carddemo

Date
Run
unknown @ 59cc6c2fd7ebd7ef7925cad552a01a4b8b6e4d5e
Rubric
witan-rubric-v17-2026-07-24

Insufficient source

No free-core rubric criterion produced a measurable signal. Cejel abstains rather than publish a numeric zero for an entirely unmeasured repository. Source coverage: 9 of 250 source-shaped files (3.6%) are criterion-ratable, below the 20% reviewable-source threshold (328 tracked files in total).

How to read this certificate

This certificate describes the repository tree at the pinned revision. Evidence outside that tree, including a test suite in another repository or CI checks in a different working directory, is neither seen by this scan nor claimed to be absent.

Produced by Cejel 0.4.9 under witan-rubric-v17-2026-07-24. Read the report JSON.

Rubric behaviour fingerprint: sha256:ff0f01abe8c12daa60375d0e18c1aca4a1135a55ab2a80b15f4c037bfc18b4b1. This identifies measured behaviour on the synthetic corpus; it is not a coverage claim.

Criterion profile

Measured scores are plotted on a 0–4 scale. Unknown and not-applicable dimensions remain explicit.

0 measured 5 no data 6 N/A

Code trust

A1Test integrity and regression signal
No data
A2Data-layer isolation and secrets posture
N/A
A3Production readiness
N/A
A4Dependency hygiene
No data
A5Claim-vs-reality reconciliation
No data

Process trust

B1Internal process dimension
N/A
B2PR outcome traceability
No data
B3CI and QA discipline
No data
B4Audit trail and report-up completeness
N/A
B5Internal process dimension
N/A
B6Privileged-operation human gating
N/A

Code trust

A1

Test integrity and regression signal

dimension band: insufficient_data
No data
  • No measured depth metrics supplied.
  • No concrete evidence supplied.
A4

Dependency hygiene

dimension band: insufficient_data
No data
  • No measured depth metrics supplied.
  • No concrete evidence supplied.
A5

Claim-vs-reality reconciliation

dimension band: insufficient_data
No data
  • No measured depth metrics supplied.
  • No concrete evidence supplied.

Not applicable to this repository

  • A2 Data-layer isolation and secrets posture — No data layer (DB/ORM/migrations) or ratable secrets surface detected — A2 not applicable to this repo archetype. A ratable surface requires .env* files, .gitignore .env rule, committed/history .env path, or detected signing/HMAC/secret-comparison code; bare env reads (process.env / os.environ / std::env::) do not qualify.
  • A3 Production readiness — No deployable-service surface detected — production-readiness not applicable to this library/CLI archetype. Signals checked: production server entrypoint (HTTP/RPC port binding in main/server/app files, outside examples/tests/demo dirs), deploy config (vercel.json, render.yaml, fly.toml, Procfile, app.yaml, serverless.yml, docker-compose, k8s/helm manifests), CI deploy job (fly deploy, kubectl apply, helm install/upgrade, docker push). A Dockerfile without an explicit runtime start/service command is ambiguous and does not qualify.

Process trust

B2

PR outcome traceability

dimension band: insufficient_data
No data
  • No measured depth metrics supplied.
  • No concrete evidence supplied.
B3

CI and QA discipline

dimension band: insufficient_data
No data
  • No measured depth metrics supplied.
  • No concrete evidence supplied.

Not applicable to this repository

  • B1 Internal process dimension — Substrate-specific: an internal process dimension is not applicable to external code.
  • B4 Audit trail and report-up completeness — No audit-trail artifact detected (CHANGELOG/CHANGES/HISTORY/NEWS/SECURITY/AUDIT/STATUS/ release-notes/runbook/provenance file) — B4 not applicable to this repo.
  • B5 Internal process dimension — Substrate-specific: an internal process dimension is not applicable to external code.
  • B6 Privileged-operation human gating — No privileged-operation surface (prod DB admin GRANT/privilege DDL, role escalation, or documented human-gate governance) detected in this repo.

Verified evidence

  • No verified evidence listed in this public certificate.

Open / unverified

  • A1 - Test integrity and regression signalInsufficient data — no measurable signal; excluded from composite.
  • A4 - Dependency hygieneInsufficient data — no measurable signal; excluded from composite.
  • A5 - Claim-vs-reality reconciliationInsufficient data — no measurable signal; excluded from composite.
  • B2 - PR outcome traceabilityInsufficient data — no measurable signal; excluded from composite.
  • B3 - CI and QA disciplineInsufficient data — no measurable signal; excluded from composite.