{
  "productSlug": "witan-batch-1787098842288-685254",
  "productDisplayName": "witan-batch-1787098842288-685254",
  "repo": {
    "headSha": "912f0f51b0ced654d0069741e7160834dca742ee"
  },
  "rubricVersion": "witan-rubric-v17-2026-07-24",
  "criteria": [
    {
      "id": "A1",
      "title": "Test integrity and regression signal",
      "category": "code_trust",
      "score": 2.5,
      "status": "verified",
      "evidence": [
        {
          "kind": "test_run",
          "label": "Detected test file",
          "path": "packages/docs/content/api.test.ts",
          "line": 1,
          "contentHash": "e8a097b1503aebd72521069a8d4da6c3e40fe92839793ce96d968a8ca024b186"
        },
        {
          "kind": "test_run",
          "label": "Detected test file",
          "path": "packages/resolution/attw.test.ts",
          "line": 1,
          "contentHash": "b57403796b4404d025a9ba56a944011546fa3ad78e60e3d42f7796c6de76412a"
        },
        {
          "kind": "test_run",
          "label": "Detected test file",
          "path": "packages/zod/src/v3/tests/Mocker.ts",
          "line": 1,
          "contentHash": "b7732bb15ed6ab38f61dd4a15f088af109b0a99eccb50cdd9f542a17bb935f5e"
        },
        {
          "kind": "test_run",
          "label": "Detected test file",
          "path": "packages/zod/src/v3/tests/all-errors.test.ts",
          "line": 1,
          "contentHash": "ac1e032526bd4dcb874880df7c28f7a1b60b1b850f68da95df28ead0317527e8"
        },
        {
          "kind": "test_run",
          "label": "Detected test file",
          "path": "packages/zod/src/v3/tests/anyunknown.test.ts",
          "line": 1,
          "contentHash": "fac8ebb9d3007f7ef1ea320eed85b22b3248fde6bb1fe645a1a513b69442c014"
        },
        {
          "kind": "test_run",
          "label": "Detected test file",
          "path": "packages/zod/src/v3/tests/array.test.ts",
          "line": 1,
          "contentHash": "e7d3813182c59e511d350bebbd2a25b349868cc73d057b23b1d85a4d927b3711"
        },
        {
          "kind": "test_run",
          "label": "Detected test file",
          "path": "packages/zod/src/v3/tests/async-parsing.test.ts",
          "line": 1,
          "contentHash": "45f829362cc917d9505e244ea0d9a06d71a1953747dc31e57780388e82ad5afa"
        },
        {
          "kind": "test_run",
          "label": "Detected test file",
          "path": "packages/zod/src/v3/tests/async-refinements.test.ts",
          "line": 1,
          "contentHash": "cfd6752223678338c949f1716deeff8c18807f31343d6a4544f494d10e5acf60"
        },
        {
          "kind": "test_run",
          "label": "Configured test runner",
          "path": "packages/docs/vitest.config.ts",
          "line": 1,
          "contentHash": "8fc5dec98e5eb40e6090cfff0bb621b08cf0bea5c7555c5bc1f34cc3317dc9e1"
        },
        {
          "kind": "test_run",
          "label": "Configured test runner",
          "path": "packages/resolution/vitest.config.ts",
          "line": 1,
          "contentHash": "6469722039db4cca732e06bb82b9151fb3e0437ff64ae12c2ddd181b23bd8fa4"
        },
        {
          "kind": "test_run",
          "label": "Configured test runner",
          "path": "packages/zod/vitest.config.ts",
          "line": 1,
          "contentHash": "49c9e26afb17070d77b674403513523739f11eb6cdb2fc60ea9a0a2a05963420"
        },
        {
          "kind": "test_run",
          "label": "Configured test runner",
          "path": "vitest.config.ts",
          "line": 1,
          "contentHash": "04a55003ffaa3fe760fc652388e112af0f96938581422d109e4605791c0ffe8d"
        },
        {
          "kind": "test_run",
          "label": "Configured test runner",
          "path": "package.json",
          "line": 1,
          "contentHash": "8b65378dc0f70153a336049b3427feb5cd2fa1c5c0082c148ead93ce74e58700"
        },
        {
          "kind": "test_run",
          "label": "CI workflow runs the test suite",
          "path": ".github/workflows/release.yml",
          "line": 1,
          "contentHash": "f2da754e222ec78f98f3e345b86ece65d318732f4c84e5748f606d6ad26ce64b"
        }
      ],
      "findings": [
        {
          "severity": "info",
          "summary": "Test suite files are present, but no coverage configuration was detected.",
          "evidence": {
            "kind": "test_run",
            "label": "Detected test file",
            "path": "packages/docs/content/api.test.ts",
            "line": 1,
            "contentHash": "e8a097b1503aebd72521069a8d4da6c3e40fe92839793ce96d968a8ca024b186"
          }
        }
      ],
      "metrics": [
        {
          "name": "test_to_source_ratio",
          "label": "Test-to-source file ratio",
          "value": 172,
          "max": 224,
          "kind": "saturating_count",
          "weight": 0.3,
          "unit": "ratio",
          "description": "Measures how much concrete test surface exists relative to implementation surface."
        },
        {
          "name": "coverage_percent",
          "label": "Static coverage percentage",
          "value": 0,
          "max": 100,
          "weight": 0.3,
          "unit": "percent",
          "description": "Uses a static coverage report value or configured threshold when present, without running tests."
        },
        {
          "name": "verification_script_ratio",
          "label": "Verification script ratio",
          "value": 6,
          "max": 4,
          "kind": "saturating_count",
          "weight": 0.25,
          "unit": "ratio",
          "description": "Measures explicit test/lint/typecheck verification commands (via npm script or CI-invoked tool) plus test runner configuration."
        },
        {
          "name": "non_hollow_test_share",
          "label": "Non-hollow test share",
          "value": 160,
          "max": 170,
          "weight": 0.15,
          "unit": "ratio",
          "description": "Penalizes skipped or placeholder-only test files; test-directory support scaffolding (helpers/fixtures with no test in them) is excluded from the denominator."
        }
      ],
      "notes": "A1 is detected from real test files, test runner configuration, and optional coverage configuration."
    },
    {
      "id": "A2",
      "title": "Data-layer isolation and secrets posture",
      "category": "code_trust",
      "score": 3.6,
      "status": "verified",
      "evidence": [
        {
          "kind": "secret_scan",
          "label": ".env files are gitignored",
          "path": ".gitignore",
          "line": 1,
          "contentHash": "adc6897846fd04040243d0ab82b8ed105b5dea98e09e2c38431d45e7cea81a0f"
        }
      ],
      "findings": [],
      "metrics": [
        {
          "name": "secret_cleanliness",
          "label": "Secret cleanliness",
          "value": 1,
          "max": 1,
          "weight": 0.7,
          "unit": "clean",
          "description": "Credits absence of committed or recent-history secret findings in the static scan."
        },
        {
          "name": "env_handling_depth",
          "label": "Environment handling depth",
          "value": 2,
          "max": 3,
          "weight": 0.3,
          "unit": "practices",
          "description": "Counts three bounded env-handling practices (0–3): template file, gitignore rule, env reads in any supported language."
        }
      ],
      "notes": "History secret scanning covers all reachable git history for credential-pattern paths unless the explicit credential-blob safety valve is reported."
    },
    {
      "id": "A3",
      "title": "Production readiness",
      "category": "code_trust",
      "score": 0,
      "status": "not_applicable",
      "evidence": [],
      "findings": [],
      "metrics": [],
      "notes": "No deployable-service surface detected — production-readiness not applicable to this library/CLI archetype. Signals checked: production server entrypoint (HTTP/RPC port binding in main/server/app files, outside examples/tests/demo dirs), deploy config (vercel.json, render.yaml, fly.toml, Procfile, app.yaml, serverless.yml, docker-compose, k8s/helm manifests), CI deploy job (fly deploy, kubectl apply, helm install/upgrade, docker push). A Dockerfile without an explicit runtime start/service command is ambiguous and does not qualify."
    },
    {
      "id": "A4",
      "title": "Dependency hygiene",
      "category": "code_trust",
      "score": 3.1,
      "status": "warning",
      "evidence": [
        {
          "kind": "dependency_report",
          "label": "Dependency manifest",
          "path": "package.json",
          "line": 1,
          "contentHash": "8b65378dc0f70153a336049b3427feb5cd2fa1c5c0082c148ead93ce74e58700"
        },
        {
          "kind": "dependency_report",
          "label": "Dependency lockfile",
          "path": "packages/docs/pnpm-lock.yaml",
          "line": 1,
          "contentHash": "819481715eef9a633d9773e3d308779b689558cba2e0475dd7f133ae3143afe7"
        }
      ],
      "findings": [
        {
          "severity": "warning",
          "summary": "A4 metric-derived score is 3.1/4.0, in the warning band — no single finding drove this; it reflects the combined metric weighting below.",
          "evidence": {
            "kind": "dependency_report",
            "label": "Dependency manifest",
            "path": "package.json",
            "line": 1,
            "contentHash": "8b65378dc0f70153a336049b3427feb5cd2fa1c5c0082c148ead93ce74e58700"
          }
        }
      ],
      "metrics": [
        {
          "name": "declared_version_range_ratio",
          "label": "Declared version range ratio",
          "value": 94,
          "max": 96,
          "weight": 0.5,
          "unit": "ratio",
          "description": "Measures dependencies declared with an explicit version constraint (range or exact); a library correctly ships ranges, so ranges earn full credit here."
        },
        {
          "name": "lockfile_coverage",
          "label": "Lockfile coverage",
          "value": 1,
          "max": 1,
          "weight": 0.3,
          "unit": "present",
          "description": "Credited when present (reproducible dev/CI installs); a library without a committed lockfile is not penalized — consumers resolve their own trees."
        },
        {
          "name": "dependency_automation_ratio",
          "label": "Dependency automation ratio",
          "value": 0,
          "max": 2,
          "weight": 0.25,
          "unit": "ratio",
          "description": "Credits automated dependency updates and package-manager audit hooks."
        },
        {
          "name": "dependency_count_sanity",
          "label": "Dependency count sanity",
          "value": 1,
          "max": 1,
          "weight": 0.1,
          "unit": "sane",
          "description": "Credits a sane direct-dependency count for a library (full credit up to 120 declared specs across manifests, declining beyond)."
        }
      ],
      "notes": "A4 scored against library/CLI norms (no deploy surface detected — same archetype line as A3): declared version ranges are correct library behavior; a committed lockfile is credited but not required."
    },
    {
      "id": "A5",
      "title": "Claim-vs-reality reconciliation",
      "category": "code_trust",
      "score": 0,
      "status": "not_applicable",
      "evidence": [],
      "findings": [],
      "metrics": [],
      "notes": "No README or docs found — nothing is claimed about this repo, so there is nothing for A5 to reconcile against."
    },
    {
      "id": "B1",
      "title": "Internal process dimension",
      "category": "process_trust",
      "score": 0,
      "status": "not_applicable",
      "evidence": [],
      "findings": [],
      "metrics": [],
      "notes": "Substrate-specific: an internal process dimension is not applicable to external code."
    },
    {
      "id": "B2",
      "title": "PR outcome traceability",
      "category": "process_trust",
      "score": 3.2,
      "status": "warning",
      "evidence": [
        {
          "kind": "ci_run",
          "label": "Pull-request CI workflow",
          "path": ".github/workflows/claude-code-review.yml",
          "line": 1,
          "contentHash": "4c568b40f09bcbe85c6985c7333959067dd99bc4a80ef6fda179617d029eeed8"
        },
        {
          "kind": "ci_run",
          "label": "Pull-request CI workflow",
          "path": ".github/workflows/claude.yml",
          "line": 1,
          "contentHash": "887e633ee5cbba7299cad49c22722e8c9789a3369804b2eee3ccf15b6e6c7a8b"
        },
        {
          "kind": "ci_run",
          "label": "Pull-request CI workflow",
          "path": ".github/workflows/pullfrog.yml",
          "line": 1,
          "contentHash": "238dd53690eabc7912655a75c6f50bf34cf21f39775493fb38242511eb200ee0"
        }
      ],
      "findings": [
        {
          "severity": "warning",
          "summary": "B2 metric-derived score is 3.2/4.0, in the warning band — no single finding drove this; it reflects the combined metric weighting below.",
          "evidence": {
            "kind": "ci_run",
            "label": "Pull-request CI workflow",
            "path": ".github/workflows/claude-code-review.yml",
            "line": 1,
            "contentHash": "4c568b40f09bcbe85c6985c7333959067dd99bc4a80ef6fda179617d029eeed8"
          }
        }
      ],
      "metrics": [
        {
          "name": "pr_trace_primitives",
          "label": "PR trace basic checks",
          "value": 6,
          "max": 2,
          "kind": "saturating_count",
          "weight": 0.8,
          "unit": "signals",
          "description": "Measures CI, PR template, and review-gate evidence for pull-request traceability."
        },
        {
          "name": "pr_merge_ratio",
          "label": "Recent PR merge ratio",
          "value": 0,
          "max": 1,
          "weight": 0.2,
          "unit": "ratio",
          "description": "Uses bounded git history as a deterministic proxy for PR outcome traceability."
        }
      ]
    },
    {
      "id": "B3",
      "title": "CI and QA discipline",
      "category": "process_trust",
      "score": 3.5,
      "status": "verified",
      "evidence": [
        {
          "kind": "test_run",
          "label": "Test script",
          "path": "package.json",
          "line": 1,
          "contentHash": "8b65378dc0f70153a336049b3427feb5cd2fa1c5c0082c148ead93ce74e58700"
        },
        {
          "kind": "ci_run",
          "label": "Lint script",
          "path": "package.json",
          "line": 1,
          "contentHash": "8b65378dc0f70153a336049b3427feb5cd2fa1c5c0082c148ead93ce74e58700"
        },
        {
          "kind": "ci_run",
          "label": "CI workflow",
          "path": ".github/workflows/claude-code-review.yml",
          "line": 1,
          "contentHash": "4c568b40f09bcbe85c6985c7333959067dd99bc4a80ef6fda179617d029eeed8"
        }
      ],
      "findings": [],
      "metrics": [
        {
          "name": "ci_script_depth",
          "label": "CI verification depth",
          "value": 4,
          "max": 4,
          "kind": "saturating_count",
          "weight": 0.45,
          "unit": "signals",
          "description": "Counts npm verification scripts plus distinct test/lint/typecheck/build command categories detected anywhere in CI workflows; language-agnostic, counted by category not by file."
        },
        {
          "name": "default_branch_ci_depth",
          "label": "PR-gate CI workflow count",
          "value": 3,
          "max": 4,
          "kind": "saturating_count",
          "weight": 0.55,
          "unit": "workflows",
          "description": "Counts CI workflows that target pull requests or the default branch, up to 4."
        }
      ]
    },
    {
      "id": "B4",
      "title": "Audit trail and report-up completeness",
      "category": "process_trust",
      "score": 2.9,
      "status": "verified",
      "evidence": [
        {
          "kind": "audit_log",
          "label": "Audit or changelog artifact",
          "path": "SECURITY.md",
          "line": 1,
          "contentHash": "246450874a5d11493c4eb283671af9e25b855daddf6f7789f582c703c8ed8b71"
        },
        {
          "kind": "audit_log",
          "label": "Audit or changelog artifact",
          "path": "packages/docs-v3/CHANGELOG.md",
          "line": 1,
          "contentHash": "491c8ddc14fc19791c2aadef4b9738d49fb1cf2432ff6cb74ad0e14927db2cc6"
        }
      ],
      "findings": [],
      "metrics": [
        {
          "name": "audit_artifact_depth",
          "label": "Audit artifact depth",
          "value": 2,
          "max": 3,
          "kind": "saturating_count",
          "weight": 0.8,
          "unit": "files",
          "description": "Measures quantity of audit, security, runbook, incident, status, and changelog artifacts."
        },
        {
          "name": "audit_freshness_depth",
          "label": "Audit freshness depth",
          "value": 2,
          "max": 2,
          "weight": 0.2,
          "unit": "ratio",
          "description": "Credits audit artifacts that carry freshness/current-state markers."
        }
      ]
    },
    {
      "id": "B5",
      "title": "Internal process dimension",
      "category": "process_trust",
      "score": 0,
      "status": "not_applicable",
      "evidence": [],
      "findings": [],
      "metrics": [],
      "notes": "Substrate-specific: an internal process dimension is not applicable to external code."
    },
    {
      "id": "B6",
      "title": "Privileged-operation human gating",
      "category": "process_trust",
      "score": 0,
      "status": "not_applicable",
      "evidence": [],
      "findings": [],
      "metrics": [],
      "notes": "No privileged-operation surface (prod DB admin GRANT/privilege DDL, role escalation, or documented human-gate governance) detected in this repo."
    }
  ],
  "archetype": "monorepo",
  "contentReadSummary": {
    "skipped": 76,
    "byReason": {
      "unreadable": 0,
      "tooLarge": 0,
      "excludedByExtension": 73,
      "deniedPath": 0,
      "nonRegularFile": 3
    },
    "unreadableByErrno": {},
    "affectedCriteria": []
  },
  "verdict": "conditional",
  "codeTrustScore": 3.1,
  "processTrustScore": 3.2,
  "overallScore": 3.2
}