witan-batch-1787098800962-493388

Date
Run
unknown @ 36e4a824f340fdee7ed50937ba8e7f6bc7d17f81
Rubric
witan-rubric-v17-2026-07-24
2.9/4.0 overall

Conditional

Code 2.7 · Process 3.0

code 4/5 · process 3/6 measured

Criterion profile

Measured scores are plotted on a 0–4 scale. Unknown and not-applicable dimensions remain explicit.

7 measured 0 no data 4 N/A

Code trust

A1Test integrity and regression signal
2.3
A2Data-layer isolation and secrets posture
3.2
A3Production readiness
N/A
A4Dependency hygiene
2.9
A5Claim-vs-reality reconciliation
2.2

Process trust

B1Internal process dimension
N/A
B2PR outcome traceability
3.2
B3CI and QA discipline
2.1
B4Audit trail and report-up completeness
3.7
B5Internal process dimension
N/A
B6Privileged-operation human gating
N/A

Code trust

A1

Test integrity and regression signal

dimension band: verified
2.3
  • Test-to-source file ratio27 ratio (capped; 59 raw)
  • Static coverage percentage0/100 percent
  • Verification script ratio2/4 ratio
  • Non-hollow test share28/28 ratio
  • Detected test file examples/javascript/tests/conftest.py:1 · sha256:aff1ac8ea5b7
  • Detected test file examples/javascript/tests/test_js_example.py:1 · sha256:52a0ce22402b
  • Detected test file examples/tutorial/tests/conftest.py:1 · sha256:2778b7c035d9
  • Detected test file examples/tutorial/tests/data.sql:1 · sha256:244a542220a6
  • Detected test file examples/tutorial/tests/test_auth.py:1 · sha256:cbbe178c9980
  • Detected test file examples/tutorial/tests/test_blog.py:1 · sha256:a4c01c486e86
  • Detected test file examples/tutorial/tests/test_db.py:1 · sha256:324baea21b98
  • Detected test file examples/tutorial/tests/test_factory.py:1 · sha256:1906cfed379a
  • Configured test runner pyproject.toml:1 · sha256:b006962b5906
  • Coverage configuration pyproject.toml:1 · sha256:b006962b5906
A2

Data-layer isolation and secrets posture

dimension band: verified
3.2
  • Secret cleanliness1/1 clean
  • Environment handling depth1/3 practices
  • .env path detected in git history .git · sha256:36e4a824f340
A4

Dependency hygiene

dimension band: warning
2.9
  • Declared version range ratio27/31 ratio
  • Lockfile coverage1/1 present
  • Dependency automation ratio0/2 ratio
  • Dependency count sanity1/1 sane
  • Dependency manifest examples/celery/requirements.txt:1 · sha256:96eaefbbd532
  • Dependency lockfile uv.lock:1 · sha256:2c98e34b7d92
  • finding severity warning: A4 dimension band is warning at 2.9/4.0. Lowest contributing measurements: Dependency automation ratio 0/2 ratio; Declared version range ratio 27/31 ratio. To improve: enable automated dependency updates and an audit command; declare an explicit compatible version for every dependency. (Dependency manifest examples/celery/requirements.txt:1 · sha256:96eaefbbd532)
A5

Claim-vs-reality reconciliation

dimension band: warning
2.2
  • Claim match rate12/13 ratio
  • Claim source depth1/4 docs
  • Reconciliation artifact depth0/3 artifacts
  • Repository claim source README.md:1 · sha256:1f2de14735b1
  • Code presence for claim reconciliation src/flask/__init__.py:1 · sha256:2daebda4dc29
  • finding severity warning: Claim source and implementation files are present, but no dedicated claim-reality report artifact was supplied. (Repository claim source README.md:1 · sha256:1f2de14735b1)

Not applicable to this repository

  • A3 Production readiness — No deployable-service surface detected — production-readiness not applicable to this library/CLI archetype. Signals checked: production server entrypoint (HTTP/RPC port binding in main/server/app files, outside examples/tests/demo dirs), deploy config (vercel.json, render.yaml, fly.toml, Procfile, app.yaml, serverless.yml, docker-compose, k8s/helm manifests), CI deploy job (fly deploy, kubectl apply, helm install/upgrade, docker push). A Dockerfile without an explicit runtime start/service command is ambiguous and does not qualify.

Process trust

B2

PR outcome traceability

dimension band: warning
3.2
  • PR trace basic checks2 signals (capped; 6 raw)
  • Recent PR merge ratio0/1 ratio
  • Pull-request CI workflow .github/workflows/lock.yaml:1 · sha256:a1beaa8eb392
  • Pull-request CI workflow .github/workflows/pre-commit.yaml:1 · sha256:6ceaadd5d41f
  • Pull-request CI workflow .github/workflows/publish.yaml:1 · sha256:d6ebee41546c
  • Pull request template .github/pull_request_template.md:1 · sha256:f92d7fa6366d
  • finding severity warning: B2 dimension band is warning at 3.2/4.0. Lowest contributing measurements: Recent PR merge ratio 0/1 ratio; PR trace basic checks 2 signals capped (6 raw). To improve: preserve merged pull-request history in the scanned clone; add pull-request templates and outcome-trace records. (Pull-request CI workflow .github/workflows/lock.yaml:1 · sha256:a1beaa8eb392)
B3

CI and QA discipline

dimension band: verified
2.1
  • CI verification depth1/4 signals
  • PR-gate CI workflow count3/4 workflows
  • CI workflow .github/workflows/lock.yaml:1 · sha256:a1beaa8eb392
B4

Audit trail and report-up completeness

dimension band: verified
3.7
  • Audit artifact depth3/3 files
  • Audit freshness depth2/3 ratio
  • Audit or changelog artifact CHANGES.rst:1 · sha256:c850d97d088d
  • Audit or changelog artifact docs/changes.rst:1 · sha256:94c7e3657f87
  • Audit or changelog artifact docs/web-security.rst:1 · sha256:75044a9c1f60

Not applicable to this repository

  • B1 Internal process dimension — Substrate-specific: an internal process dimension is not applicable to external code.
  • B5 Internal process dimension — Substrate-specific: an internal process dimension is not applicable to external code.
  • B6 Privileged-operation human gating — No privileged-operation surface (prod DB admin GRANT/privilege DDL, role escalation, or documented human-gate governance) detected in this repo.

Verified evidence

  • A1 - Test integrity and regression signalDetected test file examples/javascript/tests/conftest.py:1 · sha256:aff1ac8ea5b7
  • A1 - Test integrity and regression signalDetected test file examples/javascript/tests/test_js_example.py:1 · sha256:52a0ce22402b
  • A1 - Test integrity and regression signalDetected test file examples/tutorial/tests/conftest.py:1 · sha256:2778b7c035d9
  • A1 - Test integrity and regression signalDetected test file examples/tutorial/tests/data.sql:1 · sha256:244a542220a6
  • A1 - Test integrity and regression signalDetected test file examples/tutorial/tests/test_auth.py:1 · sha256:cbbe178c9980
  • A1 - Test integrity and regression signalDetected test file examples/tutorial/tests/test_blog.py:1 · sha256:a4c01c486e86
  • A1 - Test integrity and regression signalDetected test file examples/tutorial/tests/test_db.py:1 · sha256:324baea21b98
  • A1 - Test integrity and regression signalDetected test file examples/tutorial/tests/test_factory.py:1 · sha256:1906cfed379a
  • A1 - Test integrity and regression signalConfigured test runner pyproject.toml:1 · sha256:b006962b5906
  • A1 - Test integrity and regression signalCoverage configuration pyproject.toml:1 · sha256:b006962b5906
  • A2 - Data-layer isolation and secrets posture.env path detected in git history .git · sha256:36e4a824f340
  • B3 - CI and QA disciplineCI workflow .github/workflows/lock.yaml:1 · sha256:a1beaa8eb392
  • B4 - Audit trail and report-up completenessAudit or changelog artifact CHANGES.rst:1 · sha256:c850d97d088d
  • B4 - Audit trail and report-up completenessAudit or changelog artifact docs/changes.rst:1 · sha256:94c7e3657f87
  • B4 - Audit trail and report-up completenessAudit or changelog artifact docs/web-security.rst:1 · sha256:75044a9c1f60

Open / unverified

  • A4 - Dependency hygienefinding severity warning: A4 dimension band is warning at 2.9/4.0. Lowest contributing measurements: Dependency automation ratio 0/2 ratio; Declared version range ratio 27/31 ratio. To improve: enable automated dependency updates and an audit command; declare an explicit compatible version for every dependency. (Dependency manifest examples/celery/requirements.txt:1 · sha256:96eaefbbd532)
  • A5 - Claim-vs-reality reconciliationfinding severity warning: Claim source and implementation files are present, but no dedicated claim-reality report artifact was supplied. (Repository claim source README.md:1 · sha256:1f2de14735b1)
  • B2 - PR outcome traceabilityfinding severity warning: B2 dimension band is warning at 3.2/4.0. Lowest contributing measurements: Recent PR merge ratio 0/1 ratio; PR trace basic checks 2 signals capped (6 raw). To improve: preserve merged pull-request history in the scanned clone; add pull-request templates and outcome-trace records. (Pull-request CI workflow .github/workflows/lock.yaml:1 · sha256:a1beaa8eb392)