@cejel/cejel

Date
Run
unknown @ 0be03171c810023c65806d87f25ee4873a377cea
Rubric
witan-rubric-v17-2026-07-24
2.8/4.0 overall

Conditional

Code 2.3 · Process 3.2

code 5/5 · process 3/6 measured

Criterion profile

Measured scores are plotted on a 0–4 scale. Unknown and not-applicable dimensions remain explicit.

8 measured 0 no data 3 N/A

Code trust

A1Test integrity and regression signal
2.0
A2Data-layer isolation and secrets posture
3.3
A3Production readiness
2.3
A4Dependency hygiene
1.8
A5Claim-vs-reality reconciliation
2.2

Process trust

B1Internal process dimension
N/A
B2PR outcome traceability
4.0
B3CI and QA discipline
2.4
B4Audit trail and report-up completeness
N/A
B5Internal process dimension
N/A
B6Privileged-operation human gating
3.3

Code trust

A1

Test integrity and regression signal

dimension band: verified
2.0
  • Test-to-source file ratio20/27 ratio
  • Static coverage percentage0/100 percent
  • Verification script ratio2/4 ratio
  • Non-hollow test share20/20 ratio
  • Detected test file src/__tests__/index.test.ts:1 · sha256:32fc957d514d
  • Detected test file src/__tests__/mcp-scan-parity.test.ts:1 · sha256:34b3efdfe7b2
  • Detected test file src/__tests__/offline-guarantee.test.ts:1 · sha256:803f3b84f346
  • Detected test file src/__tests__/product-identity.test.ts:1 · sha256:8a8ce5c1aada
  • Detected test file src/__tests__/publish-installable.test.ts:1 · sha256:8379557a0d39
  • Detected test file src/__tests__/summary.test.ts:1 · sha256:de47e2cae9da
  • Detected test file src/__tests__/terminal.test.ts:1 · sha256:d16d09ff7e09
  • Detected test file src/witan/__tests__/attestation.test.ts:1 · sha256:4e18dabfae27
  • Configured test runner package.json:1 · sha256:c1c359ec5669
  • CI workflow runs the test suite .github/workflows/ci.yml:1 · sha256:f9d89e4c65a1
  • finding severity info: Test suite files are present, but no coverage configuration was detected. (Detected test file src/__tests__/index.test.ts:1 · sha256:32fc957d514d)
A2

Data-layer isolation and secrets posture

dimension band: verified
3.3
  • Secret cleanliness1/1 clean
  • Environment handling depth1/3 practices
  • Crypto comparison hygiene1/1 clean
  • DB client import src/witan/__tests__/repo-signals.test.ts:1 · sha256:213989426f8b
  • Constant-time secret/HMAC comparison src/witan/repo-signals.ts:1 · sha256:383f202763dd
A3

Production readiness

dimension band: warning
2.3
  • Production-readiness basic checks3/6 checks
  • Production workflow depth6/6 signals
  • Observability depth4 signals (capped; 7 raw)
  • Rollback and migration-safety depth0/4 signals
  • Build or typecheck script package.json:1 · sha256:c1c359ec5669
  • CI workflow .github/workflows/ci.yml:1 · sha256:f9d89e4c65a1
  • Release deploy configuration vercel.json:1 · sha256:1a7f3230d16c
  • Container build configuration Dockerfile:1 · sha256:219ff891874d
  • finding severity warning: A3 dimension band is warning at 2.3/4.0. Lowest contributing measurements: Rollback and migration-safety depth 0/4 signals; Production-readiness basic checks 3/6 checks. To improve: document and test rollback or recovery procedures; add the missing deployment-readiness controls. (Build or typecheck script package.json:1 · sha256:c1c359ec5669)
A4

Dependency hygiene

dimension band: warning
1.8
  • Pinned dependency ratio0/8 ratio
  • Lockfile coverage1/1 present
  • Dependency automation ratio0/2 ratio
  • Dependency manifest package.json:1 · sha256:c1c359ec5669
  • Dependency lockfile pnpm-lock.yaml:1 · sha256:d0ca1e84d71e
  • finding severity warning: A4 dimension band is warning at 1.8/4.0. Lowest contributing measurements: Pinned dependency ratio 0/8 ratio; Dependency automation ratio 0/2 ratio. To improve: pin application dependencies that determine the deployed artifact; enable automated dependency updates and an audit command. (Dependency manifest package.json:1 · sha256:c1c359ec5669)
A5

Claim-vs-reality reconciliation

dimension band: warning
2.2
  • Claim match rate12/13 ratio
  • Claim source depth1/4 docs
  • Reconciliation artifact depth0/3 artifacts
  • Repository claim source README.md:1 · sha256:56ddeb464198
  • Code presence for claim reconciliation src/http/server.ts:1 · sha256:f68a25887561
  • finding severity warning: Claim source and implementation files are present, but no dedicated claim-reality report artifact was supplied. (Repository claim source README.md:1 · sha256:56ddeb464198)

Process trust

B2

PR outcome traceability

dimension band: verified
4.0
  • PR trace basic checks2 signals (capped; 4 raw)
  • Recent PR merge ratio1/1 ratio
  • Pull-request CI workflow .github/workflows/ci.yml:1 · sha256:f9d89e4c65a1
  • Pull-request CI workflow .github/workflows/cla.yml:1 · sha256:3501cf464dbc
  • Pull-request CI workflow .github/workflows/publish-distribution.yml:1 · sha256:b16f13592b84
B3

CI and QA discipline

dimension band: verified
2.4
  • CI verification depth4/4 signals
  • PR-gate CI workflow count1/4 workflows
  • Test script package.json:1 · sha256:c1c359ec5669
  • CI workflow .github/workflows/ci.yml:1 · sha256:f9d89e4c65a1
B6

Privileged-operation human gating

dimension band: verified
3.3
  • Human gate documented1/1 present
  • Fail-closed privilege check present1/1 present
  • Privilege-escalation cleanliness1/1 clean
  • Protected-path review gate0/1 present
  • Documents privileged operations as human-executed/gated leaderboard/reports/alfred.md:1 · sha256:4f6e2d964969
  • Fail-closed privilege-membership check before role elevation src/witan/__tests__/repo-signals.test.ts:1 · sha256:213989426f8b

Not applicable to this repository

  • B1 Internal process dimension — Substrate-specific: an internal process dimension is not applicable to external code.
  • B4 Audit trail and report-up completeness — No audit-trail artifact detected (CHANGELOG/CHANGES/HISTORY/NEWS/SECURITY/AUDIT/STATUS/ release-notes/runbook/provenance file) — B4 not applicable to this repo.
  • B5 Internal process dimension — Substrate-specific: an internal process dimension is not applicable to external code.

Verified evidence

  • A1 - Test integrity and regression signalDetected test file src/__tests__/index.test.ts:1 · sha256:32fc957d514d
  • A1 - Test integrity and regression signalDetected test file src/__tests__/mcp-scan-parity.test.ts:1 · sha256:34b3efdfe7b2
  • A1 - Test integrity and regression signalDetected test file src/__tests__/offline-guarantee.test.ts:1 · sha256:803f3b84f346
  • A1 - Test integrity and regression signalDetected test file src/__tests__/product-identity.test.ts:1 · sha256:8a8ce5c1aada
  • A1 - Test integrity and regression signalDetected test file src/__tests__/publish-installable.test.ts:1 · sha256:8379557a0d39
  • A1 - Test integrity and regression signalDetected test file src/__tests__/summary.test.ts:1 · sha256:de47e2cae9da
  • A1 - Test integrity and regression signalDetected test file src/__tests__/terminal.test.ts:1 · sha256:d16d09ff7e09
  • A1 - Test integrity and regression signalDetected test file src/witan/__tests__/attestation.test.ts:1 · sha256:4e18dabfae27
  • A1 - Test integrity and regression signalConfigured test runner package.json:1 · sha256:c1c359ec5669
  • A1 - Test integrity and regression signalCI workflow runs the test suite .github/workflows/ci.yml:1 · sha256:f9d89e4c65a1
  • A2 - Data-layer isolation and secrets postureDB client import src/witan/__tests__/repo-signals.test.ts:1 · sha256:213989426f8b
  • A2 - Data-layer isolation and secrets postureConstant-time secret/HMAC comparison src/witan/repo-signals.ts:1 · sha256:383f202763dd
  • B2 - PR outcome traceabilityPull-request CI workflow .github/workflows/ci.yml:1 · sha256:f9d89e4c65a1
  • B2 - PR outcome traceabilityPull-request CI workflow .github/workflows/cla.yml:1 · sha256:3501cf464dbc
  • B2 - PR outcome traceabilityPull-request CI workflow .github/workflows/publish-distribution.yml:1 · sha256:b16f13592b84
  • B3 - CI and QA disciplineTest script package.json:1 · sha256:c1c359ec5669
  • B3 - CI and QA disciplineCI workflow .github/workflows/ci.yml:1 · sha256:f9d89e4c65a1
  • B6 - Privileged-operation human gatingDocuments privileged operations as human-executed/gated leaderboard/reports/alfred.md:1 · sha256:4f6e2d964969
  • B6 - Privileged-operation human gatingFail-closed privilege-membership check before role elevation src/witan/__tests__/repo-signals.test.ts:1 · sha256:213989426f8b

Open / unverified

  • A3 - Production readinessfinding severity warning: A3 dimension band is warning at 2.3/4.0. Lowest contributing measurements: Rollback and migration-safety depth 0/4 signals; Production-readiness basic checks 3/6 checks. To improve: document and test rollback or recovery procedures; add the missing deployment-readiness controls. (Build or typecheck script package.json:1 · sha256:c1c359ec5669)
  • A4 - Dependency hygienefinding severity warning: A4 dimension band is warning at 1.8/4.0. Lowest contributing measurements: Pinned dependency ratio 0/8 ratio; Dependency automation ratio 0/2 ratio. To improve: pin application dependencies that determine the deployed artifact; enable automated dependency updates and an audit command. (Dependency manifest package.json:1 · sha256:c1c359ec5669)
  • A5 - Claim-vs-reality reconciliationfinding severity warning: Claim source and implementation files are present, but no dedicated claim-reality report artifact was supplied. (Repository claim source README.md:1 · sha256:56ddeb464198)