witan-batch-1787098867317-19135

Date
Run
unknown @ a79df4504cd4e42ed004b1113fb82171e62ed822
Rubric
witan-rubric-v17-2026-07-24
2.6/4.0 overall

Conditional

Code 2.0 · Process 3.2

code 3/5 · process 4/6 measured

Criterion profile

Measured scores are plotted on a 0–4 scale. Unknown and not-applicable dimensions remain explicit.

7 measured 0 no data 4 N/A

Code trust

A1Test integrity and regression signal
2.3
A2Data-layer isolation and secrets posture
N/A
A3Production readiness
N/A
A4Dependency hygiene
1.6
A5Claim-vs-reality reconciliation
2.2

Process trust

B1Internal process dimension
N/A
B2PR outcome traceability
3.2
B3CI and QA discipline
3.1
B4Audit trail and report-up completeness
2.5
B5Internal process dimension
N/A
B6Privileged-operation human gating
4.0

Code trust

A1

Test integrity and regression signal

dimension band: verified
2.3
  • Test-to-source file ratio4 ratio (capped; 55 raw)
  • Static coverage percentage0/100 percent
  • Verification script ratio2/4 ratio
  • Non-hollow test share29/29 ratio
  • Detected test file test/add-subdirectory-test/main.cc:1 · sha256:400f01bbe88c
  • Detected test file test/args-test.cc:1 · sha256:7f66f365eab1
  • Detected test file test/assert-test.cc:1 · sha256:b5c1ce1f68a2
  • Detected test file test/base-test.cc:1 · sha256:78f726cc38f5
  • Detected test file test/c-test.c:1 · sha256:1da68512e63d
  • Detected test file test/chrono-test.cc:1 · sha256:64b8408d67a5
  • Detected test file test/color-test.cc:1 · sha256:978d8c89099f
  • Detected test file test/compile-test.cc:1 · sha256:d561506df50a
  • Configured test runner CMakeLists.txt:1 · sha256:a5f0dc122b68
  • CI workflow runs the test suite .github/workflows/linux.yml:1 · sha256:a9f998199231
  • finding severity info: Test suite files are present, but no coverage configuration was detected. (Detected test file test/add-subdirectory-test/main.cc:1 · sha256:400f01bbe88c)
A4

Dependency hygiene

dimension band: verified
1.6
  • Declared version range ratio1/4 ratio
  • Dependency automation ratio1/2 ratio
  • Dependency count sanity1/1 sane
  • Dependency manifest test/cuda-test/CMakeLists.txt:1 · sha256:ab9624b5a25e
  • Dependency update config .github/dependabot.yml:1 · sha256:496e2016d5fc
A5

Claim-vs-reality reconciliation

dimension band: warning
2.2
  • Claim match rate12/13 ratio
  • Claim source depth1/4 docs
  • Reconciliation artifact depth0/3 artifacts
  • Repository claim source README.md:1 · sha256:26b23c0cda15
  • Code presence for claim reconciliation include/fmt/args.h:1 · sha256:ce9705a22f68
  • finding severity warning: Claim source and implementation files are present, but no dedicated claim-reality report artifact was supplied. (Repository claim source README.md:1 · sha256:26b23c0cda15)

Not applicable to this repository

  • A2 Data-layer isolation and secrets posture — No data layer (DB/ORM/migrations) or ratable secrets surface detected — A2 not applicable to this repo archetype. A ratable surface requires .env* files, .gitignore .env rule, committed/history .env path, or detected signing/HMAC/secret-comparison code; bare env reads (process.env / os.environ / std::env::) do not qualify.
  • A3 Production readiness — No deployable-service surface detected — production-readiness not applicable to this library/CLI archetype. Signals checked: production server entrypoint (HTTP/RPC port binding in main/server/app files, outside examples/tests/demo dirs), deploy config (vercel.json, render.yaml, fly.toml, Procfile, app.yaml, serverless.yml, docker-compose, k8s/helm manifests), CI deploy job (fly deploy, kubectl apply, helm install/upgrade, docker push). A Dockerfile without an explicit runtime start/service command is ambiguous and does not qualify.

Process trust

B2

PR outcome traceability

dimension band: warning
3.2
  • PR trace basic checks2 signals (capped; 11 raw)
  • Recent PR merge ratio0/1 ratio
  • Pull-request CI workflow .github/workflows/codeql.yml:1 · sha256:252ba92b5c3e
  • Pull-request CI workflow .github/workflows/doc.yml:1 · sha256:1ec8a39044dc
  • Pull-request CI workflow .github/workflows/fuzz.yml:1 · sha256:1962b83eb499
  • Pull request template .github/pull_request_template.md:1 · sha256:4547e593fddf
  • Review gate configuration .github/CODEOWNERS:1 · sha256:524103c7d5ec
  • finding severity warning: B2 dimension band is warning at 3.2/4.0. Lowest contributing measurements: Recent PR merge ratio 0/1 ratio; PR trace basic checks 2 signals capped (11 raw). To improve: preserve merged pull-request history in the scanned clone; add pull-request templates and outcome-trace records. (Pull-request CI workflow .github/workflows/codeql.yml:1 · sha256:252ba92b5c3e)
B3

CI and QA discipline

dimension band: verified
3.1
  • CI verification depth2/4 signals
  • PR-gate CI workflow count4 workflows (capped; 8 raw)
  • CI workflow .github/workflows/codeql.yml:1 · sha256:252ba92b5c3e
B4

Audit trail and report-up completeness

dimension band: verified
2.5
  • Audit artifact depth2/3 files
  • Audit freshness depth1/2 ratio
  • Audit or changelog artifact .github/SECURITY.md:1 · sha256:d0a63d810fe7
  • Audit or changelog artifact ChangeLog.md:1 · sha256:01791cf67050
B6

Privileged-operation human gating

dimension band: verified
4.0
  • Privilege-escalation cleanliness1/1 clean
  • Protected-path review gate1/1 present
  • CODEOWNERS/required-review gate on protected paths .github/CODEOWNERS:1 · sha256:524103c7d5ec

Not applicable to this repository

  • B1 Internal process dimension — Substrate-specific: an internal process dimension is not applicable to external code.
  • B5 Internal process dimension — Substrate-specific: an internal process dimension is not applicable to external code.

Verified evidence

  • A1 - Test integrity and regression signalDetected test file test/add-subdirectory-test/main.cc:1 · sha256:400f01bbe88c
  • A1 - Test integrity and regression signalDetected test file test/args-test.cc:1 · sha256:7f66f365eab1
  • A1 - Test integrity and regression signalDetected test file test/assert-test.cc:1 · sha256:b5c1ce1f68a2
  • A1 - Test integrity and regression signalDetected test file test/base-test.cc:1 · sha256:78f726cc38f5
  • A1 - Test integrity and regression signalDetected test file test/c-test.c:1 · sha256:1da68512e63d
  • A1 - Test integrity and regression signalDetected test file test/chrono-test.cc:1 · sha256:64b8408d67a5
  • A1 - Test integrity and regression signalDetected test file test/color-test.cc:1 · sha256:978d8c89099f
  • A1 - Test integrity and regression signalDetected test file test/compile-test.cc:1 · sha256:d561506df50a
  • A1 - Test integrity and regression signalConfigured test runner CMakeLists.txt:1 · sha256:a5f0dc122b68
  • A1 - Test integrity and regression signalCI workflow runs the test suite .github/workflows/linux.yml:1 · sha256:a9f998199231
  • A4 - Dependency hygieneDependency manifest test/cuda-test/CMakeLists.txt:1 · sha256:ab9624b5a25e
  • A4 - Dependency hygieneDependency update config .github/dependabot.yml:1 · sha256:496e2016d5fc
  • B3 - CI and QA disciplineCI workflow .github/workflows/codeql.yml:1 · sha256:252ba92b5c3e
  • B4 - Audit trail and report-up completenessAudit or changelog artifact .github/SECURITY.md:1 · sha256:d0a63d810fe7
  • B4 - Audit trail and report-up completenessAudit or changelog artifact ChangeLog.md:1 · sha256:01791cf67050
  • B6 - Privileged-operation human gatingCODEOWNERS/required-review gate on protected paths .github/CODEOWNERS:1 · sha256:524103c7d5ec

Open / unverified

  • A5 - Claim-vs-reality reconciliationfinding severity warning: Claim source and implementation files are present, but no dedicated claim-reality report artifact was supplied. (Repository claim source README.md:1 · sha256:26b23c0cda15)
  • B2 - PR outcome traceabilityfinding severity warning: B2 dimension band is warning at 3.2/4.0. Lowest contributing measurements: Recent PR merge ratio 0/1 ratio; PR trace basic checks 2 signals capped (11 raw). To improve: preserve merged pull-request history in the scanned clone; add pull-request templates and outcome-trace records. (Pull-request CI workflow .github/workflows/codeql.yml:1 · sha256:252ba92b5c3e)