },
    {
      "id": "B5",
      "title": "Internal process dimension",
      "category": "process_trust",
      "score": 0,
      "status": "not_applicable",
      "evidence": [],
      "findings": [],
      "metrics": [],
      "notes": "Substrate-specific: an internal process dimension is not applicable to external code."
    },
    {
      "id": "B6",
      "title": "Privileged-operation human gating",
      "category": "process_trust",
      "score": 1.4,
      "status": "critical",
      "evidence": [
        {
          "kind": "artifact",
          "label": "Documents privileged operations as human-executed/gated",
          "contentHash": "9170f0e81c3d404e0cbcda098b9d5f19e3816aa87da8945e26eef21f2f4fe981",
          "locationWithheld": "path withheld — private repository"
        },
        {
          "kind": "artifact",
          "label": "Fail-closed privilege-membership check before role elevation",
          "contentHash": "64df9a44b3e6aac70866d681298fa3310bb9385be37b62b2fad2aa3500ed5007",
          "locationWithheld": "path withheld — private repository"
        },
        {
          "kind": "artifact",
          "label": "Un-overridable kill-switch / fail-safe governance toggle",
          "contentHash": "1b7cb4b2b4142e18b0d625b518461b8f10711d4af7b97dbdd5ec89f9c9221e6a",
          "locationWithheld": "path withheld — private repository"
        },
        {
          "kind": "artifact",
          "label": "CODEOWNERS/required-review gate on protected paths",
          "contentHash": "f7f031449857f49a85ed60fcc08f3e0237de6291eb98afc58b7230ac5675a1e5",
          "locationWithheld": "path withheld — private repository"
        }
      ],
      "findings": [
        {
          "severity": "critical",
          "summary": "Role-membership GRANT or SUPERUSER escalation executes in code with no documented human gate.",
          "evidence": {
            "kind": "artifact",
            "label": "Ungated privilege-escalation statement",
            "contentHash": "c839412291f30d9630cb97839391f8046696c1c6ad3a6bdf0c8e72e50065e1cb",
            "locationWithheld": "path withheld — private repository"
          }
        },
        {
          "severity": "critical",
          "summary": "Role-membership GRANT or SUPERUSER escalation executes in code with no documented human gate.",
          "evidence": {
            "kind": "artifact",
            "label": "Ungated privilege-escalation statement",
            "contentHash": "8fdd968fd2ed1822c8d5b879bd942295c017992f9028e9f457b32ba930216dfa",
            "locationWithheld": "path withheld — private repository"
          }
        }
      ],
      "metrics": [
        {
          "name": "human_gate_documented",
          "label": "Human gate documented",
          "value": 1,
          "max": 1,
          "weight": 0.4,
          "unit": "present",
          "description": "Credits explicit documentation that privileged/credentialed operations are human-executed, never agent-run."
        },
        {
          "name": "fail_closed_privilege_check",
          "label": "Fail-closed privilege check present",
          "value": 1,
          "max": 1,
          "weight": 0.3,
          "unit": "present",
          "description": "Credits code that checks role membership and fails closed before elevating privilege, instead of attempting elevation blind."
        },
        {
          "name": "privilege_escalation_cleanliness",
          "label": "Privilege-escalation cleanliness",
          "value": 0,
          "max": 1,
          "weight": 0.3,
          "unit": "clean",
          "description": "Penalizes code that executes a role-membership GRANT or SUPERUSER escalation with no documented human gate (test/fixture SQL is excluded from this production-code measurement)."
        },
        {
          "name": "protected_path_review_gate",
          "label": "Protected-path review gate",
          "value": 1,
          "max": 1,
          "weight": 0.2,
          "unit": "present",
          "description": "Credits a CODEOWNERS file or documented required-review/branch-protection policy — the general OSS-observable analogue of human-gating changes to sensitive paths."
        },
        {
          "name": "kill_switch_fail_safe_present",
          "label": "Un-overridable kill-switch present",
          "value": 1,
          "max": 1,
          "weight": 0.15,
          "unit": "present",
          "description": "Credits a governance/safety toggle that fails closed before any lower-priority config can override it."
        }
      ],
      "notes": "B6 rewards documented, fail-closed human gating of privileged/credentialed operations and penalizes ungated privilege-escalation code paths."
    }
  ],
  "archetype": "monorepo",
  "contentReadSummary": {
    "skipped": 249,
    "byReason": {
      "unreadable": 0,
      "tooLarge": 0,
      "excludedByExtension": 249,
      "deniedPath": 0,
      "nonRegularFile": 0
    },
    "unreadableByErrno": {},
    "affectedCriteria": []
  },
  "verdict": "conditional",
  "codeTrustScore": 3.1,
  "processTrustScore": 3.3,
  "overallScore": 3.2,
  "publicSanitization": "Transparency entry for a repository inside the private source monorepo: every evidence and finding location is withheld from this public copy (marked \"path withheld — private repository\"). Dimension, summary, status, score, finding counts, and content hash are unchanged from the private evidence."
}