| Id | Goal | Measured | Verdict | From |
|---|
| G1 | Nothing merges without a person | harness produced patches and drafts only; no git push, no VEX published | met | packet.md |
| G2 | Every kept test was compiled and run in the sandbox before a reviewer sees it | 1 tests ran on head, again for flakes, and on base; 0 flaky | met | results.json |
| G3 | A test that passes on both versions is not presented as CVE evidence | 0 fix-pinning confirmed; pass-on-both CVE tests are classified test-bug and excluded from VEX 'fixed' | met | triage.json |
| G4 | Stage 0 passed before evidence was produced | 28 of 28 register checks; sandbox probe skipped; model probe skipped | met | selfcheck.json |
| G5 | Generated tests ran with no network, no secrets, read-only root, disposable container | {'build_cache': 'writable mount, content-addressed, per environment', 'capabilities': 'all dropped', 'disposable': True, 'limits': {'cpus': '2&#x | met | sandbox.json |
| G6 | Every accepted test carries a provenance record and a signed attestation | 0 records; envelopes verified locally: [True]; signer is a development key | met (development signer) | statement.dsse.json |
| G7 | Every advisory on the work item has a CVE-targeted test attempt and a draft VEX statement | github.com/getkin/kin-openapi: {'CVE-2026-73501': 'affected', 'CVE-2026-73502': 'affected', 'CVE-2026-76905': 'affected', 'CVE-2026-77354': 'affe | met | vex.openvex.json |
| G8 | The run surfaces a finding the PR diff does not show | github.com/getkin/kin-openapi: ['github.com/getkin/kin-openapi v0.139.0 has 8 open advisories at head; reachable=', 'github.com/getkin/kin-openapi: a code path raised the same internal error on bot'] | met | triage.json |
| G9 | Packet within 2 hours of trigger for depth 0 and 1 | intake 2026-09-13T20:44:23+00:00 -> packet 2026-09-14T15:01:17+00:00 | see measurement | run.json summary.json |
| G10 | Every number in the packet points at a file in the work directory | packet sections cite artifact paths; attestation subjects are the patch and the manifest digests | met | statement.json |
| G11 | Test strength measured by mutation and coverage delta | github.com/getkin/kin-openapi: no mutation engine for go yet; the score is not measured, not zero; coverage delta: no baseline overlay suite yet | not applicable | mutation.json |
| G12 | The pipeline's own gaps are stated, never inherited silently | analysis predates the pipeline facts; rerun analysis | not applicable | |
| G13 | Every behaviour the change reaches ends in exactly one state, and a gap carries its reason | 5 behaviour(s) reached: 0 validated, 0 for your environment, 5 stated gap(s) (5 no-test-generated); 2 reference(s) set aside with a reason | met | accounting-summary.json accounting.json |