{
  "productSlug": "cejel",
  "productDisplayName": "@cejel/cejel",
  "repo": {
    "headSha": "0be03171c810023c65806d87f25ee4873a377cea"
  },
  "rubricVersion": "witan-rubric-v17-2026-07-24",
  "criteria": [
    {
      "id": "A1",
      "title": "Test integrity and regression signal",
      "category": "code_trust",
      "score": 2,
      "status": "verified",
      "evidence": [
        {
          "kind": "test_run",
          "label": "Detected test file",
          "path": "src/__tests__/index.test.ts",
          "line": 1,
          "contentHash": "32fc957d514d7b432d79cee149bd26898bd1a4641d0a657d4d19d098fb3d22e9"
        },
        {
          "kind": "test_run",
          "label": "Detected test file",
          "path": "src/__tests__/mcp-scan-parity.test.ts",
          "line": 1,
          "contentHash": "34b3efdfe7b2cfd835fc022ff3693cb1ec65505997f19c0be9c08a8d4e697c09"
        },
        {
          "kind": "test_run",
          "label": "Detected test file",
          "path": "src/__tests__/offline-guarantee.test.ts",
          "line": 1,
          "contentHash": "803f3b84f346464b0110b26a3b902159926eae90e0808e0df26f6e5c15d02fa7"
        },
        {
          "kind": "test_run",
          "label": "Detected test file",
          "path": "src/__tests__/product-identity.test.ts",
          "line": 1,
          "contentHash": "8a8ce5c1aada7d5a763a77c8e8743f52876c7e79a879d8e6324cd956ddeb63d6"
        },
        {
          "kind": "test_run",
          "label": "Detected test file",
          "path": "src/__tests__/publish-installable.test.ts",
          "line": 1,
          "contentHash": "8379557a0d395d7fdf9421b2e1635f7a705c1ac18bc253578fa76a1fc608c5af"
        },
        {
          "kind": "test_run",
          "label": "Detected test file",
          "path": "src/__tests__/summary.test.ts",
          "line": 1,
          "contentHash": "de47e2cae9daff7978bc73b94607e40090ea289d3ac86294fff839cae10b9a22"
        },
        {
          "kind": "test_run",
          "label": "Detected test file",
          "path": "src/__tests__/terminal.test.ts",
          "line": 1,
          "contentHash": "d16d09ff7e09590700a29fbf8d15795a7e3416f1fd5f47a2868f873cda8547ee"
        },
        {
          "kind": "test_run",
          "label": "Detected test file",
          "path": "src/witan/__tests__/attestation.test.ts",
          "line": 1,
          "contentHash": "4e18dabfae27e87db117958abeb1c5295ce9ac78c2a751dbf7015e794d712495"
        },
        {
          "kind": "test_run",
          "label": "Configured test runner",
          "path": "package.json",
          "line": 1,
          "contentHash": "c1c359ec5669a029c1cfb9ba6d08d6522ca9f5be055c3103f26f20556d130ce2"
        },
        {
          "kind": "test_run",
          "label": "CI workflow runs the test suite",
          "path": ".github/workflows/ci.yml",
          "line": 1,
          "contentHash": "f9d89e4c65a1cc60d4f4868f15edfbf9b5037d09cbd67dbe0e3f2e16b2870aba"
        }
      ],
      "findings": [
        {
          "severity": "info",
          "summary": "Test suite files are present, but no coverage configuration was detected.",
          "evidence": {
            "kind": "test_run",
            "label": "Detected test file",
            "path": "src/__tests__/index.test.ts",
            "line": 1,
            "contentHash": "32fc957d514d7b432d79cee149bd26898bd1a4641d0a657d4d19d098fb3d22e9"
          }
        }
      ],
      "metrics": [
        {
          "name": "test_to_source_ratio",
          "label": "Test-to-source file ratio",
          "value": 20,
          "max": 27,
          "kind": "saturating_count",
          "weight": 0.3,
          "unit": "ratio",
          "description": "Measures how much concrete test surface exists relative to implementation surface."
        },
        {
          "name": "coverage_percent",
          "label": "Static coverage percentage",
          "value": 0,
          "max": 100,
          "weight": 0.3,
          "unit": "percent",
          "description": "Uses a static coverage report value or configured threshold when present, without running tests."
        },
        {
          "name": "verification_script_ratio",
          "label": "Verification script ratio",
          "value": 2,
          "max": 4,
          "kind": "saturating_count",
          "weight": 0.25,
          "unit": "ratio",
          "description": "Measures explicit test/lint/typecheck verification commands (via npm script or CI-invoked tool) plus test runner configuration."
        },
        {
          "name": "non_hollow_test_share",
          "label": "Non-hollow test share",
          "value": 20,
          "max": 20,
          "weight": 0.15,
          "unit": "ratio",
          "description": "Penalizes skipped or placeholder-only test files; test-directory support scaffolding (helpers/fixtures with no test in them) is excluded from the denominator."
        }
      ],
      "notes": "A1 is detected from real test files, test runner configuration, and optional coverage configuration."
    },
    {
      "id": "A2",
      "title": "Data-layer isolation and secrets posture",
      "category": "code_trust",
      "score": 3.3,
      "status": "verified",
      "evidence": [
        {
          "kind": "artifact",
          "label": "DB client import",
          "path": "src/witan/__tests__/repo-signals.test.ts",
          "line": 1,
          "contentHash": "213989426f8b192b207bf4178276fee4fa623d9f3020163312ce5662e383334f"
        },
        {
          "kind": "artifact",
          "label": "Constant-time secret/HMAC comparison",
          "path": "src/witan/repo-signals.ts",
          "line": 1,
          "contentHash": "383f202763dd9edd7a78fc69ace3d6d1972fc7f14051e9f07c73a91812d2fd8a"
        }
      ],
      "findings": [],
      "metrics": [
        {
          "name": "secret_cleanliness",
          "label": "Secret cleanliness",
          "value": 1,
          "max": 1,
          "weight": 0.7,
          "unit": "clean",
          "description": "Credits absence of committed or recent-history secret findings in the static scan."
        },
        {
          "name": "env_handling_depth",
          "label": "Environment handling depth",
          "value": 1,
          "max": 3,
          "weight": 0.3,
          "unit": "practices",
          "description": "Counts three bounded env-handling practices (0–3): template file, gitignore rule, env reads in any supported language."
        },
        {
          "name": "crypto_comparison_hygiene",
          "label": "Crypto comparison hygiene",
          "value": 1,
          "max": 1,
          "weight": 0.2,
          "unit": "clean",
          "description": "Credits constant-time secret/HMAC comparison and canonical serialization before signing when a signing/HMAC surface is detected in source; only scored when such a surface exists."
        }
      ],
      "notes": "History secret scanning covers all reachable git history for credential-pattern paths unless the explicit credential-blob safety valve is reported."
    },
    {
      "id": "A3",
      "title": "Production readiness",
      "category": "code_trust",
      "score": 2.3,
      "status": "warning",
      "evidence": [
        {
          "kind": "prod_check",
          "label": "Build or typecheck script",
          "path": "package.json",
          "line": 1,
          "contentHash": "c1c359ec5669a029c1cfb9ba6d08d6522ca9f5be055c3103f26f20556d130ce2"
        },
        {
          "kind": "ci_run",
          "label": "CI workflow",
          "path": ".github/workflows/ci.yml",
          "line": 1,
          "contentHash": "f9d89e4c65a1cc60d4f4868f15edfbf9b5037d09cbd67dbe0e3f2e16b2870aba"
        },
        {
          "kind": "prod_check",
          "label": "Release deploy configuration",
          "path": "vercel.json",
          "line": 1,
          "contentHash": "1a7f3230d16ce24e177102bdfe92d580250ef84302cddcf50069edcec2cda892"
        },
        {
          "kind": "prod_check",
          "label": "Container build configuration",
          "path": "Dockerfile",
          "line": 1,
          "contentHash": "219ff891874d37f4fd406e4a5b138cc072be41a50b40cf730a1b00d28964a51a"
        }
      ],
      "findings": [
        {
          "severity": "warning",
          "summary": "A3 metric-derived score is 2.3/4.0, in the warning band — no single finding drove this; it reflects the combined metric weighting below.",
          "evidence": {
            "kind": "prod_check",
            "label": "Build or typecheck script",
            "path": "package.json",
            "line": 1,
            "contentHash": "c1c359ec5669a029c1cfb9ba6d08d6522ca9f5be055c3103f26f20556d130ce2"
          }
        }
      ],
      "metrics": [
        {
          "name": "prod_readiness_primitives",
          "label": "Production-readiness basic checks",
          "value": 3,
          "max": 6,
          "weight": 0.55,
          "unit": "checks",
          "description": "Counts distinct static production-readiness checks instead of treating presence as enough."
        },
        {
          "name": "prod_workflow_depth",
          "label": "Production workflow depth",
          "value": 6,
          "max": 6,
          "kind": "saturating_count",
          "weight": 0.2,
          "unit": "signals",
          "description": "Measures CI/deploy configuration depth instead of a single CI-present bit."
        },
        {
          "name": "observability_depth",
          "label": "Observability depth",
          "value": 7,
          "max": 4,
          "kind": "saturating_count",
          "weight": 0.1,
          "unit": "signals",
          "description": "Counts static observability/logging/metrics implementation signals."
        },
        {
          "name": "rollback_safety_depth",
          "label": "Rollback and migration-safety depth",
          "value": 0,
          "max": 4,
          "kind": "saturating_count",
          "weight": 0.15,
          "unit": "signals",
          "description": "Counts static rollback or migration-safety artifacts."
        }
      ]
    },
    {
      "id": "A4",
      "title": "Dependency hygiene",
      "category": "code_trust",
      "score": 1.8,
      "status": "warning",
      "evidence": [
        {
          "kind": "dependency_report",
          "label": "Dependency manifest",
          "path": "package.json",
          "line": 1,
          "contentHash": "c1c359ec5669a029c1cfb9ba6d08d6522ca9f5be055c3103f26f20556d130ce2"
        },
        {
          "kind": "dependency_report",
          "label": "Dependency lockfile",
          "path": "pnpm-lock.yaml",
          "line": 1,
          "contentHash": "d0ca1e84d71efcce48aa39f35e43ce0309c17046857da341ec0e41dbc1de5136"
        }
      ],
      "findings": [
        {
          "severity": "warning",
          "summary": "A4 metric-derived score is 1.8/4.0, in the warning band — no single finding drove this; it reflects the combined metric weighting below.",
          "evidence": {
            "kind": "dependency_report",
            "label": "Dependency manifest",
            "path": "package.json",
            "line": 1,
            "contentHash": "c1c359ec5669a029c1cfb9ba6d08d6522ca9f5be055c3103f26f20556d130ce2"
          }
        }
      ],
      "metrics": [
        {
          "name": "pinned_dependency_ratio",
          "label": "Pinned dependency ratio",
          "value": 0,
          "max": 8,
          "weight": 0.3,
          "unit": "ratio",
          "description": "Measures exact/static dependency versions in manifests; lower weight because a lockfile is the primary reproducibility guarantee."
        },
        {
          "name": "lockfile_coverage",
          "label": "Lockfile coverage",
          "value": 1,
          "max": 1,
          "weight": 0.45,
          "unit": "present",
          "description": "Credits presence of at least one lockfile; one root lockfile covering a monorepo is sufficient."
        },
        {
          "name": "dependency_automation_ratio",
          "label": "Dependency automation ratio",
          "value": 0,
          "max": 2,
          "weight": 0.25,
          "unit": "ratio",
          "description": "Credits automated dependency updates and package-manager audit hooks."
        }
      ],
      "notes": "A4 scored against app/service norms (deploy surface detected): pinned dependencies and a lockfile are required for reproducible installs."
    },
    {
      "id": "A5",
      "title": "Claim-vs-reality reconciliation",
      "category": "code_trust",
      "score": 2.2,
      "status": "warning",
      "evidence": [
        {
          "kind": "claim_reconciliation",
          "label": "Repository claim source",
          "path": "README.md",
          "line": 1,
          "contentHash": "56ddeb464198e7546a05b83d8946f6965f1562191037c3c8e254a96011061490"
        },
        {
          "kind": "artifact",
          "label": "Code presence for claim reconciliation",
          "path": "src/http/server.ts",
          "line": 1,
          "contentHash": "f68a258875615bee204c96afd0ce2a9aacd0fb35d5e65008143c593c81c04eb4"
        }
      ],
      "findings": [
        {
          "severity": "warning",
          "summary": "Claim source and implementation files are present, but no dedicated claim-reality report artifact was supplied.",
          "evidence": {
            "kind": "claim_reconciliation",
            "label": "Repository claim source",
            "path": "README.md",
            "line": 1,
            "contentHash": "56ddeb464198e7546a05b83d8946f6965f1562191037c3c8e254a96011061490"
          }
        }
      ],
      "metrics": [
        {
          "name": "claim_match_rate",
          "label": "Claim match rate",
          "value": 12,
          "max": 13,
          "weight": 0.5,
          "unit": "ratio",
          "description": "Uses bounded implementation-to-claim-source depth as a static proxy when no dedicated artifact exists."
        },
        {
          "name": "claim_source_depth",
          "label": "Claim source depth",
          "value": 1,
          "max": 4,
          "kind": "saturating_count",
          "weight": 0.35,
          "unit": "docs",
          "description": "Credits multiple claim-bearing documents without judging unverified prose as truth."
        },
        {
          "name": "reconciliation_artifact_depth",
          "label": "Reconciliation artifact depth",
          "value": 0,
          "max": 3,
          "weight": 0.15,
          "unit": "artifacts",
          "description": "Requires a specific claim-reality artifact to reach full depth."
        }
      ]
    },
    {
      "id": "B1",
      "title": "Internal process dimension",
      "category": "process_trust",
      "score": 0,
      "status": "not_applicable",
      "evidence": [],
      "findings": [],
      "metrics": [],
      "notes": "Substrate-specific: an internal process dimension is not applicable to external code."
    },
    {
      "id": "B2",
      "title": "PR outcome traceability",
      "category": "process_trust",
      "score": 4,
      "status": "verified",
      "evidence": [
        {
          "kind": "ci_run",
          "label": "Pull-request CI workflow",
          "path": ".github/workflows/ci.yml",
          "line": 1,
          "contentHash": "f9d89e4c65a1cc60d4f4868f15edfbf9b5037d09cbd67dbe0e3f2e16b2870aba"
        },
        {
          "kind": "ci_run",
          "label": "Pull-request CI workflow",
          "path": ".github/workflows/cla.yml",
          "line": 1,
          "contentHash": "3501cf464dbcde9046a43df76d776ef7fe3020ac9ccd24809eaa6a96e4ca05ce"
        },
        {
          "kind": "ci_run",
          "label": "Pull-request CI workflow",
          "path": ".github/workflows/publish-distribution.yml",
          "line": 1,
          "contentHash": "b16f13592b843cf0ca9aac5db0f290d60bcb468af3bc131e4b7a62849679d6ea"
        }
      ],
      "findings": [],
      "metrics": [
        {
          "name": "pr_trace_primitives",
          "label": "PR trace basic checks",
          "value": 4,
          "max": 2,
          "kind": "saturating_count",
          "weight": 0.8,
          "unit": "signals",
          "description": "Measures CI, PR template, and review-gate evidence for pull-request traceability."
        },
        {
          "name": "pr_merge_ratio",
          "label": "Recent PR merge ratio",
          "value": 1,
          "max": 1,
          "weight": 0.2,
          "unit": "ratio",
          "description": "Uses bounded git history as a deterministic proxy for PR outcome traceability."
        }
      ]
    },
    {
      "id": "B3",
      "title": "CI and QA discipline",
      "category": "process_trust",
      "score": 2.4,
      "status": "verified",
      "evidence": [
        {
          "kind": "test_run",
          "label": "Test script",
          "path": "package.json",
          "line": 1,
          "contentHash": "c1c359ec5669a029c1cfb9ba6d08d6522ca9f5be055c3103f26f20556d130ce2"
        },
        {
          "kind": "ci_run",
          "label": "CI workflow",
          "path": ".github/workflows/ci.yml",
          "line": 1,
          "contentHash": "f9d89e4c65a1cc60d4f4868f15edfbf9b5037d09cbd67dbe0e3f2e16b2870aba"
        }
      ],
      "findings": [],
      "metrics": [
        {
          "name": "ci_script_depth",
          "label": "CI verification depth",
          "value": 4,
          "max": 4,
          "kind": "saturating_count",
          "weight": 0.45,
          "unit": "signals",
          "description": "Counts npm verification scripts plus distinct test/lint/typecheck/build command categories detected anywhere in CI workflows; language-agnostic, counted by category not by file."
        },
        {
          "name": "default_branch_ci_depth",
          "label": "PR-gate CI workflow count",
          "value": 1,
          "max": 4,
          "kind": "saturating_count",
          "weight": 0.55,
          "unit": "workflows",
          "description": "Counts CI workflows that target pull requests or the default branch, up to 4."
        }
      ]
    },
    {
      "id": "B4",
      "title": "Audit trail and report-up completeness",
      "category": "process_trust",
      "score": 0,
      "status": "not_applicable",
      "evidence": [],
      "findings": [],
      "metrics": [],
      "notes": "No audit-trail artifact detected (CHANGELOG/CHANGES/HISTORY/NEWS/SECURITY/AUDIT/STATUS/ release-notes/runbook/provenance file) — B4 not applicable to this repo."
    },
    {
      "id": "B5",
      "title": "Internal process dimension",
      "category": "process_trust",
      "score": 0,
      "status": "not_applicable",
      "evidence": [],
      "findings": [],
      "metrics": [],
      "notes": "Substrate-specific: an internal process dimension is not applicable to external code."
    },
    {
      "id": "B6",
      "title": "Privileged-operation human gating",
      "category": "process_trust",
      "score": 3.3,
      "status": "verified",
      "evidence": [
        {
          "kind": "artifact",
          "label": "Documents privileged operations as human-executed/gated",
          "path": "leaderboard/reports/alfred.md",
          "line": 1,
          "contentHash": "4f6e2d964969ebdd25e5da9484660020dc7d2c82dc3205f6900a4b19f13781c1"
        },
        {
          "kind": "artifact",
          "label": "Fail-closed privilege-membership check before role elevation",
          "path": "src/witan/__tests__/repo-signals.test.ts",
          "line": 1,
          "contentHash": "213989426f8b192b207bf4178276fee4fa623d9f3020163312ce5662e383334f"
        }
      ],
      "findings": [],
      "metrics": [
        {
          "name": "human_gate_documented",
          "label": "Human gate documented",
          "value": 1,
          "max": 1,
          "weight": 0.4,
          "unit": "present",
          "description": "Credits explicit documentation that privileged/credentialed operations are human-executed, never agent-run."
        },
        {
          "name": "fail_closed_privilege_check",
          "label": "Fail-closed privilege check present",
          "value": 1,
          "max": 1,
          "weight": 0.3,
          "unit": "present",
          "description": "Credits code that checks role membership and fails closed before elevating privilege, instead of attempting elevation blind."
        },
        {
          "name": "privilege_escalation_cleanliness",
          "label": "Privilege-escalation cleanliness",
          "value": 1,
          "max": 1,
          "weight": 0.3,
          "unit": "clean",
          "description": "Penalizes code that executes a role-membership GRANT or SUPERUSER escalation with no documented human gate (test/fixture SQL is excluded from this production-code measurement)."
        },
        {
          "name": "protected_path_review_gate",
          "label": "Protected-path review gate",
          "value": 0,
          "max": 1,
          "weight": 0.2,
          "unit": "present",
          "description": "Credits a CODEOWNERS file or documented required-review/branch-protection policy — the general OSS-observable analogue of human-gating changes to sensitive paths."
        }
      ],
      "notes": "B6 rewards documented, fail-closed human gating of privileged/credentialed operations and penalizes ungated privilege-escalation code paths."
    }
  ],
  "archetype": "source",
  "contentReadSummary": {
    "skipped": 32,
    "byReason": {
      "unreadable": 0,
      "tooLarge": 0,
      "excludedByExtension": 32,
      "deniedPath": 0,
      "nonRegularFile": 0
    },
    "unreadableByErrno": {},
    "affectedCriteria": []
  },
  "verdict": "conditional",
  "codeTrustScore": 2.3,
  "processTrustScore": 3.2,
  "overallScore": 2.8
}