witan-batch-1787098842288-685254

Date
Run
unknown @ 912f0f51b0ced654d0069741e7160834dca742ee
Rubric
witan-rubric-v17-2026-07-24
3.2/4.0 overall

Conditional

Code 3.1 · Process 3.2

code 3/5 · process 3/6 measured

Criterion profile

Measured scores are plotted on a 0–4 scale. Unknown and not-applicable dimensions remain explicit.

6 measured 0 no data 5 N/A

Code trust

A1Test integrity and regression signal
2.5
A2Data-layer isolation and secrets posture
3.6
A3Production readiness
N/A
A4Dependency hygiene
3.1
A5Claim-vs-reality reconciliation
N/A

Process trust

B1Internal process dimension
N/A
B2PR outcome traceability
3.2
B3CI and QA discipline
3.5
B4Audit trail and report-up completeness
2.9
B5Internal process dimension
N/A
B6Privileged-operation human gating
N/A

Code trust

A1

Test integrity and regression signal

dimension band: verified
2.5
  • Test-to-source file ratio172/224 ratio
  • Static coverage percentage0/100 percent
  • Verification script ratio4 ratio (capped; 6 raw)
  • Non-hollow test share160/170 ratio
  • Detected test file packages/docs/content/api.test.ts:1 · sha256:e8a097b1503a
  • Detected test file packages/resolution/attw.test.ts:1 · sha256:b57403796b44
  • Detected test file packages/zod/src/v3/tests/Mocker.ts:1 · sha256:b7732bb15ed6
  • Detected test file packages/zod/src/v3/tests/all-errors.test.ts:1 · sha256:ac1e032526bd
  • Detected test file packages/zod/src/v3/tests/anyunknown.test.ts:1 · sha256:fac8ebb9d300
  • Detected test file packages/zod/src/v3/tests/array.test.ts:1 · sha256:e7d3813182c5
  • Detected test file packages/zod/src/v3/tests/async-parsing.test.ts:1 · sha256:45f829362cc9
  • Detected test file packages/zod/src/v3/tests/async-refinements.test.ts:1 · sha256:cfd675222367
  • Configured test runner packages/docs/vitest.config.ts:1 · sha256:8fc5dec98e5e
  • Configured test runner packages/resolution/vitest.config.ts:1 · sha256:6469722039db
  • Configured test runner packages/zod/vitest.config.ts:1 · sha256:49c9e26afb17
  • Configured test runner vitest.config.ts:1 · sha256:04a55003ffaa
  • Configured test runner package.json:1 · sha256:8b65378dc0f7
  • CI workflow runs the test suite .github/workflows/release.yml:1 · sha256:f2da754e222e
  • finding severity info: Test suite files are present, but no coverage configuration was detected. (Detected test file packages/docs/content/api.test.ts:1 · sha256:e8a097b1503a)
A2

Data-layer isolation and secrets posture

dimension band: verified
3.6
  • Secret cleanliness1/1 clean
  • Environment handling depth2/3 practices
  • .env files are gitignored .gitignore:1 · sha256:adc6897846fd
A4

Dependency hygiene

dimension band: warning
3.1
  • Declared version range ratio94/96 ratio
  • Lockfile coverage1/1 present
  • Dependency automation ratio0/2 ratio
  • Dependency count sanity1/1 sane
  • Dependency manifest package.json:1 · sha256:8b65378dc0f7
  • Dependency lockfile packages/docs/pnpm-lock.yaml:1 · sha256:819481715eef
  • finding severity warning: A4 dimension band is warning at 3.1/4.0. Lowest contributing measurements: Dependency automation ratio 0/2 ratio; Declared version range ratio 94/96 ratio. To improve: enable automated dependency updates and an audit command; declare an explicit compatible version for every dependency. (Dependency manifest package.json:1 · sha256:8b65378dc0f7)

Not applicable to this repository

  • A3 Production readiness — No deployable-service surface detected — production-readiness not applicable to this library/CLI archetype. Signals checked: production server entrypoint (HTTP/RPC port binding in main/server/app files, outside examples/tests/demo dirs), deploy config (vercel.json, render.yaml, fly.toml, Procfile, app.yaml, serverless.yml, docker-compose, k8s/helm manifests), CI deploy job (fly deploy, kubectl apply, helm install/upgrade, docker push). A Dockerfile without an explicit runtime start/service command is ambiguous and does not qualify.
  • A5 Claim-vs-reality reconciliation — No README or docs found — nothing is claimed about this repo, so there is nothing for A5 to reconcile against.

Process trust

B2

PR outcome traceability

dimension band: warning
3.2
  • PR trace basic checks2 signals (capped; 6 raw)
  • Recent PR merge ratio0/1 ratio
  • Pull-request CI workflow .github/workflows/claude-code-review.yml:1 · sha256:4c568b40f09b
  • Pull-request CI workflow .github/workflows/claude.yml:1 · sha256:887e633ee5cb
  • Pull-request CI workflow .github/workflows/pullfrog.yml:1 · sha256:238dd53690ea
  • finding severity warning: B2 dimension band is warning at 3.2/4.0. Lowest contributing measurements: Recent PR merge ratio 0/1 ratio; PR trace basic checks 2 signals capped (6 raw). To improve: preserve merged pull-request history in the scanned clone; add pull-request templates and outcome-trace records. (Pull-request CI workflow .github/workflows/claude-code-review.yml:1 · sha256:4c568b40f09b)
B3

CI and QA discipline

dimension band: verified
3.5
  • CI verification depth4/4 signals
  • PR-gate CI workflow count3/4 workflows
  • Test script package.json:1 · sha256:8b65378dc0f7
  • Lint script package.json:1 · sha256:8b65378dc0f7
  • CI workflow .github/workflows/claude-code-review.yml:1 · sha256:4c568b40f09b
B4

Audit trail and report-up completeness

dimension band: verified
2.9
  • Audit artifact depth2/3 files
  • Audit freshness depth2/2 ratio
  • Audit or changelog artifact SECURITY.md:1 · sha256:246450874a5d
  • Audit or changelog artifact packages/docs-v3/CHANGELOG.md:1 · sha256:491c8ddc14fc

Not applicable to this repository

  • B1 Internal process dimension — Substrate-specific: an internal process dimension is not applicable to external code.
  • B5 Internal process dimension — Substrate-specific: an internal process dimension is not applicable to external code.
  • B6 Privileged-operation human gating — No privileged-operation surface (prod DB admin GRANT/privilege DDL, role escalation, or documented human-gate governance) detected in this repo.

Verified evidence

  • A1 - Test integrity and regression signalDetected test file packages/docs/content/api.test.ts:1 · sha256:e8a097b1503a
  • A1 - Test integrity and regression signalDetected test file packages/resolution/attw.test.ts:1 · sha256:b57403796b44
  • A1 - Test integrity and regression signalDetected test file packages/zod/src/v3/tests/Mocker.ts:1 · sha256:b7732bb15ed6
  • A1 - Test integrity and regression signalDetected test file packages/zod/src/v3/tests/all-errors.test.ts:1 · sha256:ac1e032526bd
  • A1 - Test integrity and regression signalDetected test file packages/zod/src/v3/tests/anyunknown.test.ts:1 · sha256:fac8ebb9d300
  • A1 - Test integrity and regression signalDetected test file packages/zod/src/v3/tests/array.test.ts:1 · sha256:e7d3813182c5
  • A1 - Test integrity and regression signalDetected test file packages/zod/src/v3/tests/async-parsing.test.ts:1 · sha256:45f829362cc9
  • A1 - Test integrity and regression signalDetected test file packages/zod/src/v3/tests/async-refinements.test.ts:1 · sha256:cfd675222367
  • A1 - Test integrity and regression signalConfigured test runner packages/docs/vitest.config.ts:1 · sha256:8fc5dec98e5e
  • A1 - Test integrity and regression signalConfigured test runner packages/resolution/vitest.config.ts:1 · sha256:6469722039db
  • A1 - Test integrity and regression signalConfigured test runner packages/zod/vitest.config.ts:1 · sha256:49c9e26afb17
  • A1 - Test integrity and regression signalConfigured test runner vitest.config.ts:1 · sha256:04a55003ffaa
  • A1 - Test integrity and regression signalConfigured test runner package.json:1 · sha256:8b65378dc0f7
  • A1 - Test integrity and regression signalCI workflow runs the test suite .github/workflows/release.yml:1 · sha256:f2da754e222e
  • A2 - Data-layer isolation and secrets posture.env files are gitignored .gitignore:1 · sha256:adc6897846fd
  • B3 - CI and QA disciplineTest script package.json:1 · sha256:8b65378dc0f7
  • B3 - CI and QA disciplineLint script package.json:1 · sha256:8b65378dc0f7
  • B3 - CI and QA disciplineCI workflow .github/workflows/claude-code-review.yml:1 · sha256:4c568b40f09b
  • B4 - Audit trail and report-up completenessAudit or changelog artifact SECURITY.md:1 · sha256:246450874a5d
  • B4 - Audit trail and report-up completenessAudit or changelog artifact packages/docs-v3/CHANGELOG.md:1 · sha256:491c8ddc14fc

Open / unverified

  • A4 - Dependency hygienefinding severity warning: A4 dimension band is warning at 3.1/4.0. Lowest contributing measurements: Dependency automation ratio 0/2 ratio; Declared version range ratio 94/96 ratio. To improve: enable automated dependency updates and an audit command; declare an explicit compatible version for every dependency. (Dependency manifest package.json:1 · sha256:8b65378dc0f7)
  • B2 - PR outcome traceabilityfinding severity warning: B2 dimension band is warning at 3.2/4.0. Lowest contributing measurements: Recent PR merge ratio 0/1 ratio; PR trace basic checks 2 signals capped (6 raw). To improve: preserve merged pull-request history in the scanned clone; add pull-request templates and outcome-trace records. (Pull-request CI workflow .github/workflows/claude-code-review.yml:1 · sha256:4c568b40f09b)