Django

Date
Run
unknown @ 65a9f14196c338d70889bd54753370606b3fb4eb
Rubric
witan-rubric-v17-2026-07-24
3.2/4.0 overall

Conditional

Code 2.6 · Process 3.8

code 3/5 · process 2/6 measured · low confidence

Criterion profile

Measured scores are plotted on a 0–4 scale. Unknown and not-applicable dimensions remain explicit.

5 measured 0 no data 6 N/A

Code trust

A1Test integrity and regression signal
2.8
A2Data-layer isolation and secrets posture
2.8
A3Production readiness
N/A
A4Dependency hygiene
2.1
A5Claim-vs-reality reconciliation
N/A

Process trust

B1Internal process dimension
N/A
B2PR outcome traceability
4.0
B3CI and QA discipline
3.6
B4Audit trail and report-up completeness
N/A
B5Internal process dimension
N/A
B6Privileged-operation human gating
N/A

Code trust

A1

Test integrity and regression signal

dimension band: verified
2.8
  • Test-to-source file ratio1 ratio (capped; 2267 raw)
  • Static coverage percentage0/100 percent
  • Verification script ratio4/4 ratio
  • Non-hollow test share858/875 ratio
  • Detected test file django/test/__init__.py:1 · sha256:5f5d82f7c94a
  • Detected test file django/test/client.py:1 · sha256:04fab2a961cd
  • Detected test file django/test/html.py:1 · sha256:5bdec1f2401e
  • Detected test file django/test/runner.py:1 · sha256:a43abfb53b08
  • Detected test file django/test/selenium.py:1 · sha256:a665939110f6
  • Detected test file django/test/signals.py:1 · sha256:40a6de190da6
  • Detected test file django/test/testcases.py:1 · sha256:1b360268bc91
  • Detected test file django/test/utils.py:1 · sha256:93071067bbf1
  • Configured test runner docs/Makefile:1 · sha256:072b14b4d497
  • Configured test runner tox.ini:1 · sha256:47d70986367b
  • CI workflow runs the test suite .github/workflows/schedule_tests.yml:1 · sha256:f2ab5bab19a1
  • finding severity info: Test suite files are present, but no coverage configuration was detected. (Detected test file django/test/__init__.py:1 · sha256:5f5d82f7c94a)
A2

Data-layer isolation and secrets posture

dimension band: warning
2.8
  • Secret cleanliness1/1 clean
  • Environment handling depth0/3 practices
  • Data layer migration django/conf/app_template/migrations/__init__.py-tpl
  • finding severity warning: A2 dimension band is warning at 2.8/4.0. Lowest contributing measurements: Environment handling depth 0/3 practices; Secret cleanliness 1/1 clean. To improve: document and enforce safe environment-secret handling; remove committed secrets and rotate any exposed credentials. (Data layer migration django/conf/app_template/migrations/__init__.py-tpl)
A4

Dependency hygiene

dimension band: warning
2.1
  • Declared version range ratio9/13 ratio
  • Dependency automation ratio0/2 ratio
  • Dependency count sanity1/1 sane
  • Dependency manifest docs/requirements.txt:1 · sha256:aa58469ea781
  • finding severity warning: A4 dimension band is warning at 2.1/4.0. Lowest contributing measurements: Dependency automation ratio 0/2 ratio; Declared version range ratio 9/13 ratio. To improve: enable automated dependency updates and an audit command; declare an explicit compatible version for every dependency. (Dependency manifest docs/requirements.txt:1 · sha256:aa58469ea781)

Not applicable to this repository

  • A3 Production readiness — No deployable-service surface detected — production-readiness not applicable to this library/CLI archetype. Signals checked: production server entrypoint (HTTP/RPC port binding in main/server/app files, outside examples/tests/demo dirs), deploy config (vercel.json, render.yaml, fly.toml, Procfile, app.yaml, serverless.yml, docker-compose, k8s/helm manifests), CI deploy job (fly deploy, kubectl apply, helm install/upgrade, docker push). A Dockerfile without an explicit runtime start/service command is ambiguous and does not qualify.
  • A5 Claim-vs-reality reconciliation — No README or docs found — nothing is claimed about this repo, so there is nothing for A5 to reconcile against.

Process trust

B2

PR outcome traceability

dimension band: verified
4.0
  • PR trace basic checks2 signals (capped; 20 raw)
  • Recent PR merge ratio1/1 ratio
  • Pull-request CI workflow .github/workflows/benchmark.yml:1 · sha256:0458e12b829d
  • Pull-request CI workflow .github/workflows/check-migrations.yml:1 · sha256:2647a7fcd299
  • Pull-request CI workflow .github/workflows/check_commit_messages.yml:1 · sha256:2fe53834db82
  • Pull request template .github/pull_request_template.md:1 · sha256:3c3cc0e20540
B3

CI and QA discipline

dimension band: verified
3.6
  • CI verification depth3/4 signals
  • PR-gate CI workflow count4 workflows (capped; 15 raw)
  • Test script package.json:1 · sha256:19afbf089af1
  • CI workflow .github/workflows/benchmark.yml:1 · sha256:0458e12b829d

Not applicable to this repository

  • B1 Internal process dimension — Substrate-specific: an internal process dimension is not applicable to external code.
  • B4 Audit trail and report-up completeness — Only a static security-policy artifact (e.g. SECURITY.md) was detected — no committed CHANGELOG/CHANGES/HISTORY/NEWS/AUDIT/STATUS/release-notes/runbook/provenance file to rate for an audit trail. The project may publish release history outside the repository (e.g. GitHub Releases). B4 has no ratable surface here; it is excluded rather than scored.
  • B5 Internal process dimension — Substrate-specific: an internal process dimension is not applicable to external code.
  • B6 Privileged-operation human gating — No privileged-operation surface (prod DB admin GRANT/privilege DDL, role escalation, or documented human-gate governance) detected in this repo.

Verified evidence

  • A1 - Test integrity and regression signalDetected test file django/test/__init__.py:1 · sha256:5f5d82f7c94a
  • A1 - Test integrity and regression signalDetected test file django/test/client.py:1 · sha256:04fab2a961cd
  • A1 - Test integrity and regression signalDetected test file django/test/html.py:1 · sha256:5bdec1f2401e
  • A1 - Test integrity and regression signalDetected test file django/test/runner.py:1 · sha256:a43abfb53b08
  • A1 - Test integrity and regression signalDetected test file django/test/selenium.py:1 · sha256:a665939110f6
  • A1 - Test integrity and regression signalDetected test file django/test/signals.py:1 · sha256:40a6de190da6
  • A1 - Test integrity and regression signalDetected test file django/test/testcases.py:1 · sha256:1b360268bc91
  • A1 - Test integrity and regression signalDetected test file django/test/utils.py:1 · sha256:93071067bbf1
  • A1 - Test integrity and regression signalConfigured test runner docs/Makefile:1 · sha256:072b14b4d497
  • A1 - Test integrity and regression signalConfigured test runner tox.ini:1 · sha256:47d70986367b
  • A1 - Test integrity and regression signalCI workflow runs the test suite .github/workflows/schedule_tests.yml:1 · sha256:f2ab5bab19a1
  • B2 - PR outcome traceabilityPull-request CI workflow .github/workflows/benchmark.yml:1 · sha256:0458e12b829d
  • B2 - PR outcome traceabilityPull-request CI workflow .github/workflows/check-migrations.yml:1 · sha256:2647a7fcd299
  • B2 - PR outcome traceabilityPull-request CI workflow .github/workflows/check_commit_messages.yml:1 · sha256:2fe53834db82
  • B2 - PR outcome traceabilityPull request template .github/pull_request_template.md:1 · sha256:3c3cc0e20540
  • B3 - CI and QA disciplineTest script package.json:1 · sha256:19afbf089af1
  • B3 - CI and QA disciplineCI workflow .github/workflows/benchmark.yml:1 · sha256:0458e12b829d

Open / unverified

  • A2 - Data-layer isolation and secrets posturefinding severity warning: A2 dimension band is warning at 2.8/4.0. Lowest contributing measurements: Environment handling depth 0/3 practices; Secret cleanliness 1/1 clean. To improve: document and enforce safe environment-secret handling; remove committed secrets and rotate any exposed credentials. (Data layer migration django/conf/app_template/migrations/__init__.py-tpl)
  • A4 - Dependency hygienefinding severity warning: A4 dimension band is warning at 2.1/4.0. Lowest contributing measurements: Dependency automation ratio 0/2 ratio; Declared version range ratio 9/13 ratio. To improve: enable automated dependency updates and an audit command; declare an explicit compatible version for every dependency. (Dependency manifest docs/requirements.txt:1 · sha256:aa58469ea781)