# Cejel Trust Report - witan-batch-1787098784914-541717

- Product: witan-batch-1787098784914-541717
- Rubric: witan-rubric-v17-2026-07-24
- Generated: undefined
- Repository: witan-batch-1787098784914-541717 @ c0606e91798c8dca4f33d101e1dd836d672592c1

## Criterion Profile

| ID | Criterion | Category | Score | Status | Measurement signals |
|---|---|---|---:|---|---|
| A1 | Test integrity and regression signal | Code trust | 2.5 | verified | Test-to-source file ratio: 212/272 ratio; Static coverage percentage: 0/100 percent; Verification script ratio: 4/4 ratio; Non-hollow test share: 198/212 ratio |
| A2 | Data-layer isolation and secrets posture | Code trust | N/A | not_applicable | N/A |
| A3 | Production readiness | Code trust | 2.2 | warning | Production-readiness basic checks: 3/6 checks; Production workflow depth: 6 signals (capped; 11 raw); Observability depth: 3/4 signals; Rollback and migration-safety depth: 0/4 signals |
| A4 | Dependency hygiene | Code trust | 2.7 | verified | Pinned dependency ratio: 38/123 ratio; Lockfile coverage: 1/1 present; Dependency automation ratio: 1/2 ratio |
| A5 | Claim-vs-reality reconciliation | Code trust | 2.2 | warning | Claim match rate: 12/13 ratio; Claim source depth: 1/4 docs; Reconciliation artifact depth: 0/3 artifacts |
| B1 | Internal process dimension | Process trust | N/A | not_applicable | N/A |
| B2 | PR outcome traceability | Process trust | 3.2 | warning | PR trace basic checks: 2 signals (capped; 9 raw); Recent PR merge ratio: 0/1 ratio |
| B3 | CI and QA discipline | Process trust | 4.0 | verified | CI verification depth: 4 signals (capped; 6 raw); PR-gate CI workflow count: 4 workflows (capped; 5 raw) |
| B4 | Audit trail and report-up completeness | Process trust | 2.9 | verified | Audit artifact depth: 2/3 files; Audit freshness depth: 2/2 ratio |
| B5 | Internal process dimension | Process trust | N/A | not_applicable | N/A |
| B6 | Privileged-operation human gating | Process trust | N/A | not_applicable | N/A |

## Summary Scores

- Code trust: 2.4/4.0
- Process trust: 3.4/4.0
- Overall: 2.9/4.0
- Measured coverage: code trust 4/5, process trust 3/6, overall 7/11 dimensions measured — a dimension counts as measured only when it produced a real score; not-applicable and insufficient-data dimensions are unmeasured. A score reflects only its measured dimensions, and unmeasured is not good — it is unknown.
- Not applicable: A2, B1, B5, B6 — substrate-specific criteria excluded from composite (N/A for external code).

## Evidence

- A1: Detected test file (packages/compiler-core/__tests__/codegen.spec.ts:1, sha256:63ba48da7ac9)
- A1: Detected test file (packages/compiler-core/__tests__/compile.spec.ts:1, sha256:be962453bd41)
- A1: Detected test file (packages/compiler-core/__tests__/parse.spec.ts:1, sha256:937d3edeeae4)
- A1: Detected test file (packages/compiler-core/__tests__/scopeId.spec.ts:1, sha256:5bc4e857bccb)
- A1: Detected test file (packages/compiler-core/__tests__/testUtils.ts:1, sha256:201483f1165d)
- A1: Detected test file (packages/compiler-core/__tests__/transform.spec.ts:1, sha256:f47ac739de25)
- A1: Detected test file (packages/compiler-core/__tests__/transforms/cacheStatic.spec.ts:1, sha256:e636d1021703)
- A1: Detected test file (packages/compiler-core/__tests__/transforms/noopDirectiveTransform.spec.ts:1, sha256:0257911e5bfb)
- A1: Configured test runner (vitest.config.ts:1, sha256:53a16c86c515)
- A1: Configured test runner (package.json:1, sha256:0e9687aefbca)
- A1: Coverage configuration (vitest.config.ts:1, sha256:53a16c86c515)
- A1: CI workflow runs the test suite (.github/workflows/test.yml:1, sha256:3510205184c9)
- A2: N/A — No data layer (DB/ORM/migrations) or ratable secrets surface detected — A2 not applicable to this repo archetype. A ratable surface requires .env* files, .gitignore .env rule, committed/history .env path, or detected signing/HMAC/secret-comparison code; bare env reads (process.env / os.environ / std::env::) do not qualify.
- A3: Build or typecheck script (package.json:1, sha256:0e9687aefbca)
- A3: CI workflow (.github/workflows/autofix.yml:1, sha256:b07d87251343)
- A3: Release deploy configuration (netlify.toml:1, sha256:dcb6042928c9)
- A3: Build or typecheck script (package.json:1, sha256:0e9687aefbca) (warning)
- A4: Dependency manifest (package.json:1, sha256:0e9687aefbca)
- A4: Dependency lockfile (pnpm-lock.yaml:1, sha256:a9947be31928)
- A4: Dependency update config (.github/renovate.json5:1, sha256:4f3867861c7f)
- A5: Repository claim source (README.md:1, sha256:1d5ea6d8b418)
- A5: Code presence for claim reconciliation (packages-private/dts-built-test/src/index.ts:1, sha256:5d44f16d7982)
- A5: Repository claim source (README.md:1, sha256:1d5ea6d8b418) (warning)
- B1: N/A — Substrate-specific: an internal process dimension is not applicable to external code.
- B2: Pull-request CI workflow (.github/workflows/autofix.yml:1, sha256:b07d87251343)
- B2: Pull-request CI workflow (.github/workflows/ci.yml:1, sha256:ede571131c6d)
- B2: Pull-request CI workflow (.github/workflows/close-cant-reproduce-issues.yml:1, sha256:8f37190a64d8)
- B2: Pull-request CI workflow (.github/workflows/autofix.yml:1, sha256:b07d87251343) (warning)
- B3: Test script (package.json:1, sha256:0e9687aefbca)
- B3: Lint script (package.json:1, sha256:0e9687aefbca)
- B3: CI workflow (.github/workflows/autofix.yml:1, sha256:b07d87251343)
- B4: Audit or changelog artifact (CHANGELOG.md:1, sha256:4f9499f794a5)
- B4: Audit or changelog artifact (SECURITY.md:1, sha256:f744b4da60a2)
- B5: N/A — Substrate-specific: an internal process dimension is not applicable to external code.
- B6: N/A — No privileged-operation surface (prod DB admin GRANT/privilege DDL, role escalation, or documented human-gate governance) detected in this repo.

## Findings

- A3 finding severity warning (dimension band warning): A3 dimension band is warning at 2.2/4.0. Lowest contributing measurements: Rollback and migration-safety depth 0/4 signals; Production-readiness basic checks 3/6 checks. To improve: document and test rollback or recovery procedures; add the missing deployment-readiness controls. (Build or typecheck script (package.json:1, sha256:0e9687aefbca))
- A5 finding severity warning (dimension band warning): Claim source and implementation files are present, but no dedicated claim-reality report artifact was supplied. (Repository claim source (README.md:1, sha256:1d5ea6d8b418))
- B2 finding severity warning (dimension band warning): B2 dimension band is warning at 3.2/4.0. Lowest contributing measurements: Recent PR merge ratio 0/1 ratio; PR trace basic checks 2 signals capped (9 raw). To improve: preserve merged pull-request history in the scanned clone; add pull-request templates and outcome-trace records. (Pull-request CI workflow (.github/workflows/autofix.yml:1, sha256:b07d87251343))