express

Date
Run
unknown @ ba006766fb964571723138708eacaba0f55759cd
Rubric
witan-rubric-v17-2026-07-24
3.0/4.0 overall

Conditional

Code 2.8 · Process 3.2

code 2/5 · process 3/6 measured · low confidence

Criterion profile

Measured scores are plotted on a 0–4 scale. Unknown and not-applicable dimensions remain explicit.

5 measured 0 no data 6 N/A

Code trust

A1Test integrity and regression signal
2.3
A2Data-layer isolation and secrets posture
N/A
A3Production readiness
N/A
A4Dependency hygiene
3.4
A5Claim-vs-reality reconciliation
N/A

Process trust

B1Internal process dimension
N/A
B2PR outcome traceability
4.0
B3CI and QA discipline
3.6
B4Audit trail and report-up completeness
1.9
B5Internal process dimension
N/A
B6Privileged-operation human gating
N/A

Code trust

A1

Test integrity and regression signal

dimension band: verified
2.3
  • Test-to-source file ratio7 ratio (capped; 95 raw)
  • Static coverage percentage0/100 percent
  • Verification script ratio2/4 ratio
  • Non-hollow test share89/89 ratio
  • Detected test file test/Route.js:1 · sha256:4607c2b70f5b
  • Detected test file test/Router.js:1 · sha256:721ffc840d1c
  • Detected test file test/acceptance/auth.js:1 · sha256:788ee64833f7
  • Detected test file test/acceptance/content-negotiation.js:2 · sha256:aeb415791ce1
  • Detected test file test/acceptance/cookie-sessions.js:2 · sha256:65f79320983c
  • Detected test file test/acceptance/cookies.js:2 · sha256:02525d857252
  • Detected test file test/acceptance/downloads.js:2 · sha256:404320d52882
  • Detected test file test/acceptance/ejs.js:2 · sha256:3babd4b53917
  • Configured test runner package.json:1 · sha256:01f5d42cf38c
  • Coverage configuration package.json:1 · sha256:01f5d42cf38c
  • CI workflow runs the test suite .github/workflows/ci.yml:1 · sha256:f50b3232db78
A4

Dependency hygiene

dimension band: verified
3.4
  • Declared version range ratio44/44 ratio
  • Dependency automation ratio1/2 ratio
  • Dependency count sanity1/1 sane
  • Dependency manifest package.json:1 · sha256:01f5d42cf38c
  • Dependency update config .github/dependabot.yml:1 · sha256:af4647d37cf7

Not applicable to this repository

  • A2 Data-layer isolation and secrets posture — No data layer (DB/ORM/migrations) or ratable secrets surface detected — A2 not applicable to this repo archetype. A ratable surface requires .env* files, .gitignore .env rule, committed/history .env path, or detected signing/HMAC/secret-comparison code; bare env reads (process.env / os.environ / std::env::) do not qualify.
  • A3 Production readiness — No deployable-service surface detected — production-readiness not applicable to this library/CLI archetype. Signals checked: production server entrypoint (HTTP/RPC port binding in main/server/app files, outside examples/tests/demo dirs), deploy config (vercel.json, render.yaml, fly.toml, Procfile, app.yaml, serverless.yml, docker-compose, k8s/helm manifests), CI deploy job (fly deploy, kubectl apply, helm install/upgrade, docker push). A Dockerfile without an explicit runtime start/service command is ambiguous and does not qualify.
  • A5 Claim-vs-reality reconciliation — No README or docs found — nothing is claimed about this repo, so there is nothing for A5 to reconcile against.

Process trust

B2

PR outcome traceability

dimension band: verified
4.0
  • PR trace basic checks2 signals (capped; 4 raw)
  • Recent PR merge ratio1/1 ratio
  • Pull-request CI workflow .github/workflows/ci.yml:1 · sha256:f50b3232db78
  • Pull-request CI workflow .github/workflows/codeql.yml:1 · sha256:de0a7a113e14
  • Pull-request CI workflow .github/workflows/legacy.yml:1 · sha256:1d537259a4e6
B3

CI and QA discipline

dimension band: verified
3.6
  • CI verification depth3/4 signals
  • PR-gate CI workflow count4/4 workflows
  • Test script package.json:1 · sha256:01f5d42cf38c
  • Lint script package.json:1 · sha256:01f5d42cf38c
  • CI workflow .github/workflows/ci.yml:1 · sha256:f50b3232db78
B4

Audit trail and report-up completeness

dimension band: verified
1.9
  • Audit artifact depth1/3 files
  • Audit freshness depth1/1 ratio
  • Audit or changelog artifact History.md:1 · sha256:bd9f9bf85316

Not applicable to this repository

  • B1 Internal process dimension — Substrate-specific: an internal process dimension is not applicable to external code.
  • B5 Internal process dimension — Substrate-specific: an internal process dimension is not applicable to external code.
  • B6 Privileged-operation human gating — No privileged-operation surface (prod DB admin GRANT/privilege DDL, role escalation, or documented human-gate governance) detected in this repo.

Verified evidence

  • A1 - Test integrity and regression signalDetected test file test/Route.js:1 · sha256:4607c2b70f5b
  • A1 - Test integrity and regression signalDetected test file test/Router.js:1 · sha256:721ffc840d1c
  • A1 - Test integrity and regression signalDetected test file test/acceptance/auth.js:1 · sha256:788ee64833f7
  • A1 - Test integrity and regression signalDetected test file test/acceptance/content-negotiation.js:2 · sha256:aeb415791ce1
  • A1 - Test integrity and regression signalDetected test file test/acceptance/cookie-sessions.js:2 · sha256:65f79320983c
  • A1 - Test integrity and regression signalDetected test file test/acceptance/cookies.js:2 · sha256:02525d857252
  • A1 - Test integrity and regression signalDetected test file test/acceptance/downloads.js:2 · sha256:404320d52882
  • A1 - Test integrity and regression signalDetected test file test/acceptance/ejs.js:2 · sha256:3babd4b53917
  • A1 - Test integrity and regression signalConfigured test runner package.json:1 · sha256:01f5d42cf38c
  • A1 - Test integrity and regression signalCoverage configuration package.json:1 · sha256:01f5d42cf38c
  • A1 - Test integrity and regression signalCI workflow runs the test suite .github/workflows/ci.yml:1 · sha256:f50b3232db78
  • A4 - Dependency hygieneDependency manifest package.json:1 · sha256:01f5d42cf38c
  • A4 - Dependency hygieneDependency update config .github/dependabot.yml:1 · sha256:af4647d37cf7
  • B2 - PR outcome traceabilityPull-request CI workflow .github/workflows/ci.yml:1 · sha256:f50b3232db78
  • B2 - PR outcome traceabilityPull-request CI workflow .github/workflows/codeql.yml:1 · sha256:de0a7a113e14
  • B2 - PR outcome traceabilityPull-request CI workflow .github/workflows/legacy.yml:1 · sha256:1d537259a4e6
  • B3 - CI and QA disciplineTest script package.json:1 · sha256:01f5d42cf38c
  • B3 - CI and QA disciplineLint script package.json:1 · sha256:01f5d42cf38c
  • B3 - CI and QA disciplineCI workflow .github/workflows/ci.yml:1 · sha256:f50b3232db78
  • B4 - Audit trail and report-up completenessAudit or changelog artifact History.md:1 · sha256:bd9f9bf85316

Open / unverified

  • No open findings listed.