svelte-monorepo

Date
Run
unknown @ b4d1583ae20f3869a88a731d9a265c546c099f66
Rubric
witan-rubric-v17-2026-07-24
3.1/4.0 overall

Conditional

Code 2.9 · Process 3.3

code 4/5 · process 3/6 measured

Criterion profile

Measured scores are plotted on a 0–4 scale. Unknown and not-applicable dimensions remain explicit.

7 measured 0 no data 4 N/A

Code trust

A1Test integrity and regression signal
2.6
A2Data-layer isolation and secrets posture
3.6
A3Production readiness
N/A
A4Dependency hygiene
3.1
A5Claim-vs-reality reconciliation
2.2

Process trust

B1Internal process dimension
N/A
B2PR outcome traceability
4.0
B3CI and QA discipline
4.0
B4Audit trail and report-up completeness
1.9
B5Internal process dimension
N/A
B6Privileged-operation human gating
N/A

Code trust

A1

Test integrity and regression signal

dimension band: verified
2.6
  • Test-to-source file ratio422 ratio (capped; 7886 raw)
  • Static coverage percentage0/100 percent
  • Verification script ratio3/4 ratio
  • Non-hollow test share1951/1951 ratio
  • Detected test file benchmarking/benchmarks/reactivity/tests/clean_effects.bench.js:1 · sha256:1937606d3d19
  • Detected test file benchmarking/benchmarks/reactivity/tests/kairo_avoidable.bench.js:1 · sha256:a0818f51c0eb
  • Detected test file benchmarking/benchmarks/reactivity/tests/kairo_broad.bench.js:1 · sha256:83269ad958a3
  • Detected test file benchmarking/benchmarks/reactivity/tests/kairo_broad_block.bench.js:1 · sha256:ab417b65763d
  • Detected test file benchmarking/benchmarks/reactivity/tests/kairo_deep.bench.js:1 · sha256:58c2b17b2114
  • Detected test file benchmarking/benchmarks/reactivity/tests/kairo_deep_block.bench.js:1 · sha256:e5c2117aa045
  • Detected test file benchmarking/benchmarks/reactivity/tests/kairo_diamond.bench.js:1 · sha256:ed75fe4a855e
  • Detected test file benchmarking/benchmarks/reactivity/tests/kairo_mux.bench.js:1 · sha256:21944e547bdb
  • Configured test runner vitest.config.js:1 · sha256:301bf5f184b8
  • Configured test runner package.json:1 · sha256:cc47e94e6601
  • Coverage configuration vitest.config.js:1 · sha256:301bf5f184b8
  • CI workflow runs the test suite .github/workflows/ci.yml:1 · sha256:1bccd24d65cb
A2

Data-layer isolation and secrets posture

dimension band: verified
3.6
  • Secret cleanliness1/1 clean
  • Environment handling depth2/3 practices
  • .env files are gitignored .gitignore:1 · sha256:74cbf833f6cd
A4

Dependency hygiene

dimension band: warning
3.1
  • Declared version range ratio60/60 ratio
  • Lockfile coverage1/1 present
  • Dependency automation ratio0/2 ratio
  • Dependency count sanity1/1 sane
  • Dependency manifest packages/svelte/package.json:1 · sha256:1b17c4f21e75
  • Dependency lockfile pnpm-lock.yaml:1 · sha256:18d46c38bd3f
  • finding severity warning: A4 dimension band is warning at 3.1/4.0. Lowest contributing measurements: Dependency automation ratio 0/2 ratio; Declared version range ratio 60/60 ratio. To improve: enable automated dependency updates and an audit command; declare an explicit compatible version for every dependency. (Dependency manifest packages/svelte/package.json:1 · sha256:1b17c4f21e75)
A5

Claim-vs-reality reconciliation

dimension band: warning
2.2
  • Claim match rate12/13 ratio
  • Claim source depth1/4 docs
  • Reconciliation artifact depth0/3 artifacts
  • Repository claim source README.md:1 · sha256:f58cdd71cf9d
  • Code presence for claim reconciliation packages/svelte/elements.d.ts:1 · sha256:180ce9a33f1f
  • finding severity warning: Claim source and implementation files are present, but no dedicated claim-reality report artifact was supplied. (Repository claim source README.md:1 · sha256:f58cdd71cf9d)

Not applicable to this repository

  • A3 Production readiness — No deployable-service surface detected — production-readiness not applicable to this library/CLI archetype. Signals checked: production server entrypoint (HTTP/RPC port binding in main/server/app files, outside examples/tests/demo dirs), deploy config (vercel.json, render.yaml, fly.toml, Procfile, app.yaml, serverless.yml, docker-compose, k8s/helm manifests), CI deploy job (fly deploy, kubectl apply, helm install/upgrade, docker push). A Dockerfile without an explicit runtime start/service command is ambiguous and does not qualify.

Process trust

B2

PR outcome traceability

dimension band: verified
4.0
  • PR trace basic checks2 signals (capped; 6 raw)
  • Recent PR merge ratio1/1 ratio
  • Pull-request CI workflow .github/workflows/autofix.yml:1 · sha256:02f5a1442676
  • Pull-request CI workflow .github/workflows/ci.yml:1 · sha256:1bccd24d65cb
  • Pull-request CI workflow .github/workflows/ecosystem-ci-trigger.yml:1 · sha256:ce15fb9dd3c8
  • Pull request template .github/PULL_REQUEST_TEMPLATE.md:1 · sha256:5637321f410f
B3

CI and QA discipline

dimension band: verified
4.0
  • CI verification depth4/4 signals
  • PR-gate CI workflow count4 workflows (capped; 5 raw)
  • Test script package.json:1 · sha256:cc47e94e6601
  • Lint script package.json:1 · sha256:cc47e94e6601
  • CI workflow .github/workflows/autofix.yml:1 · sha256:02f5a1442676
B4

Audit trail and report-up completeness

dimension band: verified
1.9
  • Audit artifact depth1/3 files
  • Audit freshness depth1/1 ratio
  • Audit or changelog artifact packages/svelte/CHANGELOG.md:1 · sha256:34ca5aff9916

Not applicable to this repository

  • B1 Internal process dimension — Substrate-specific: an internal process dimension is not applicable to external code.
  • B5 Internal process dimension — Substrate-specific: an internal process dimension is not applicable to external code.
  • B6 Privileged-operation human gating — No privileged-operation surface (prod DB admin GRANT/privilege DDL, role escalation, or documented human-gate governance) detected in this repo.

Verified evidence

  • A1 - Test integrity and regression signalDetected test file benchmarking/benchmarks/reactivity/tests/clean_effects.bench.js:1 · sha256:1937606d3d19
  • A1 - Test integrity and regression signalDetected test file benchmarking/benchmarks/reactivity/tests/kairo_avoidable.bench.js:1 · sha256:a0818f51c0eb
  • A1 - Test integrity and regression signalDetected test file benchmarking/benchmarks/reactivity/tests/kairo_broad.bench.js:1 · sha256:83269ad958a3
  • A1 - Test integrity and regression signalDetected test file benchmarking/benchmarks/reactivity/tests/kairo_broad_block.bench.js:1 · sha256:ab417b65763d
  • A1 - Test integrity and regression signalDetected test file benchmarking/benchmarks/reactivity/tests/kairo_deep.bench.js:1 · sha256:58c2b17b2114
  • A1 - Test integrity and regression signalDetected test file benchmarking/benchmarks/reactivity/tests/kairo_deep_block.bench.js:1 · sha256:e5c2117aa045
  • A1 - Test integrity and regression signalDetected test file benchmarking/benchmarks/reactivity/tests/kairo_diamond.bench.js:1 · sha256:ed75fe4a855e
  • A1 - Test integrity and regression signalDetected test file benchmarking/benchmarks/reactivity/tests/kairo_mux.bench.js:1 · sha256:21944e547bdb
  • A1 - Test integrity and regression signalConfigured test runner vitest.config.js:1 · sha256:301bf5f184b8
  • A1 - Test integrity and regression signalConfigured test runner package.json:1 · sha256:cc47e94e6601
  • A1 - Test integrity and regression signalCoverage configuration vitest.config.js:1 · sha256:301bf5f184b8
  • A1 - Test integrity and regression signalCI workflow runs the test suite .github/workflows/ci.yml:1 · sha256:1bccd24d65cb
  • A2 - Data-layer isolation and secrets posture.env files are gitignored .gitignore:1 · sha256:74cbf833f6cd
  • B2 - PR outcome traceabilityPull-request CI workflow .github/workflows/autofix.yml:1 · sha256:02f5a1442676
  • B2 - PR outcome traceabilityPull-request CI workflow .github/workflows/ci.yml:1 · sha256:1bccd24d65cb
  • B2 - PR outcome traceabilityPull-request CI workflow .github/workflows/ecosystem-ci-trigger.yml:1 · sha256:ce15fb9dd3c8
  • B2 - PR outcome traceabilityPull request template .github/PULL_REQUEST_TEMPLATE.md:1 · sha256:5637321f410f
  • B3 - CI and QA disciplineTest script package.json:1 · sha256:cc47e94e6601
  • B3 - CI and QA disciplineLint script package.json:1 · sha256:cc47e94e6601
  • B3 - CI and QA disciplineCI workflow .github/workflows/autofix.yml:1 · sha256:02f5a1442676
  • B4 - Audit trail and report-up completenessAudit or changelog artifact packages/svelte/CHANGELOG.md:1 · sha256:34ca5aff9916

Open / unverified

  • A4 - Dependency hygienefinding severity warning: A4 dimension band is warning at 3.1/4.0. Lowest contributing measurements: Dependency automation ratio 0/2 ratio; Declared version range ratio 60/60 ratio. To improve: enable automated dependency updates and an audit command; declare an explicit compatible version for every dependency. (Dependency manifest packages/svelte/package.json:1 · sha256:1b17c4f21e75)
  • A5 - Claim-vs-reality reconciliationfinding severity warning: Claim source and implementation files are present, but no dedicated claim-reality report artifact was supplied. (Repository claim source README.md:1 · sha256:f58cdd71cf9d)