witan-batch-1787098803373-595182

Date
Run
unknown @ 7cb06f360dd44efac059848df1a9beee7643b018
Rubric
witan-rubric-v17-2026-07-24
3.1/4.0 overall

Conditional

Code 3.0 · Process 3.2

code 2/5 · process 3/6 measured · low confidence

Criterion profile

Measured scores are plotted on a 0–4 scale. Unknown and not-applicable dimensions remain explicit.

5 measured 1 no data 5 N/A

Code trust

A1Test integrity and regression signal
2.3
A2Data-layer isolation and secrets posture
N/A
A3Production readiness
N/A
A4Dependency hygiene
3.6
A5Claim-vs-reality reconciliation
No data

Process trust

B1Internal process dimension
N/A
B2PR outcome traceability
3.2
B3CI and QA discipline
2.7
B4Audit trail and report-up completeness
3.6
B5Internal process dimension
N/A
B6Privileged-operation human gating
N/A

Code trust

A1

Test integrity and regression signal

dimension band: verified
2.3
  • Test-to-source file ratio1 ratio (capped; 604 raw)
  • Static coverage percentage0/100 percent
  • Verification script ratio2/4 ratio
  • Non-hollow test share491/501 ratio
  • Detected test file docs_src/app_testing/app_a_py310/test_main.py:1 · sha256:e7206e066c05
  • Detected test file docs_src/app_testing/app_b_an_py310/test_main.py:1 · sha256:0983f6ade01f
  • Detected test file docs_src/app_testing/app_b_py310/test_main.py:1 · sha256:0983f6ade01f
  • Detected test file docs_src/async_tests/__init__.py
  • Detected test file docs_src/async_tests/app_a_py310/__init__.py
  • Detected test file docs_src/async_tests/app_a_py310/main.py:1 · sha256:f28e4cbedad7
  • Detected test file docs_src/async_tests/app_a_py310/test_main.py:1 · sha256:a129755184f1
  • Detected test file docs_src/settings/app02_an_py310/test_main.py:1 · sha256:cc6f4b806f7f
  • Configured test runner pyproject.toml:1 · sha256:b4181f59f23f
  • Coverage configuration pyproject.toml:1 · sha256:b4181f59f23f
  • CI workflow runs the test suite .github/workflows/test.yml:1 · sha256:5e24f8017646
A4

Dependency hygiene

dimension band: verified
3.6
  • Declared version range ratio5/5 ratio
  • Lockfile coverage1/1 present
  • Dependency automation ratio1/2 ratio
  • Dependency count sanity1/1 sane
  • Dependency manifest pyproject.toml:1 · sha256:b4181f59f23f
  • Dependency lockfile uv.lock:1 · sha256:04e02a427144
  • Dependency update config .github/dependabot.yml:1 · sha256:92725ac5b657
A5

Claim-vs-reality reconciliation

dimension band: insufficient_data
No data
  • No measured depth metrics supplied.
  • No concrete evidence supplied.

Not applicable to this repository

  • A2 Data-layer isolation and secrets posture — No data layer (DB/ORM/migrations) or ratable secrets surface detected — A2 not applicable to this repo archetype. A ratable surface requires .env* files, .gitignore .env rule, committed/history .env path, or detected signing/HMAC/secret-comparison code; bare env reads (process.env / os.environ / std::env::) do not qualify.
  • A3 Production readiness — No deployable-service surface detected — production-readiness not applicable to this library/CLI archetype. Signals checked: production server entrypoint (HTTP/RPC port binding in main/server/app files, outside examples/tests/demo dirs), deploy config (vercel.json, render.yaml, fly.toml, Procfile, app.yaml, serverless.yml, docker-compose, k8s/helm manifests), CI deploy job (fly deploy, kubectl apply, helm install/upgrade, docker push). A Dockerfile without an explicit runtime start/service command is ambiguous and does not qualify.

Process trust

B2

PR outcome traceability

dimension band: warning
3.2
  • PR trace basic checks2 signals (capped; 23 raw)
  • Recent PR merge ratio0/1 ratio
  • Pull-request CI workflow .github/workflows/add-to-project.yml:1 · sha256:74f130b855a5
  • Pull-request CI workflow .github/workflows/build-docs.yml:1 · sha256:388a7d1eb471
  • Pull-request CI workflow .github/workflows/contributors.yml:1 · sha256:7d91c15909bf
  • finding severity warning: B2 dimension band is warning at 3.2/4.0. Lowest contributing measurements: Recent PR merge ratio 0/1 ratio; PR trace basic checks 2 signals capped (23 raw). To improve: preserve merged pull-request history in the scanned clone; add pull-request templates and outcome-trace records. (Pull-request CI workflow .github/workflows/add-to-project.yml:1 · sha256:74f130b855a5)
B3

CI and QA discipline

dimension band: verified
2.7
  • CI verification depth1/4 signals
  • PR-gate CI workflow count4 workflows (capped; 9 raw)
  • CI workflow .github/workflows/add-to-project.yml:1 · sha256:74f130b855a5
B4

Audit trail and report-up completeness

dimension band: verified
3.6
  • Audit artifact depth3 files (capped; 99 raw)
  • Audit freshness depth48/99 ratio
  • Audit or changelog artifact CITATION.cff:1 · sha256:8feb5e554875
  • Audit or changelog artifact docs/de/docs/advanced/security/http-basic-auth.md:1 · sha256:a1c453720a1d
  • Audit or changelog artifact docs/de/docs/advanced/security/index.md:1 · sha256:f86483015af3
  • Audit or changelog artifact docs/de/docs/advanced/security/oauth2-scopes.md:1 · sha256:304c2794044f
  • Audit or changelog artifact docs/de/docs/tutorial/security/first-steps.md:1 · sha256:d88a5eb95f14

Not applicable to this repository

  • B1 Internal process dimension — Substrate-specific: an internal process dimension is not applicable to external code.
  • B5 Internal process dimension — Substrate-specific: an internal process dimension is not applicable to external code.
  • B6 Privileged-operation human gating — No privileged-operation surface (prod DB admin GRANT/privilege DDL, role escalation, or documented human-gate governance) detected in this repo.

Verified evidence

  • A1 - Test integrity and regression signalDetected test file docs_src/app_testing/app_a_py310/test_main.py:1 · sha256:e7206e066c05
  • A1 - Test integrity and regression signalDetected test file docs_src/app_testing/app_b_an_py310/test_main.py:1 · sha256:0983f6ade01f
  • A1 - Test integrity and regression signalDetected test file docs_src/app_testing/app_b_py310/test_main.py:1 · sha256:0983f6ade01f
  • A1 - Test integrity and regression signalDetected test file docs_src/async_tests/__init__.py
  • A1 - Test integrity and regression signalDetected test file docs_src/async_tests/app_a_py310/__init__.py
  • A1 - Test integrity and regression signalDetected test file docs_src/async_tests/app_a_py310/main.py:1 · sha256:f28e4cbedad7
  • A1 - Test integrity and regression signalDetected test file docs_src/async_tests/app_a_py310/test_main.py:1 · sha256:a129755184f1
  • A1 - Test integrity and regression signalDetected test file docs_src/settings/app02_an_py310/test_main.py:1 · sha256:cc6f4b806f7f
  • A1 - Test integrity and regression signalConfigured test runner pyproject.toml:1 · sha256:b4181f59f23f
  • A1 - Test integrity and regression signalCoverage configuration pyproject.toml:1 · sha256:b4181f59f23f
  • A1 - Test integrity and regression signalCI workflow runs the test suite .github/workflows/test.yml:1 · sha256:5e24f8017646
  • A4 - Dependency hygieneDependency manifest pyproject.toml:1 · sha256:b4181f59f23f
  • A4 - Dependency hygieneDependency lockfile uv.lock:1 · sha256:04e02a427144
  • A4 - Dependency hygieneDependency update config .github/dependabot.yml:1 · sha256:92725ac5b657
  • B3 - CI and QA disciplineCI workflow .github/workflows/add-to-project.yml:1 · sha256:74f130b855a5
  • B4 - Audit trail and report-up completenessAudit or changelog artifact CITATION.cff:1 · sha256:8feb5e554875
  • B4 - Audit trail and report-up completenessAudit or changelog artifact docs/de/docs/advanced/security/http-basic-auth.md:1 · sha256:a1c453720a1d
  • B4 - Audit trail and report-up completenessAudit or changelog artifact docs/de/docs/advanced/security/index.md:1 · sha256:f86483015af3
  • B4 - Audit trail and report-up completenessAudit or changelog artifact docs/de/docs/advanced/security/oauth2-scopes.md:1 · sha256:304c2794044f
  • B4 - Audit trail and report-up completenessAudit or changelog artifact docs/de/docs/tutorial/security/first-steps.md:1 · sha256:d88a5eb95f14

Open / unverified

  • A5 - Claim-vs-reality reconciliationInsufficient data — no measurable signal; excluded from composite.
  • B2 - PR outcome traceabilityfinding severity warning: B2 dimension band is warning at 3.2/4.0. Lowest contributing measurements: Recent PR merge ratio 0/1 ratio; PR trace basic checks 2 signals capped (23 raw). To improve: preserve merged pull-request history in the scanned clone; add pull-request templates and outcome-trace records. (Pull-request CI workflow .github/workflows/add-to-project.yml:1 · sha256:74f130b855a5)