witan-batch-1787098815564-168806

Date
Run
unknown @ 6ff1d8b0d8c134e867a397eef39702a223ebef9e
Rubric
witan-rubric-v17-2026-07-24
2.5/4.0 overall

Conditional

Code 2.6 · Process 2.4

code 3/5 · process 3/6 measured

Criterion profile

Measured scores are plotted on a 0–4 scale. Unknown and not-applicable dimensions remain explicit.

6 measured 0 no data 5 N/A

Code trust

A1Test integrity and regression signal
2.2
A2Data-layer isolation and secrets posture
N/A
A3Production readiness
N/A
A4Dependency hygiene
3.1
A5Claim-vs-reality reconciliation
2.4

Process trust

B1Internal process dimension
N/A
B2PR outcome traceability
3.2
B3CI and QA discipline
2.0
B4Audit trail and report-up completeness
1.9
B5Internal process dimension
N/A
B6Privileged-operation human gating
N/A

Code trust

A1

Test integrity and regression signal

dimension band: verified
2.2
  • Test-to-source file ratio26 ratio (capped; 35 raw)
  • Static coverage percentage0/100 percent
  • Verification script ratio3/4 ratio
  • Non-hollow test share15/34 ratio
  • Detected test file internal/bundler_tests/bundler_css_test.go:1 · sha256:4ca59971537d
  • Detected test file internal/bundler_tests/bundler_dce_test.go:1 · sha256:077703d5e650
  • Detected test file internal/bundler_tests/bundler_default_test.go:1 · sha256:d249d68924f0
  • Detected test file internal/bundler_tests/bundler_glob_test.go:1 · sha256:b1a0fcbc38d7
  • Detected test file internal/bundler_tests/bundler_importphase_test.go:1 · sha256:d56b260cfafc
  • Detected test file internal/bundler_tests/bundler_importstar_test.go:1 · sha256:9c5f3aa40964
  • Detected test file internal/bundler_tests/bundler_importstar_ts_test.go:1 · sha256:5fd6a59f12f6
  • Detected test file internal/bundler_tests/bundler_loader_test.go:1 · sha256:07a896abcd49
  • Configured test runner Makefile:1 · sha256:ca1b97d21eef
  • CI workflow runs the test suite .github/workflows/ci.yml:1 · sha256:a028444642bb
  • finding severity info: Test suite files are present, but no coverage configuration was detected. (Detected test file internal/bundler_tests/bundler_css_test.go:1 · sha256:4ca59971537d)
A4

Dependency hygiene

dimension band: warning
3.1
  • Declared version range ratio59/59 ratio
  • Lockfile coverage1/1 present
  • Dependency automation ratio0/2 ratio
  • Dependency count sanity1/1 sane
  • Dependency manifest npm/esbuild/package.json:1 · sha256:d55d1d19fcc5
  • Dependency lockfile compat-table/package-lock.json:1 · sha256:b9b3bf165f6d
  • finding severity warning: A4 dimension band is warning at 3.1/4.0. Lowest contributing measurements: Dependency automation ratio 0/2 ratio; Declared version range ratio 59/59 ratio. To improve: enable automated dependency updates and an audit command; declare an explicit compatible version for every dependency. (Dependency manifest npm/esbuild/package.json:1 · sha256:d55d1d19fcc5)
A5

Claim-vs-reality reconciliation

dimension band: warning
2.4
  • Claim match rate12/15 ratio
  • Claim source depth3/4 docs
  • Reconciliation artifact depth0/3 artifacts
  • Repository claim source README.md:1 · sha256:d9233b2fb0eb
  • Code presence for claim reconciliation cmd/esbuild/main.go:1 · sha256:3e56d13cfa3b
  • finding severity warning: Claim source and implementation files are present, but no dedicated claim-reality report artifact was supplied. (Repository claim source README.md:1 · sha256:d9233b2fb0eb)

Not applicable to this repository

  • A2 Data-layer isolation and secrets posture — No data layer (DB/ORM/migrations) or ratable secrets surface detected — A2 not applicable to this repo archetype. A ratable surface requires .env* files, .gitignore .env rule, committed/history .env path, or detected signing/HMAC/secret-comparison code; bare env reads (process.env / os.environ / std::env::) do not qualify.
  • A3 Production readiness — No deployable-service surface detected — production-readiness not applicable to this library/CLI archetype. Signals checked: production server entrypoint (HTTP/RPC port binding in main/server/app files, outside examples/tests/demo dirs), deploy config (vercel.json, render.yaml, fly.toml, Procfile, app.yaml, serverless.yml, docker-compose, k8s/helm manifests), CI deploy job (fly deploy, kubectl apply, helm install/upgrade, docker push). A Dockerfile without an explicit runtime start/service command is ambiguous and does not qualify.

Process trust

B2

PR outcome traceability

dimension band: warning
3.2
  • PR trace basic checks2 signals (capped; 4 raw)
  • Recent PR merge ratio0/1 ratio
  • Pull-request CI workflow .github/workflows/ci.yml:1 · sha256:a028444642bb
  • Pull-request CI workflow .github/workflows/e2e.yml:1 · sha256:ea4c80bd05ea
  • Pull-request CI workflow .github/workflows/publish.yml:1 · sha256:8475659bb5fb
  • finding severity warning: B2 dimension band is warning at 3.2/4.0. Lowest contributing measurements: Recent PR merge ratio 0/1 ratio; PR trace basic checks 2 signals capped (4 raw). To improve: preserve merged pull-request history in the scanned clone; add pull-request templates and outcome-trace records. (Pull-request CI workflow .github/workflows/ci.yml:1 · sha256:a028444642bb)
B3

CI and QA discipline

dimension band: verified
2.0
  • CI verification depth2/4 signals
  • PR-gate CI workflow count2/4 workflows
  • CI workflow .github/workflows/ci.yml:1 · sha256:a028444642bb
B4

Audit trail and report-up completeness

dimension band: verified
1.9
  • Audit artifact depth1/3 files
  • Audit freshness depth1/1 ratio
  • Audit or changelog artifact CHANGELOG.md:1 · sha256:994fc1638806

Not applicable to this repository

  • B1 Internal process dimension — Substrate-specific: an internal process dimension is not applicable to external code.
  • B5 Internal process dimension — Substrate-specific: an internal process dimension is not applicable to external code.
  • B6 Privileged-operation human gating — No privileged-operation surface (prod DB admin GRANT/privilege DDL, role escalation, or documented human-gate governance) detected in this repo.

Verified evidence

  • A1 - Test integrity and regression signalDetected test file internal/bundler_tests/bundler_css_test.go:1 · sha256:4ca59971537d
  • A1 - Test integrity and regression signalDetected test file internal/bundler_tests/bundler_dce_test.go:1 · sha256:077703d5e650
  • A1 - Test integrity and regression signalDetected test file internal/bundler_tests/bundler_default_test.go:1 · sha256:d249d68924f0
  • A1 - Test integrity and regression signalDetected test file internal/bundler_tests/bundler_glob_test.go:1 · sha256:b1a0fcbc38d7
  • A1 - Test integrity and regression signalDetected test file internal/bundler_tests/bundler_importphase_test.go:1 · sha256:d56b260cfafc
  • A1 - Test integrity and regression signalDetected test file internal/bundler_tests/bundler_importstar_test.go:1 · sha256:9c5f3aa40964
  • A1 - Test integrity and regression signalDetected test file internal/bundler_tests/bundler_importstar_ts_test.go:1 · sha256:5fd6a59f12f6
  • A1 - Test integrity and regression signalDetected test file internal/bundler_tests/bundler_loader_test.go:1 · sha256:07a896abcd49
  • A1 - Test integrity and regression signalConfigured test runner Makefile:1 · sha256:ca1b97d21eef
  • A1 - Test integrity and regression signalCI workflow runs the test suite .github/workflows/ci.yml:1 · sha256:a028444642bb
  • B3 - CI and QA disciplineCI workflow .github/workflows/ci.yml:1 · sha256:a028444642bb
  • B4 - Audit trail and report-up completenessAudit or changelog artifact CHANGELOG.md:1 · sha256:994fc1638806

Open / unverified

  • A4 - Dependency hygienefinding severity warning: A4 dimension band is warning at 3.1/4.0. Lowest contributing measurements: Dependency automation ratio 0/2 ratio; Declared version range ratio 59/59 ratio. To improve: enable automated dependency updates and an audit command; declare an explicit compatible version for every dependency. (Dependency manifest npm/esbuild/package.json:1 · sha256:d55d1d19fcc5)
  • A5 - Claim-vs-reality reconciliationfinding severity warning: Claim source and implementation files are present, but no dedicated claim-reality report artifact was supplied. (Repository claim source README.md:1 · sha256:d9233b2fb0eb)
  • B2 - PR outcome traceabilityfinding severity warning: B2 dimension band is warning at 3.2/4.0. Lowest contributing measurements: Recent PR merge ratio 0/1 ratio; PR trace basic checks 2 signals capped (4 raw). To improve: preserve merged pull-request history in the scanned clone; add pull-request templates and outcome-trace records. (Pull-request CI workflow .github/workflows/ci.yml:1 · sha256:a028444642bb)