witan-batch-1787098833705-86768

Date
Run
unknown @ f361ead047be5cb873174218582f7d8b9fcd9f49
Rubric
witan-rubric-v17-2026-07-24
2.9/4.0 overall

Conditional

Code 2.4 · Process 3.4

code 3/5 · process 4/6 measured

Criterion profile

Measured scores are plotted on a 0–4 scale. Unknown and not-applicable dimensions remain explicit.

7 measured 0 no data 4 N/A

Code trust

A1Test integrity and regression signal
2.5
A2Data-layer isolation and secrets posture
N/A
A3Production readiness
N/A
A4Dependency hygiene
2.6
A5Claim-vs-reality reconciliation
2.2

Process trust

B1Internal process dimension
N/A
B2PR outcome traceability
4.0
B3CI and QA discipline
2.7
B4Audit trail and report-up completeness
2.9
B5Internal process dimension
N/A
B6Privileged-operation human gating
4.0

Code trust

A1

Test integrity and regression signal

dimension band: verified
2.5
  • Test-to-source file ratio15/19 ratio
  • Static coverage percentage0/100 percent
  • Verification script ratio4/4 ratio
  • Non-hollow test share8/9 ratio
  • Detected test file tests/__init__.py:1 · sha256:ac7f253daae0
  • Detected test file tests/compat.py:1 · sha256:d58ff5e3167d
  • Detected test file tests/conftest.py:1 · sha256:6d65ffb58251
  • Detected test file tests/test_adapters.py:1 · sha256:102494aa704f
  • Detected test file tests/test_help.py:1 · sha256:1c2ac8ca9f49
  • Detected test file tests/test_hooks.py:1 · sha256:a9e5163f5385
  • Detected test file tests/test_lowlevel.py:1 · sha256:db5fac7340c4
  • Detected test file tests/test_packages.py:1 · sha256:90875423db05
  • Configured test runner Makefile:1 · sha256:c31f5628de71
  • Configured test runner pyproject.toml:1 · sha256:345f26b9f691
  • Configured test runner tox.ini:1 · sha256:65aeb46c94fc
  • Coverage configuration .coveragerc:1 · sha256:8ac66b930282
A4

Dependency hygiene

dimension band: verified
2.6
  • Declared version range ratio8/12 ratio
  • Dependency automation ratio1/2 ratio
  • Dependency count sanity1/1 sane
  • Dependency manifest requirements-dev.txt:1 · sha256:aed8622c9a3d
  • Dependency update config .github/dependabot.yml:1 · sha256:d2c9890d77ab
A5

Claim-vs-reality reconciliation

dimension band: warning
2.2
  • Claim match rate12/13 ratio
  • Claim source depth1/4 docs
  • Reconciliation artifact depth0/3 artifacts
  • Repository claim source README.md:1 · sha256:2a9268c9be5f
  • Code presence for claim reconciliation src/requests/__init__.py:1 · sha256:80534322a1a3
  • finding severity warning: Claim source and implementation files are present, but no dedicated claim-reality report artifact was supplied. (Repository claim source README.md:1 · sha256:2a9268c9be5f)

Not applicable to this repository

  • A2 Data-layer isolation and secrets posture — No data layer (DB/ORM/migrations) or ratable secrets surface detected — A2 not applicable to this repo archetype. A ratable surface requires .env* files, .gitignore .env rule, committed/history .env path, or detected signing/HMAC/secret-comparison code; bare env reads (process.env / os.environ / std::env::) do not qualify.
  • A3 Production readiness — No deployable-service surface detected — production-readiness not applicable to this library/CLI archetype. Signals checked: production server entrypoint (HTTP/RPC port binding in main/server/app files, outside examples/tests/demo dirs), deploy config (vercel.json, render.yaml, fly.toml, Procfile, app.yaml, serverless.yml, docker-compose, k8s/helm manifests), CI deploy job (fly deploy, kubectl apply, helm install/upgrade, docker push). A Dockerfile without an explicit runtime start/service command is ambiguous and does not qualify.

Process trust

B2

PR outcome traceability

dimension band: verified
4.0
  • PR trace basic checks2 signals (capped; 9 raw)
  • Recent PR merge ratio1/1 ratio
  • Pull-request CI workflow .github/workflows/close-issues.yml:1 · sha256:3f9ea1ad83af
  • Pull-request CI workflow .github/workflows/codeql-analysis.yml:1 · sha256:50b45a295fad
  • Pull-request CI workflow .github/workflows/lint.yml:1 · sha256:0cb480c5b85a
  • Review gate configuration .github/CODEOWNERS:1 · sha256:1231f289a3ee
B3

CI and QA discipline

dimension band: verified
2.7
  • CI verification depth1/4 signals
  • PR-gate CI workflow count4 workflows (capped; 5 raw)
  • CI workflow .github/workflows/close-issues.yml:1 · sha256:3f9ea1ad83af
B4

Audit trail and report-up completeness

dimension band: verified
2.9
  • Audit artifact depth2/3 files
  • Audit freshness depth2/2 ratio
  • Audit or changelog artifact .github/SECURITY.md:1 · sha256:4d8f1a61f94c
  • Audit or changelog artifact HISTORY.md:1 · sha256:f779ef32bdb0
B6

Privileged-operation human gating

dimension band: verified
4.0
  • Privilege-escalation cleanliness1/1 clean
  • Protected-path review gate1/1 present
  • CODEOWNERS/required-review gate on protected paths .github/CODEOWNERS:1 · sha256:1231f289a3ee

Not applicable to this repository

  • B1 Internal process dimension — Substrate-specific: an internal process dimension is not applicable to external code.
  • B5 Internal process dimension — Substrate-specific: an internal process dimension is not applicable to external code.

Verified evidence

  • A1 - Test integrity and regression signalDetected test file tests/__init__.py:1 · sha256:ac7f253daae0
  • A1 - Test integrity and regression signalDetected test file tests/compat.py:1 · sha256:d58ff5e3167d
  • A1 - Test integrity and regression signalDetected test file tests/conftest.py:1 · sha256:6d65ffb58251
  • A1 - Test integrity and regression signalDetected test file tests/test_adapters.py:1 · sha256:102494aa704f
  • A1 - Test integrity and regression signalDetected test file tests/test_help.py:1 · sha256:1c2ac8ca9f49
  • A1 - Test integrity and regression signalDetected test file tests/test_hooks.py:1 · sha256:a9e5163f5385
  • A1 - Test integrity and regression signalDetected test file tests/test_lowlevel.py:1 · sha256:db5fac7340c4
  • A1 - Test integrity and regression signalDetected test file tests/test_packages.py:1 · sha256:90875423db05
  • A1 - Test integrity and regression signalConfigured test runner Makefile:1 · sha256:c31f5628de71
  • A1 - Test integrity and regression signalConfigured test runner pyproject.toml:1 · sha256:345f26b9f691
  • A1 - Test integrity and regression signalConfigured test runner tox.ini:1 · sha256:65aeb46c94fc
  • A1 - Test integrity and regression signalCoverage configuration .coveragerc:1 · sha256:8ac66b930282
  • A4 - Dependency hygieneDependency manifest requirements-dev.txt:1 · sha256:aed8622c9a3d
  • A4 - Dependency hygieneDependency update config .github/dependabot.yml:1 · sha256:d2c9890d77ab
  • B2 - PR outcome traceabilityPull-request CI workflow .github/workflows/close-issues.yml:1 · sha256:3f9ea1ad83af
  • B2 - PR outcome traceabilityPull-request CI workflow .github/workflows/codeql-analysis.yml:1 · sha256:50b45a295fad
  • B2 - PR outcome traceabilityPull-request CI workflow .github/workflows/lint.yml:1 · sha256:0cb480c5b85a
  • B2 - PR outcome traceabilityReview gate configuration .github/CODEOWNERS:1 · sha256:1231f289a3ee
  • B3 - CI and QA disciplineCI workflow .github/workflows/close-issues.yml:1 · sha256:3f9ea1ad83af
  • B4 - Audit trail and report-up completenessAudit or changelog artifact .github/SECURITY.md:1 · sha256:4d8f1a61f94c
  • B4 - Audit trail and report-up completenessAudit or changelog artifact HISTORY.md:1 · sha256:f779ef32bdb0
  • B6 - Privileged-operation human gatingCODEOWNERS/required-review gate on protected paths .github/CODEOWNERS:1 · sha256:1231f289a3ee

Open / unverified

  • A5 - Claim-vs-reality reconciliationfinding severity warning: Claim source and implementation files are present, but no dedicated claim-reality report artifact was supplied. (Repository claim source README.md:1 · sha256:2a9268c9be5f)