{
  "productSlug": "witan-batch-1787098800962-493388",
  "productDisplayName": "witan-batch-1787098800962-493388",
  "repo": {
    "headSha": "36e4a824f340fdee7ed50937ba8e7f6bc7d17f81"
  },
  "rubricVersion": "witan-rubric-v17-2026-07-24",
  "criteria": [
    {
      "id": "A1",
      "title": "Test integrity and regression signal",
      "category": "code_trust",
      "score": 2.3,
      "status": "verified",
      "evidence": [
        {
          "kind": "test_run",
          "label": "Detected test file",
          "path": "examples/javascript/tests/conftest.py",
          "line": 1,
          "contentHash": "aff1ac8ea5b7c6e4d7adf67a0eae5c13cbb9adf38e1a2434e6cc7e6824c56b11"
        },
        {
          "kind": "test_run",
          "label": "Detected test file",
          "path": "examples/javascript/tests/test_js_example.py",
          "line": 1,
          "contentHash": "52a0ce22402bb671b391cd278c2ab0865d2d5f9d6daf8d4387ef23337f0a026f"
        },
        {
          "kind": "test_run",
          "label": "Detected test file",
          "path": "examples/tutorial/tests/conftest.py",
          "line": 1,
          "contentHash": "2778b7c035d917bb0909ec6ee2f9d61ccba030ff8ae635ff65a52c133ec5afca"
        },
        {
          "kind": "test_run",
          "label": "Detected test file",
          "path": "examples/tutorial/tests/data.sql",
          "line": 1,
          "contentHash": "244a542220a64bdbf9bd3340f8280551b95e6d3248ead974fdd0a07a7dd06a0c"
        },
        {
          "kind": "test_run",
          "label": "Detected test file",
          "path": "examples/tutorial/tests/test_auth.py",
          "line": 1,
          "contentHash": "cbbe178c9980d8499561d8eae72f01b8abeead2fa10c9d5f71427da4af38a938"
        },
        {
          "kind": "test_run",
          "label": "Detected test file",
          "path": "examples/tutorial/tests/test_blog.py",
          "line": 1,
          "contentHash": "a4c01c486e86aed522c3ade398bf4016f6ef59bbada2c7c5f69eb55ce297877c"
        },
        {
          "kind": "test_run",
          "label": "Detected test file",
          "path": "examples/tutorial/tests/test_db.py",
          "line": 1,
          "contentHash": "324baea21b981575b4e6d92b6517f21ec2ad86a6138010863a9fcfb4f984e649"
        },
        {
          "kind": "test_run",
          "label": "Detected test file",
          "path": "examples/tutorial/tests/test_factory.py",
          "line": 1,
          "contentHash": "1906cfed379afe315b6ad7db3c71c951ac87c53b57b28b04b5b6c84df2a79e01"
        },
        {
          "kind": "test_run",
          "label": "Configured test runner",
          "path": "pyproject.toml",
          "line": 1,
          "contentHash": "b006962b5906885658cc3f600a906d76a659a77b11cadda4c6ab6e9a0b950c2d"
        },
        {
          "kind": "coverage",
          "label": "Coverage configuration",
          "path": "pyproject.toml",
          "line": 1,
          "contentHash": "b006962b5906885658cc3f600a906d76a659a77b11cadda4c6ab6e9a0b950c2d"
        }
      ],
      "findings": [],
      "metrics": [
        {
          "name": "test_to_source_ratio",
          "label": "Test-to-source file ratio",
          "value": 59,
          "max": 27,
          "kind": "saturating_count",
          "weight": 0.3,
          "unit": "ratio",
          "description": "Measures how much concrete test surface exists relative to implementation surface."
        },
        {
          "name": "coverage_percent",
          "label": "Static coverage percentage",
          "value": 0,
          "max": 100,
          "weight": 0.3,
          "unit": "percent",
          "description": "Uses a static coverage report value or configured threshold when present, without running tests."
        },
        {
          "name": "verification_script_ratio",
          "label": "Verification script ratio",
          "value": 2,
          "max": 4,
          "kind": "saturating_count",
          "weight": 0.25,
          "unit": "ratio",
          "description": "Measures explicit test/lint/typecheck verification commands (via npm script or CI-invoked tool) plus test runner configuration."
        },
        {
          "name": "non_hollow_test_share",
          "label": "Non-hollow test share",
          "value": 28,
          "max": 28,
          "weight": 0.15,
          "unit": "ratio",
          "description": "Penalizes skipped or placeholder-only test files; test-directory support scaffolding (helpers/fixtures with no test in them) is excluded from the denominator."
        }
      ],
      "notes": "A1 is detected from real test files, test runner configuration, and optional coverage configuration."
    },
    {
      "id": "A2",
      "title": "Data-layer isolation and secrets posture",
      "category": "code_trust",
      "score": 3.2,
      "status": "verified",
      "evidence": [
        {
          "kind": "secret_scan",
          "label": ".env path detected in git history",
          "path": ".git",
          "contentHash": "36e4a824f340fdee7ed50937ba8e7f6bc7d17f81"
        }
      ],
      "findings": [],
      "metrics": [
        {
          "name": "secret_cleanliness",
          "label": "Secret cleanliness",
          "value": 1,
          "max": 1,
          "weight": 0.7,
          "unit": "clean",
          "description": "Credits absence of committed or recent-history secret findings in the static scan."
        },
        {
          "name": "env_handling_depth",
          "label": "Environment handling depth",
          "value": 1,
          "max": 3,
          "weight": 0.3,
          "unit": "practices",
          "description": "Counts three bounded env-handling practices (0–3): template file, gitignore rule, env reads in any supported language."
        }
      ],
      "notes": "History secret scanning covers all reachable git history for credential-pattern paths unless the explicit credential-blob safety valve is reported."
    },
    {
      "id": "A3",
      "title": "Production readiness",
      "category": "code_trust",
      "score": 0,
      "status": "not_applicable",
      "evidence": [],
      "findings": [],
      "metrics": [],
      "notes": "No deployable-service surface detected — production-readiness not applicable to this library/CLI archetype. Signals checked: production server entrypoint (HTTP/RPC port binding in main/server/app files, outside examples/tests/demo dirs), deploy config (vercel.json, render.yaml, fly.toml, Procfile, app.yaml, serverless.yml, docker-compose, k8s/helm manifests), CI deploy job (fly deploy, kubectl apply, helm install/upgrade, docker push). A Dockerfile without an explicit runtime start/service command is ambiguous and does not qualify."
    },
    {
      "id": "A4",
      "title": "Dependency hygiene",
      "category": "code_trust",
      "score": 2.9,
      "status": "warning",
      "evidence": [
        {
          "kind": "dependency_report",
          "label": "Dependency manifest",
          "path": "examples/celery/requirements.txt",
          "line": 1,
          "contentHash": "96eaefbbd532b79f687e17d0418807257cddf6f9c1d15aad0b11683ebf23a382"
        },
        {
          "kind": "dependency_report",
          "label": "Dependency lockfile",
          "path": "uv.lock",
          "line": 1,
          "contentHash": "2c98e34b7d9219e3c3bfa19dece73405f6809703244e99076271437f68ade565"
        }
      ],
      "findings": [
        {
          "severity": "warning",
          "summary": "A4 metric-derived score is 2.9/4.0, in the warning band — no single finding drove this; it reflects the combined metric weighting below.",
          "evidence": {
            "kind": "dependency_report",
            "label": "Dependency manifest",
            "path": "examples/celery/requirements.txt",
            "line": 1,
            "contentHash": "96eaefbbd532b79f687e17d0418807257cddf6f9c1d15aad0b11683ebf23a382"
          }
        }
      ],
      "metrics": [
        {
          "name": "declared_version_range_ratio",
          "label": "Declared version range ratio",
          "value": 27,
          "max": 31,
          "weight": 0.5,
          "unit": "ratio",
          "description": "Measures dependencies declared with an explicit version constraint (range or exact); a library correctly ships ranges, so ranges earn full credit here."
        },
        {
          "name": "lockfile_coverage",
          "label": "Lockfile coverage",
          "value": 1,
          "max": 1,
          "weight": 0.3,
          "unit": "present",
          "description": "Credited when present (reproducible dev/CI installs); a library without a committed lockfile is not penalized — consumers resolve their own trees."
        },
        {
          "name": "dependency_automation_ratio",
          "label": "Dependency automation ratio",
          "value": 0,
          "max": 2,
          "weight": 0.25,
          "unit": "ratio",
          "description": "Credits automated dependency updates and package-manager audit hooks."
        },
        {
          "name": "dependency_count_sanity",
          "label": "Dependency count sanity",
          "value": 1,
          "max": 1,
          "weight": 0.1,
          "unit": "sane",
          "description": "Credits a sane direct-dependency count for a library (full credit up to 120 declared specs across manifests, declining beyond)."
        }
      ],
      "notes": "A4 scored against library/CLI norms (no deploy surface detected — same archetype line as A3): declared version ranges are correct library behavior; a committed lockfile is credited but not required."
    },
    {
      "id": "A5",
      "title": "Claim-vs-reality reconciliation",
      "category": "code_trust",
      "score": 2.2,
      "status": "warning",
      "evidence": [
        {
          "kind": "claim_reconciliation",
          "label": "Repository claim source",
          "path": "README.md",
          "line": 1,
          "contentHash": "1f2de14735b1ee9d3a342fa7c5d5e87b95727276c0a56c8a9d77221f37880602"
        },
        {
          "kind": "artifact",
          "label": "Code presence for claim reconciliation",
          "path": "src/flask/__init__.py",
          "line": 1,
          "contentHash": "2daebda4dc29fed5cb36c912a6115a234e9a4b5f9c33fd795e4bfeffd0cc9386"
        }
      ],
      "findings": [
        {
          "severity": "warning",
          "summary": "Claim source and implementation files are present, but no dedicated claim-reality report artifact was supplied.",
          "evidence": {
            "kind": "claim_reconciliation",
            "label": "Repository claim source",
            "path": "README.md",
            "line": 1,
            "contentHash": "1f2de14735b1ee9d3a342fa7c5d5e87b95727276c0a56c8a9d77221f37880602"
          }
        }
      ],
      "metrics": [
        {
          "name": "claim_match_rate",
          "label": "Claim match rate",
          "value": 12,
          "max": 13,
          "weight": 0.5,
          "unit": "ratio",
          "description": "Uses bounded implementation-to-claim-source depth as a static proxy when no dedicated artifact exists."
        },
        {
          "name": "claim_source_depth",
          "label": "Claim source depth",
          "value": 1,
          "max": 4,
          "kind": "saturating_count",
          "weight": 0.35,
          "unit": "docs",
          "description": "Credits multiple claim-bearing documents without judging unverified prose as truth."
        },
        {
          "name": "reconciliation_artifact_depth",
          "label": "Reconciliation artifact depth",
          "value": 0,
          "max": 3,
          "weight": 0.15,
          "unit": "artifacts",
          "description": "Requires a specific claim-reality artifact to reach full depth."
        }
      ]
    },
    {
      "id": "B1",
      "title": "Internal process dimension",
      "category": "process_trust",
      "score": 0,
      "status": "not_applicable",
      "evidence": [],
      "findings": [],
      "metrics": [],
      "notes": "Substrate-specific: an internal process dimension is not applicable to external code."
    },
    {
      "id": "B2",
      "title": "PR outcome traceability",
      "category": "process_trust",
      "score": 3.2,
      "status": "warning",
      "evidence": [
        {
          "kind": "ci_run",
          "label": "Pull-request CI workflow",
          "path": ".github/workflows/lock.yaml",
          "line": 1,
          "contentHash": "a1beaa8eb3926abfa930d944a1316e6c4b3f60de4f305e05258693f6d95e7b9a"
        },
        {
          "kind": "ci_run",
          "label": "Pull-request CI workflow",
          "path": ".github/workflows/pre-commit.yaml",
          "line": 1,
          "contentHash": "6ceaadd5d41f22d6384392e6b4fcd239695addb45ff490ef22ab441b57ffdd42"
        },
        {
          "kind": "ci_run",
          "label": "Pull-request CI workflow",
          "path": ".github/workflows/publish.yaml",
          "line": 1,
          "contentHash": "d6ebee41546c9b8be29e0b4cec18f13d2a394a8154f17f3f38450e5c1e1a7a3d"
        },
        {
          "kind": "pull_request",
          "label": "Pull request template",
          "path": ".github/pull_request_template.md",
          "line": 1,
          "contentHash": "f92d7fa6366d19dfed8f7b49e753c506c39bb17e23f0908da9dea408f0f07800"
        }
      ],
      "findings": [
        {
          "severity": "warning",
          "summary": "B2 metric-derived score is 3.2/4.0, in the warning band — no single finding drove this; it reflects the combined metric weighting below.",
          "evidence": {
            "kind": "ci_run",
            "label": "Pull-request CI workflow",
            "path": ".github/workflows/lock.yaml",
            "line": 1,
            "contentHash": "a1beaa8eb3926abfa930d944a1316e6c4b3f60de4f305e05258693f6d95e7b9a"
          }
        }
      ],
      "metrics": [
        {
          "name": "pr_trace_primitives",
          "label": "PR trace basic checks",
          "value": 6,
          "max": 2,
          "kind": "saturating_count",
          "weight": 0.8,
          "unit": "signals",
          "description": "Measures CI, PR template, and review-gate evidence for pull-request traceability."
        },
        {
          "name": "pr_merge_ratio",
          "label": "Recent PR merge ratio",
          "value": 0,
          "max": 1,
          "weight": 0.2,
          "unit": "ratio",
          "description": "Uses bounded git history as a deterministic proxy for PR outcome traceability."
        }
      ]
    },
    {
      "id": "B3",
      "title": "CI and QA discipline",
      "category": "process_trust",
      "score": 2.1,
      "status": "verified",
      "evidence": [
        {
          "kind": "ci_run",
          "label": "CI workflow",
          "path": ".github/workflows/lock.yaml",
          "line": 1,
          "contentHash": "a1beaa8eb3926abfa930d944a1316e6c4b3f60de4f305e05258693f6d95e7b9a"
        }
      ],
      "findings": [],
      "metrics": [
        {
          "name": "ci_script_depth",
          "label": "CI verification depth",
          "value": 1,
          "max": 4,
          "kind": "saturating_count",
          "weight": 0.45,
          "unit": "signals",
          "description": "Counts npm verification scripts plus distinct test/lint/typecheck/build command categories detected anywhere in CI workflows; language-agnostic, counted by category not by file."
        },
        {
          "name": "default_branch_ci_depth",
          "label": "PR-gate CI workflow count",
          "value": 3,
          "max": 4,
          "kind": "saturating_count",
          "weight": 0.55,
          "unit": "workflows",
          "description": "Counts CI workflows that target pull requests or the default branch, up to 4."
        }
      ]
    },
    {
      "id": "B4",
      "title": "Audit trail and report-up completeness",
      "category": "process_trust",
      "score": 3.7,
      "status": "verified",
      "evidence": [
        {
          "kind": "audit_log",
          "label": "Audit or changelog artifact",
          "path": "CHANGES.rst",
          "line": 1,
          "contentHash": "c850d97d088d7babdf93f4477617277d8ffad511631ecedf7868a26c559db0fd"
        },
        {
          "kind": "audit_log",
          "label": "Audit or changelog artifact",
          "path": "docs/changes.rst",
          "line": 1,
          "contentHash": "94c7e3657f8795af8f66d20fb6208f83df46bce9cab9b82d2c16ad961a87f7e0"
        },
        {
          "kind": "audit_log",
          "label": "Audit or changelog artifact",
          "path": "docs/web-security.rst",
          "line": 1,
          "contentHash": "75044a9c1f605be3b1914094c019fd4e89316e56fa60f7fcd11929d9b5da3acc"
        }
      ],
      "findings": [],
      "metrics": [
        {
          "name": "audit_artifact_depth",
          "label": "Audit artifact depth",
          "value": 3,
          "max": 3,
          "kind": "saturating_count",
          "weight": 0.8,
          "unit": "files",
          "description": "Measures quantity of audit, security, runbook, incident, status, and changelog artifacts."
        },
        {
          "name": "audit_freshness_depth",
          "label": "Audit freshness depth",
          "value": 2,
          "max": 3,
          "weight": 0.2,
          "unit": "ratio",
          "description": "Credits audit artifacts that carry freshness/current-state markers."
        }
      ]
    },
    {
      "id": "B5",
      "title": "Internal process dimension",
      "category": "process_trust",
      "score": 0,
      "status": "not_applicable",
      "evidence": [],
      "findings": [],
      "metrics": [],
      "notes": "Substrate-specific: an internal process dimension is not applicable to external code."
    },
    {
      "id": "B6",
      "title": "Privileged-operation human gating",
      "category": "process_trust",
      "score": 0,
      "status": "not_applicable",
      "evidence": [],
      "findings": [],
      "metrics": [],
      "notes": "No privileged-operation surface (prod DB admin GRANT/privilege DDL, role escalation, or documented human-gate governance) detected in this repo."
    }
  ],
  "archetype": "source",
  "contentReadSummary": {
    "skipped": 13,
    "byReason": {
      "unreadable": 0,
      "tooLarge": 0,
      "excludedByExtension": 13,
      "deniedPath": 0,
      "nonRegularFile": 0
    },
    "unreadableByErrno": {},
    "affectedCriteria": []
  },
  "verdict": "conditional",
  "codeTrustScore": 2.7,
  "processTrustScore": 3,
  "overallScore": 2.9
}