witan-batch-1787098854500-657760

Date
Run
unknown @ 486837d756e6d48864620e91b0761467e2abe744
Rubric
witan-rubric-v17-2026-07-24
1.9/4.0 overall

At risk

Code 1.6 · Process 2.2

code 3/5 · process 2/6 measured · low confidence

Criterion profile

Measured scores are plotted on a 0–4 scale. Unknown and not-applicable dimensions remain explicit.

5 measured 0 no data 6 N/A

Code trust

A1Test integrity and regression signal
1.4
A2Data-layer isolation and secrets posture
N/A
A3Production readiness
N/A
A4Dependency hygiene
1.1
A5Claim-vs-reality reconciliation
2.2

Process trust

B1Internal process dimension
N/A
B2PR outcome traceability
3.2
B3CI and QA discipline
1.1
B4Audit trail and report-up completeness
N/A
B5Internal process dimension
N/A
B6Privileged-operation human gating
N/A

Code trust

A1

Test integrity and regression signal

dimension band: warning
1.4
  • Test-to-source file ratio1373/1805 ratio
  • Static coverage percentage0/100 percent
  • Verification script ratio0/4 ratio
  • Non-hollow test share846/1116 ratio
  • Detected test file android/guava-testlib/src/com/google/common/collect/testing/MapInterfaceTest.java:1 · sha256:d5d43f647dc0
  • Detected test file android/guava-testlib/src/com/google/common/collect/testing/SortedMapInterfaceTest.java:1 · sha256:cfa013c51b72
  • Detected test file android/guava-testlib/src/com/google/common/collect/testing/google/UnmodifiableCollectionTests.java:1 · sha256:2b63c408d81c
  • Detected test file android/guava-testlib/src/com/google/common/testing/AbstractPackageSanityTests.java:1 · sha256:ffcf88f95a11
  • Detected test file android/guava-testlib/src/com/google/common/util/concurrent/testing/AbstractListenableFutureTest.java:1 · sha256:ca10571a864d
  • Detected test file android/guava-testlib/test/com/google/common/collect/testing/AndroidIncompatible.java:1 · sha256:821fc20d378d
  • Detected test file android/guava-testlib/test/com/google/common/collect/testing/FeatureSpecificTestSuiteBuilderTest.java:1 · sha256:182905e8d6a9
  • Detected test file android/guava-testlib/test/com/google/common/collect/testing/HelpersTest.java:1 · sha256:81efd950abb2
  • finding severity warning: A1 dimension band is warning at 1.4/4.0. Lowest contributing measurements: Static coverage percentage 0/100 percent; Verification script ratio 0/4 ratio. To improve: configure coverage and publish a measured threshold or report; add explicit test, lint, and typecheck verification commands. (Detected test file android/guava-testlib/src/com/google/common/collect/testing/MapInterfaceTest.java:1 · sha256:d5d43f647dc0)
A4

Dependency hygiene

dimension band: warning
1.1
  • Declared version range ratio0/1 ratio
  • Dependency automation ratio1/2 ratio
  • Dependency count sanity1/1 sane
  • Dependency manifest android/guava-bom/pom.xml:1 · sha256:e636a4e3c748
  • Dependency update config .github/dependabot.yml:1 · sha256:3a90b5dfd045
  • finding severity warning: A4 dimension band is warning at 1.1/4.0. Lowest contributing measurements: Declared version range ratio 0/1 ratio; Dependency automation ratio 1/2 ratio. To improve: declare an explicit compatible version for every dependency; enable automated dependency updates and an audit command. (Dependency manifest android/guava-bom/pom.xml:1 · sha256:e636a4e3c748)
A5

Claim-vs-reality reconciliation

dimension band: warning
2.2
  • Claim match rate12/13 ratio
  • Claim source depth1/4 docs
  • Reconciliation artifact depth0/3 artifacts
  • Repository claim source README.md:1 · sha256:20dc329487f3
  • Code presence for claim reconciliation android/guava-testlib/src/com/google/common/collect/testing/AbstractCollectionTestSuiteBuilder.java:1 · sha256:2e783096169f
  • finding severity warning: Claim source and implementation files are present, but no dedicated claim-reality report artifact was supplied. (Repository claim source README.md:1 · sha256:20dc329487f3)

Not applicable to this repository

  • A2 Data-layer isolation and secrets posture — No data layer (DB/ORM/migrations) or ratable secrets surface detected — A2 not applicable to this repo archetype. A ratable surface requires .env* files, .gitignore .env rule, committed/history .env path, or detected signing/HMAC/secret-comparison code; bare env reads (process.env / os.environ / std::env::) do not qualify.
  • A3 Production readiness — No deployable-service surface detected — production-readiness not applicable to this library/CLI archetype. Signals checked: production server entrypoint (HTTP/RPC port binding in main/server/app files, outside examples/tests/demo dirs), deploy config (vercel.json, render.yaml, fly.toml, Procfile, app.yaml, serverless.yml, docker-compose, k8s/helm manifests), CI deploy job (fly deploy, kubectl apply, helm install/upgrade, docker push). A Dockerfile without an explicit runtime start/service command is ambiguous and does not qualify.

Process trust

B2

PR outcome traceability

dimension band: warning
3.2
  • PR trace basic checks2 signals (capped; 3 raw)
  • Recent PR merge ratio0/1 ratio
  • Pull-request CI workflow .github/workflows/ci.yml:1 · sha256:0f74c7922fda
  • Pull-request CI workflow .github/workflows/scorecard.yml:1 · sha256:265a949adbc0
  • Pull request template .github/pull_request_template.md:1 · sha256:def6a98ca1c6
  • finding severity warning: B2 dimension band is warning at 3.2/4.0. Lowest contributing measurements: Recent PR merge ratio 0/1 ratio; PR trace basic checks 2 signals capped (3 raw). To improve: preserve merged pull-request history in the scanned clone; add pull-request templates and outcome-trace records. (Pull-request CI workflow .github/workflows/ci.yml:1 · sha256:0f74c7922fda)
B3

CI and QA discipline

dimension band: warning
1.1
  • CI verification depth0/4 signals
  • PR-gate CI workflow count2/4 workflows
  • CI workflow .github/workflows/ci.yml:1 · sha256:0f74c7922fda
  • finding severity warning: B3 dimension band is warning at 1.1/4.0. Lowest contributing measurements: CI verification depth 0/4 signals; PR-gate CI workflow count 2/4 workflows. To improve: run the repository verification commands in CI; run CI on the default branch and pull requests. (CI workflow .github/workflows/ci.yml:1 · sha256:0f74c7922fda)

Not applicable to this repository

  • B1 Internal process dimension — Substrate-specific: an internal process dimension is not applicable to external code.
  • B4 Audit trail and report-up completeness — No audit-trail artifact detected (CHANGELOG/CHANGES/HISTORY/NEWS/SECURITY/AUDIT/STATUS/ release-notes/runbook/provenance file) — B4 not applicable to this repo.
  • B5 Internal process dimension — Substrate-specific: an internal process dimension is not applicable to external code.
  • B6 Privileged-operation human gating — No privileged-operation surface (prod DB admin GRANT/privilege DDL, role escalation, or documented human-gate governance) detected in this repo.

Verified evidence

  • No verified evidence listed in this public certificate.

Open / unverified

  • A1 - Test integrity and regression signalfinding severity warning: A1 dimension band is warning at 1.4/4.0. Lowest contributing measurements: Static coverage percentage 0/100 percent; Verification script ratio 0/4 ratio. To improve: configure coverage and publish a measured threshold or report; add explicit test, lint, and typecheck verification commands. (Detected test file android/guava-testlib/src/com/google/common/collect/testing/MapInterfaceTest.java:1 · sha256:d5d43f647dc0)
  • A4 - Dependency hygienefinding severity warning: A4 dimension band is warning at 1.1/4.0. Lowest contributing measurements: Declared version range ratio 0/1 ratio; Dependency automation ratio 1/2 ratio. To improve: declare an explicit compatible version for every dependency; enable automated dependency updates and an audit command. (Dependency manifest android/guava-bom/pom.xml:1 · sha256:e636a4e3c748)
  • A5 - Claim-vs-reality reconciliationfinding severity warning: Claim source and implementation files are present, but no dedicated claim-reality report artifact was supplied. (Repository claim source README.md:1 · sha256:20dc329487f3)
  • B2 - PR outcome traceabilityfinding severity warning: B2 dimension band is warning at 3.2/4.0. Lowest contributing measurements: Recent PR merge ratio 0/1 ratio; PR trace basic checks 2 signals capped (3 raw). To improve: preserve merged pull-request history in the scanned clone; add pull-request templates and outcome-trace records. (Pull-request CI workflow .github/workflows/ci.yml:1 · sha256:0f74c7922fda)
  • B3 - CI and QA disciplinefinding severity warning: B3 dimension band is warning at 1.1/4.0. Lowest contributing measurements: CI verification depth 0/4 signals; PR-gate CI workflow count 2/4 workflows. To improve: run the repository verification commands in CI; run CI on the default branch and pull requests. (CI workflow .github/workflows/ci.yml:1 · sha256:0f74c7922fda)