witan-batch-1787098777446-652095

Date
Run
unknown @ c0c39a6b3907eaab35f43074949e2957a2a734c1
Rubric
witan-rubric-v17-2026-07-24
3.0/4.0 overall

Conditional

Code 2.1 · Process 3.9

code 5/5 · process 3/6 measured

Criterion profile

Measured scores are plotted on a 0–4 scale. Unknown and not-applicable dimensions remain explicit.

8 measured 0 no data 3 N/A

Code trust

A1Test integrity and regression signal
2.3
A2Data-layer isolation and secrets posture
1.4
A3Production readiness
2.3
A4Dependency hygiene
2.4
A5Claim-vs-reality reconciliation
2.2

Process trust

B1Internal process dimension
N/A
B2PR outcome traceability
4.0
B3CI and QA discipline
4.0
B4Audit trail and report-up completeness
3.8
B5Internal process dimension
N/A
B6Privileged-operation human gating
N/A

Code trust

A1

Test integrity and regression signal

dimension band: verified
2.3
  • Test-to-source file ratio1873 ratio (capped; 2410 raw)
  • Static coverage percentage0/100 percent
  • Verification script ratio4 ratio (capped; 7 raw)
  • Non-hollow test share389/2409 ratio
  • Detected test file compiler/apps/playground/__tests__/e2e/page.spec.ts:1 · sha256:fd6799d3b88d
  • Detected test file compiler/apps/playground/__tests__/parseConfigOverrides.test.mjs:1 · sha256:ea734820a147
  • Detected test file compiler/crates/react_compiler_ast/tests/deep_nesting.rs:1 · sha256:4dc974785462
  • Detected test file compiler/crates/react_compiler_ast/tests/round_trip.rs:1 · sha256:381027a818ba
  • Detected test file compiler/crates/react_compiler_ast/tests/scope_resolution.rs:1 · sha256:0d8a34fba5fb
  • Detected test file compiler/crates/react_compiler_lowering/tests/unknown_statement_lowering.rs:1 · sha256:3f730b1507ca
  • Detected test file compiler/packages/babel-plugin-react-compiler/src/__tests__/DisjointSet-test.ts:1 · sha256:f0bd8a61947c
  • Detected test file compiler/packages/babel-plugin-react-compiler/src/__tests__/Logger-test.ts:1 · sha256:17e296648fe3
  • Configured test runner compiler/apps/playground/playwright.config.js:1 · sha256:d47c8779631f
  • Configured test runner compiler/packages/babel-plugin-react-compiler/jest.config.js:1 · sha256:ce0807228781
  • Configured test runner compiler/packages/make-read-only-util/jest.config.js:1 · sha256:3127744e0ed2
  • Configured test runner packages/eslint-plugin-react-hooks/jest.config.js:1 · sha256:a1152dcd39be
  • Configured test runner packages/react-devtools-inline/playwright.config.js:1 · sha256:f3f77d7ff100
  • Configured test runner package.json:1 · sha256:5cc1364afcac
  • CI workflow runs the test suite .github/workflows/compiler_playground.yml:1 · sha256:99f32e363cdf
  • finding severity info: Test suite files are present, but no coverage configuration was detected. (Detected test file compiler/apps/playground/__tests__/e2e/page.spec.ts:1 · sha256:fd6799d3b88d)
A2

Data-layer isolation and secrets posture

dimension band: critical
1.4
  • Secret cleanliness0/1 clean
  • Environment handling depth1/3 practices
  • .env path detected in git history .git · sha256:c0c39a6b3907
  • finding severity critical: Secret-shaped value appears committed in the scanned repository. (Committed secret-shaped value (value redacted; length 32; classes lower+digit) compiler/packages/react-mcp-server/src/utils/algolia.ts:14 · sha256:dda98d4dcda5)
A3

Production readiness

dimension band: warning
2.3
  • Production-readiness basic checks3/6 checks
  • Production workflow depth6 signals (capped; 23 raw)
  • Observability depth4 signals (capped; 68 raw)
  • Rollback and migration-safety depth0/4 signals
  • Build or typecheck script package.json:1 · sha256:5cc1364afcac
  • CI workflow .github/workflows/compiler_discord_notify.yml:1 · sha256:e934619a5e08
  • Release deploy configuration compiler/apps/playground/vercel.json:1 · sha256:e22d332ab69c
  • finding severity warning: A3 dimension band is warning at 2.3/4.0. Lowest contributing measurements: Rollback and migration-safety depth 0/4 signals; Production-readiness basic checks 3/6 checks. To improve: document and test rollback or recovery procedures; add the missing deployment-readiness controls. (Build or typecheck script package.json:1 · sha256:5cc1364afcac)
A4

Dependency hygiene

dimension band: verified
2.4
  • Pinned dependency ratio77/883 ratio
  • Lockfile coverage1/1 present
  • Dependency automation ratio1/2 ratio
  • Dependency manifest package.json:1 · sha256:5cc1364afcac
  • Dependency lockfile compiler/Cargo.lock:1 · sha256:023853d4df57
  • Dependency update config .github/dependabot.yml:1 · sha256:46e17f9d7ab8
A5

Claim-vs-reality reconciliation

dimension band: warning
2.2
  • Claim match rate12/13 ratio
  • Claim source depth1/4 docs
  • Reconciliation artifact depth0/3 artifacts
  • Repository claim source README.md:1 · sha256:4d20edc8d043
  • Code presence for claim reconciliation compiler/apps/playground/app/layout.tsx:1 · sha256:80ab85b722a3
  • finding severity warning: Claim source and implementation files are present, but no dedicated claim-reality report artifact was supplied. (Repository claim source README.md:1 · sha256:4d20edc8d043)

Process trust

B2

PR outcome traceability

dimension band: verified
4.0
  • PR trace basic checks2 signals (capped; 23 raw)
  • Recent PR merge ratio1/1 ratio
  • Pull-request CI workflow .github/workflows/compiler_discord_notify.yml:1 · sha256:e934619a5e08
  • Pull-request CI workflow .github/workflows/compiler_playground.yml:1 · sha256:99f32e363cdf
  • Pull-request CI workflow .github/workflows/compiler_prereleases.yml:1 · sha256:85fc08a7cb0c
  • Pull request template .github/PULL_REQUEST_TEMPLATE.md:1 · sha256:3b66d9d79de5
B3

CI and QA discipline

dimension band: verified
4.0
  • CI verification depth4 signals (capped; 6 raw)
  • PR-gate CI workflow count4 workflows (capped; 14 raw)
  • Test script package.json:1 · sha256:5cc1364afcac
  • Lint script package.json:1 · sha256:5cc1364afcac
  • CI workflow .github/workflows/compiler_discord_notify.yml:1 · sha256:e934619a5e08
B4

Audit trail and report-up completeness

dimension band: verified
3.8
  • Audit artifact depth3 files (capped; 5 raw)
  • Audit freshness depth4/5 ratio
  • Audit or changelog artifact CHANGELOG.md:1 · sha256:b5d0e23a1079
  • Audit or changelog artifact SECURITY.md:1 · sha256:c0754b9a4971
  • Audit or changelog artifact compiler/CHANGELOG.md:1 · sha256:225938e5aa42
  • Audit or changelog artifact packages/eslint-plugin-react-hooks/CHANGELOG.md:1 · sha256:46ff96b6f31c
  • Audit or changelog artifact packages/react-devtools/CHANGELOG.md:1 · sha256:3e643e9aceb2

Not applicable to this repository

  • B1 Internal process dimension — Substrate-specific: an internal process dimension is not applicable to external code.
  • B5 Internal process dimension — Substrate-specific: an internal process dimension is not applicable to external code.
  • B6 Privileged-operation human gating — No privileged-operation surface (prod DB admin GRANT/privilege DDL, role escalation, or documented human-gate governance) detected in this repo.

Verified evidence

  • A1 - Test integrity and regression signalDetected test file compiler/apps/playground/__tests__/e2e/page.spec.ts:1 · sha256:fd6799d3b88d
  • A1 - Test integrity and regression signalDetected test file compiler/apps/playground/__tests__/parseConfigOverrides.test.mjs:1 · sha256:ea734820a147
  • A1 - Test integrity and regression signalDetected test file compiler/crates/react_compiler_ast/tests/deep_nesting.rs:1 · sha256:4dc974785462
  • A1 - Test integrity and regression signalDetected test file compiler/crates/react_compiler_ast/tests/round_trip.rs:1 · sha256:381027a818ba
  • A1 - Test integrity and regression signalDetected test file compiler/crates/react_compiler_ast/tests/scope_resolution.rs:1 · sha256:0d8a34fba5fb
  • A1 - Test integrity and regression signalDetected test file compiler/crates/react_compiler_lowering/tests/unknown_statement_lowering.rs:1 · sha256:3f730b1507ca
  • A1 - Test integrity and regression signalDetected test file compiler/packages/babel-plugin-react-compiler/src/__tests__/DisjointSet-test.ts:1 · sha256:f0bd8a61947c
  • A1 - Test integrity and regression signalDetected test file compiler/packages/babel-plugin-react-compiler/src/__tests__/Logger-test.ts:1 · sha256:17e296648fe3
  • A1 - Test integrity and regression signalConfigured test runner compiler/apps/playground/playwright.config.js:1 · sha256:d47c8779631f
  • A1 - Test integrity and regression signalConfigured test runner compiler/packages/babel-plugin-react-compiler/jest.config.js:1 · sha256:ce0807228781
  • A1 - Test integrity and regression signalConfigured test runner compiler/packages/make-read-only-util/jest.config.js:1 · sha256:3127744e0ed2
  • A1 - Test integrity and regression signalConfigured test runner packages/eslint-plugin-react-hooks/jest.config.js:1 · sha256:a1152dcd39be
  • A1 - Test integrity and regression signalConfigured test runner packages/react-devtools-inline/playwright.config.js:1 · sha256:f3f77d7ff100
  • A1 - Test integrity and regression signalConfigured test runner package.json:1 · sha256:5cc1364afcac
  • A1 - Test integrity and regression signalCI workflow runs the test suite .github/workflows/compiler_playground.yml:1 · sha256:99f32e363cdf
  • A4 - Dependency hygieneDependency manifest package.json:1 · sha256:5cc1364afcac
  • A4 - Dependency hygieneDependency lockfile compiler/Cargo.lock:1 · sha256:023853d4df57
  • A4 - Dependency hygieneDependency update config .github/dependabot.yml:1 · sha256:46e17f9d7ab8
  • B2 - PR outcome traceabilityPull-request CI workflow .github/workflows/compiler_discord_notify.yml:1 · sha256:e934619a5e08
  • B2 - PR outcome traceabilityPull-request CI workflow .github/workflows/compiler_playground.yml:1 · sha256:99f32e363cdf
  • B2 - PR outcome traceabilityPull-request CI workflow .github/workflows/compiler_prereleases.yml:1 · sha256:85fc08a7cb0c
  • B2 - PR outcome traceabilityPull request template .github/PULL_REQUEST_TEMPLATE.md:1 · sha256:3b66d9d79de5
  • B3 - CI and QA disciplineTest script package.json:1 · sha256:5cc1364afcac
  • B3 - CI and QA disciplineLint script package.json:1 · sha256:5cc1364afcac
  • B3 - CI and QA disciplineCI workflow .github/workflows/compiler_discord_notify.yml:1 · sha256:e934619a5e08
  • B4 - Audit trail and report-up completenessAudit or changelog artifact CHANGELOG.md:1 · sha256:b5d0e23a1079
  • B4 - Audit trail and report-up completenessAudit or changelog artifact SECURITY.md:1 · sha256:c0754b9a4971
  • B4 - Audit trail and report-up completenessAudit or changelog artifact compiler/CHANGELOG.md:1 · sha256:225938e5aa42
  • B4 - Audit trail and report-up completenessAudit or changelog artifact packages/eslint-plugin-react-hooks/CHANGELOG.md:1 · sha256:46ff96b6f31c
  • B4 - Audit trail and report-up completenessAudit or changelog artifact packages/react-devtools/CHANGELOG.md:1 · sha256:3e643e9aceb2

Open / unverified

  • A2 - Data-layer isolation and secrets posturefinding severity critical: Secret-shaped value appears committed in the scanned repository. (Committed secret-shaped value (value redacted; length 32; classes lower+digit) compiler/packages/react-mcp-server/src/utils/algolia.ts:14 · sha256:dda98d4dcda5)
  • A3 - Production readinessfinding severity warning: A3 dimension band is warning at 2.3/4.0. Lowest contributing measurements: Rollback and migration-safety depth 0/4 signals; Production-readiness basic checks 3/6 checks. To improve: document and test rollback or recovery procedures; add the missing deployment-readiness controls. (Build or typecheck script package.json:1 · sha256:5cc1364afcac)
  • A5 - Claim-vs-reality reconciliationfinding severity warning: Claim source and implementation files are present, but no dedicated claim-reality report artifact was supplied. (Repository claim source README.md:1 · sha256:4d20edc8d043)