| Id | Goal | Measured | Verdict | From |
|---|
| G1 | Nothing merges without a person | harness produced patches and drafts only; no git push, no VEX published | met | packet.md |
| G2 | Every kept test was compiled and run in the sandbox before a reviewer sees it | 7 tests ran on head, again for flakes, and on base; 0 flaky | met | results.json |
| G3 | A test that passes on both versions is not presented as CVE evidence | 0 fix-pinning confirmed; pass-on-both CVE tests are classified test-bug and excluded from VEX 'fixed' | met | triage.json |
| G4 | Stage 0 passed before evidence was produced | 28 of 28 register checks; sandbox probe skipped; model probe skipped | met | selfcheck.json |
| G5 | Generated tests ran with no network, no secrets, read-only root, disposable container | {'build_cache': 'per environment on the shared workspace', 'disposable': 'the task pod', 'limits': {'cpus': '2', 'memory': '4g', & | met | sandbox.json |
| G6 | Every accepted test carries a provenance record and a signed attestation | 5 records; envelopes verified locally: [True]; signer is a development key | met (development signer) | statement.dsse.json |
| G7 | Every advisory on the work item has a CVE-targeted test attempt and a draft VEX statement | github.com/getkin/kin-openapi: {'CVE-2026-73501': 'affected', 'CVE-2026-73502': 'affected', 'CVE-2026-76905': 'affected', 'CVE-2026-77354': 'affe | met | vex.openvex.json |
| G8 | The run surfaces a finding the PR diff does not show | github.com/getkin/kin-openapi: ['github.com/getkin/kin-openapi v0.139.0 has 8 open advisories at head; reachable=', 'github.com/getkin/kin-openapi: a code path raised the same internal error on bot', | met | triage.json |
| G9 | Packet within 2 hours of trigger for depth 0 and 1 | intake 2026-09-26T21:14:08+00:00 -> packet 2026-09-27T00:19:45+00:00 | see measurement | run.json summary.json |
| G10 | Every number in the packet points at a file in the work directory | packet sections cite artifact paths; attestation subjects are the patch and the manifest digests | met | statement.json |
| G11 | Test strength measured by mutation and coverage delta | github.com/getkin/kin-openapi: score 0.24 on 25 sampled mutants; coverage delta: no baseline overlay suite yet | not met (target 0.6 on sampled mutants) | mutation.json |
| G12 | The pipeline's own gaps are stated, never inherited silently | analysis predates the pipeline facts; rerun analysis | not applicable | |
| G13 | Every behaviour the change reaches ends in exactly one state, and a gap carries its reason | 5 behaviour(s) reached: 0 validated, 0 for your environment, 5 stated gap(s) (1 executed-not-checked, 3 no-test-generated, 1 strength-not-sampled); 2 reference(s) set aside with a reason | met | accounting-summary.json accounting.json |