axios

Date
Run
unknown @ 7a6615e421578081743161eab032d009dc6583a4
Rubric
witan-rubric-v17-2026-07-24
3.3/4.0 overall

Conditional

Code 2.6 · Process 3.9

code 5/5 · process 4/6 measured

Criterion profile

Measured scores are plotted on a 0–4 scale. Unknown and not-applicable dimensions remain explicit.

9 measured 0 no data 2 N/A

Code trust

A1Test integrity and regression signal
2.5
A2Data-layer isolation and secrets posture
3.6
A3Production readiness
1.8
A4Dependency hygiene
2.5
A5Claim-vs-reality reconciliation
2.4

Process trust

B1Internal process dimension
N/A
B2PR outcome traceability
4.0
B3CI and QA discipline
4.0
B4Audit trail and report-up completeness
3.6
B5Internal process dimension
N/A
B6Privileged-operation human gating
4.0

Code trust

A1

Test integrity and regression signal

dimension band: verified
2.5
  • Test-to-source file ratio66 ratio (capped; 142 raw)
  • Static coverage percentage0/100 percent
  • Verification script ratio3/4 ratio
  • Non-hollow test share124/129 ratio
  • Detected test file tests/browser/adapter.browser.test.js:1 · sha256:11b993b6139f
  • Detected test file tests/browser/basicAuth.browser.test.js:1 · sha256:089fec76e3cb
  • Detected test file tests/browser/cancel.browser.test.js:1 · sha256:a14bfc6844f9
  • Detected test file tests/browser/cancelToken.browser.test.js:1 · sha256:f4f816dfb109
  • Detected test file tests/browser/cookies.browser.test.js:1 · sha256:cbfa4456f9d4
  • Detected test file tests/browser/defaults.browser.test.js:1 · sha256:17efcc0afffd
  • Detected test file tests/browser/formdata.browser.test.js:1 · sha256:703b1c9463f4
  • Detected test file tests/browser/headers.browser.test.js:1 · sha256:c54d00b1e16c
  • Configured test runner vitest.config.js:1 · sha256:80edd21efbbb
  • Configured test runner package.json:1 · sha256:b942f4a02b5a
  • CI workflow runs the test suite .github/workflows/release-branch.yml:1 · sha256:c899b2ce5855
  • finding severity info: Test suite files are present, but no coverage configuration was detected. (Detected test file tests/browser/adapter.browser.test.js:1 · sha256:11b993b6139f)
A2

Data-layer isolation and secrets posture

dimension band: verified
3.6
  • Secret cleanliness1/1 clean
  • Environment handling depth2/3 practices
  • .env files are gitignored .gitignore:1 · sha256:be03ac88088c
A3

Production readiness

dimension band: warning
1.8
  • Production-readiness basic checks2/6 checks
  • Production workflow depth6 signals (capped; 8 raw)
  • Observability depth3/4 signals
  • Rollback and migration-safety depth0/4 signals
  • Build or typecheck script package.json:1 · sha256:b942f4a02b5a
  • CI workflow .github/workflows/bundle-size.yml:1 · sha256:80cf311e8c1f
  • finding severity warning: A3 dimension band is warning at 1.8/4.0. Lowest contributing measurements: Rollback and migration-safety depth 0/4 signals; Production-readiness basic checks 2/6 checks. To improve: document and test rollback or recovery procedures; add the missing deployment-readiness controls. (Build or typecheck script package.json:1 · sha256:b942f4a02b5a)
A4

Dependency hygiene

dimension band: verified
2.5
  • Pinned dependency ratio10/62 ratio
  • Lockfile coverage1/1 present
  • Dependency automation ratio1/2 ratio
  • Dependency manifest package.json:1 · sha256:b942f4a02b5a
  • Dependency lockfile docs/package-lock.json:1 · sha256:84bfabe293bc
  • Dependency update config .github/dependabot.yml:1 · sha256:98ca74a41ffe
A5

Claim-vs-reality reconciliation

dimension band: warning
2.4
  • Claim match rate12/14 ratio
  • Claim source depth2/4 docs
  • Reconciliation artifact depth0/3 artifacts
  • Repository claim source README.md:1 · sha256:383efd90571f
  • Code presence for claim reconciliation lib/adapters/adapters.js:1 · sha256:2d3df4993726
  • Documented limitations / threat model / "not covered" section SECURITY.md:1 · sha256:f5b7cdb1fe81
  • finding severity info: Claim source and implementation files are present; no dedicated claim-reality report artifact was supplied, but the repo explicitly documents what it does NOT cover/protect against — honest scoping, not overclaiming. (Repository claim source README.md:1 · sha256:383efd90571f)
  • finding severity warning: A5 dimension band is warning at 2.4/4.0. Lowest contributing measurements: Reconciliation artifact depth 0/3 artifacts; Claim source depth 2/4 docs. To improve: publish a claim-to-evidence reconciliation record; document concrete, checkable product claims. (Repository claim source README.md:1 · sha256:383efd90571f)

Process trust

B2

PR outcome traceability

dimension band: verified
4.0
  • PR trace basic checks2 signals (capped; 10 raw)
  • Recent PR merge ratio1/1 ratio
  • Pull-request CI workflow .github/workflows/bundle-size.yml:1 · sha256:80cf311e8c1f
  • Pull-request CI workflow .github/workflows/lockfile-lint.yml:1 · sha256:e4cb9d0ee2bf
  • Pull-request CI workflow .github/workflows/moderator.yml:1 · sha256:341dacba05b6
  • Pull request template .github/PULL_REQUEST_TEMPLATE.md:1 · sha256:e313b5da52c6
  • Review gate configuration .github/CODEOWNERS:1 · sha256:c899dce56703
B3

CI and QA discipline

dimension band: verified
4.0
  • CI verification depth4/4 signals
  • PR-gate CI workflow count4 workflows (capped; 5 raw)
  • Test script package.json:1 · sha256:b942f4a02b5a
  • Lint script package.json:1 · sha256:b942f4a02b5a
  • CI workflow .github/workflows/bundle-size.yml:1 · sha256:80cf311e8c1f
B4

Audit trail and report-up completeness

dimension band: verified
3.6
  • Audit artifact depth3 files (capped; 6 raw)
  • Audit freshness depth3/6 ratio
  • Audit or changelog artifact CHANGELOG.md:1 · sha256:0012d63016b8
  • Audit or changelog artifact SECURITY.md:1 · sha256:f5b7cdb1fe81
  • Audit or changelog artifact docs/es/pages/misc/security.md:1 · sha256:92459ca06ce7
  • Audit or changelog artifact docs/fr/pages/misc/security.md:1 · sha256:0e5e849be7d3
  • Audit or changelog artifact docs/pages/misc/security.md:1 · sha256:156a85ca8b6b
B6

Privileged-operation human gating

dimension band: verified
4.0
  • Privilege-escalation cleanliness1/1 clean
  • Protected-path review gate1/1 present
  • CODEOWNERS/required-review gate on protected paths .github/CODEOWNERS:1 · sha256:c899dce56703

Not applicable to this repository

  • B1 Internal process dimension — Substrate-specific: an internal process dimension is not applicable to external code.
  • B5 Internal process dimension — Substrate-specific: an internal process dimension is not applicable to external code.

Verified evidence

  • A1 - Test integrity and regression signalDetected test file tests/browser/adapter.browser.test.js:1 · sha256:11b993b6139f
  • A1 - Test integrity and regression signalDetected test file tests/browser/basicAuth.browser.test.js:1 · sha256:089fec76e3cb
  • A1 - Test integrity and regression signalDetected test file tests/browser/cancel.browser.test.js:1 · sha256:a14bfc6844f9
  • A1 - Test integrity and regression signalDetected test file tests/browser/cancelToken.browser.test.js:1 · sha256:f4f816dfb109
  • A1 - Test integrity and regression signalDetected test file tests/browser/cookies.browser.test.js:1 · sha256:cbfa4456f9d4
  • A1 - Test integrity and regression signalDetected test file tests/browser/defaults.browser.test.js:1 · sha256:17efcc0afffd
  • A1 - Test integrity and regression signalDetected test file tests/browser/formdata.browser.test.js:1 · sha256:703b1c9463f4
  • A1 - Test integrity and regression signalDetected test file tests/browser/headers.browser.test.js:1 · sha256:c54d00b1e16c
  • A1 - Test integrity and regression signalConfigured test runner vitest.config.js:1 · sha256:80edd21efbbb
  • A1 - Test integrity and regression signalConfigured test runner package.json:1 · sha256:b942f4a02b5a
  • A1 - Test integrity and regression signalCI workflow runs the test suite .github/workflows/release-branch.yml:1 · sha256:c899b2ce5855
  • A2 - Data-layer isolation and secrets posture.env files are gitignored .gitignore:1 · sha256:be03ac88088c
  • A4 - Dependency hygieneDependency manifest package.json:1 · sha256:b942f4a02b5a
  • A4 - Dependency hygieneDependency lockfile docs/package-lock.json:1 · sha256:84bfabe293bc
  • A4 - Dependency hygieneDependency update config .github/dependabot.yml:1 · sha256:98ca74a41ffe
  • B2 - PR outcome traceabilityPull-request CI workflow .github/workflows/bundle-size.yml:1 · sha256:80cf311e8c1f
  • B2 - PR outcome traceabilityPull-request CI workflow .github/workflows/lockfile-lint.yml:1 · sha256:e4cb9d0ee2bf
  • B2 - PR outcome traceabilityPull-request CI workflow .github/workflows/moderator.yml:1 · sha256:341dacba05b6
  • B2 - PR outcome traceabilityPull request template .github/PULL_REQUEST_TEMPLATE.md:1 · sha256:e313b5da52c6
  • B2 - PR outcome traceabilityReview gate configuration .github/CODEOWNERS:1 · sha256:c899dce56703
  • B3 - CI and QA disciplineTest script package.json:1 · sha256:b942f4a02b5a
  • B3 - CI and QA disciplineLint script package.json:1 · sha256:b942f4a02b5a
  • B3 - CI and QA disciplineCI workflow .github/workflows/bundle-size.yml:1 · sha256:80cf311e8c1f
  • B4 - Audit trail and report-up completenessAudit or changelog artifact CHANGELOG.md:1 · sha256:0012d63016b8
  • B4 - Audit trail and report-up completenessAudit or changelog artifact SECURITY.md:1 · sha256:f5b7cdb1fe81
  • B4 - Audit trail and report-up completenessAudit or changelog artifact docs/es/pages/misc/security.md:1 · sha256:92459ca06ce7
  • B4 - Audit trail and report-up completenessAudit or changelog artifact docs/fr/pages/misc/security.md:1 · sha256:0e5e849be7d3
  • B4 - Audit trail and report-up completenessAudit or changelog artifact docs/pages/misc/security.md:1 · sha256:156a85ca8b6b
  • B6 - Privileged-operation human gatingCODEOWNERS/required-review gate on protected paths .github/CODEOWNERS:1 · sha256:c899dce56703

Open / unverified

  • A3 - Production readinessfinding severity warning: A3 dimension band is warning at 1.8/4.0. Lowest contributing measurements: Rollback and migration-safety depth 0/4 signals; Production-readiness basic checks 2/6 checks. To improve: document and test rollback or recovery procedures; add the missing deployment-readiness controls. (Build or typecheck script package.json:1 · sha256:b942f4a02b5a)
  • A5 - Claim-vs-reality reconciliationfinding severity info: Claim source and implementation files are present; no dedicated claim-reality report artifact was supplied, but the repo explicitly documents what it does NOT cover/protect against — honest scoping, not overclaiming. (Repository claim source README.md:1 · sha256:383efd90571f)
  • A5 - Claim-vs-reality reconciliationfinding severity warning: A5 dimension band is warning at 2.4/4.0. Lowest contributing measurements: Reconciliation artifact depth 0/3 artifacts; Claim source depth 2/4 docs. To improve: publish a claim-to-evidence reconciliation record; document concrete, checkable product claims. (Repository claim source README.md:1 · sha256:383efd90571f)