# Latest PR Scorecard

![ORANGE 14/16](proof-badge.svg)

- Pull request: [#173](https://github.com/ravisingh11/ai-engineering-guardrails/pull/173)
- Evaluated commit: [f937e1d6ca91](https://github.com/ravisingh11/ai-engineering-guardrails/commit/f937e1d6ca91c5bb25531ffe48fc4f4e414ff2bf)
- PR base: [f095db2e8b3c](https://github.com/ravisingh11/ai-engineering-guardrails/commit/f095db2e8b3cc34eb737f53bab8809fdbb7a07e7)
- Policy / runtime: [f095db2e8b3c](https://github.com/ravisingh11/ai-engineering-guardrails/commit/f095db2e8b3cc34eb737f53bab8809fdbb7a07e7)
- Page renderer: [c8c10d024b92](https://github.com/ravisingh11/ai-engineering-guardrails/commit/c8c10d024b92e1793e5076357bbf1e268ebe2f85)

| Field | Value |
| --- | --- |
| Repository | ravisingh11/ai-engineering-guardrails |
| Operation | change |
| Evaluation stage | pull-request-development |
| Status | ORANGE |
| Selected checks | 14/16 passed |
| Enforced | No checks enforced |
| Advisory | 14/16 passed |
| Source run | [41676039298 attempt 1](https://github.com/ravisingh11/ai-engineering-guardrails/actions/runs/41676039298/attempts/1) |
| Source created | 2026-11-03T16:37:06Z |
| Published | 2026-11-05T06:55:31Z |
| Subject digest | sha256:713bd9ebd5320d14839bec65ccaa2a7d8f9ebee97e4dc42abe8559c74fe5e607 |

| Evidence results | Passed | Failed |
| --- | ---: | ---: |
| All selected checks | 14 | 2 |
| Advisory | 14 | 2 |

Failed means a reported failure. Blocked means the producer reported a blocker. Unavailable evidence includes not configured, disabled, awaiting manual run, and checks marked Unable to verify; see their separate counts and labels below. Tools available to adopt and checks relevant later are excluded from this stage’s score. Checks evaluated on another subject are identified separately. Unreported checks have unknown selection and are not assumed excluded.

No enforced controls are configured, so the policy decision is not gated by any control and every result is advisory. It does not establish mergeability or release readiness. GitHub required merge checks are separate. Advisory results do not block the toolkit policy decision. Enforced checks require a pass: a failed, blocked, or unverifiable enforced check blocks that decision. GitHub blocks merging only through its configured required checks and rulesets.
This is a published PR snapshot. The source timestamp does not prove it matches the current PR head or current main.
Test totals, coverage, validator counts, and scanner finding counts, where shown, are self-reported by the pull request's own workflow run and are not independently verified. A scanner card without counts says where that scanner keeps its findings.

## PR Size · Files & LOC

Large PRs can overwhelm human reviewers; smaller, focused PRs make feedback more actionable.

Advisory — warns only; does not block the policy decision.

| Measurement | Counted | Limit | Result |
| --- | ---: | ---: | --- |
| Counted files | 3 | 12 | Within limit |
| Added lines | 46 | 300 | Within limit |
| Added + deleted lines | 52 | 500 | Within limit |
| Most added lines in one file | 16 | 150 | Within limit |

Total: 3 files; 46 added lines; 52 added + deleted lines.
Excluded: 0 files; 0 added lines; 0 added + deleted lines.
Binary files: 0 counted; 0 excluded. Binary contents have no line count.

## Checks by stage

Built-in activation and evidence availability: No unavailable evidence reported. Advisory is a policy mode, independent of provider activation. These categories split unavailable evidence for built-in checks; none counts as passed.

Only policy-selected checks for the evaluated stage enter the score. Unselected tools are adoption options, not failures.

### Selected checks

| Check | ID | Provider | Mode | Result | Purpose |
| --- | --- | --- | --- | --- | --- |
| Repository Validation | `repository-validation` | [Repository Validators](https://github.com/ravisingh11/ai-engineering-guardrails/blob/f095db2e8b3cc34eb737f53bab8809fdbb7a07e7/.proof/providers.yaml) · [Latest reported run](https://github.com/ravisingh11/ai-engineering-guardrails/actions/runs/41676047073/job/126056814945) | Advisory | Passed | Validate repository-owned contracts and configuration |
| Documentation Validation | `documentation-validation` | [Repository Validators](https://github.com/ravisingh11/ai-engineering-guardrails/blob/f095db2e8b3cc34eb737f53bab8809fdbb7a07e7/.proof/providers.yaml) · [Latest reported run](https://github.com/ravisingh11/ai-engineering-guardrails/actions/runs/41676047073/job/126056814860) | Advisory | Failed | Validate documentation structure, links, and declared targets |
| Repository Ground Truth | `repository-ground-truth` | [Repository Validators](https://github.com/ravisingh11/ai-engineering-guardrails/blob/f095db2e8b3cc34eb737f53bab8809fdbb7a07e7/.proof/providers.yaml) · [Latest reported run](https://github.com/ravisingh11/ai-engineering-guardrails/actions/runs/41676047073/job/126056814261) | Advisory | Passed | Validate declared repository architecture and engineering documents |
| PR Size | `change-scope` | [PR Size / Files & LOC](https://github.com/ravisingh11/ai-engineering-guardrails/blob/f095db2e8b3cc34eb737f53bab8809fdbb7a07e7/.proof/providers.yaml) · [Latest reported run](https://github.com/ravisingh11/ai-engineering-guardrails/runs/126056904558) | Advisory | Passed | Detect oversized or unexpectedly broad changes |
| PR Metadata | `pr-metadata` | [Repository PR Metadata](https://github.com/ravisingh11/ai-engineering-guardrails/blob/f095db2e8b3cc34eb737f53bab8809fdbb7a07e7/.proof/providers.yaml) · [Latest reported run](https://github.com/ravisingh11/ai-engineering-guardrails/actions/runs/41676039298/attempts/1) | Advisory | Failed | Validate pull-request title and body requirements against mutable PR state |
| Format and Lint | `format-and-lint` | [Repository Format and Lint Command](https://github.com/ravisingh11/ai-engineering-guardrails/blob/f095db2e8b3cc34eb737f53bab8809fdbb7a07e7/.proof/providers.yaml) · [Latest reported run](https://github.com/ravisingh11/ai-engineering-guardrails/actions/runs/41676046885/job/126056814298) | Advisory | Passed | Verify repository formatting and lint rules with the repository-owned command |
| Migration Validation | `migration-validation` | [Repository Migration Validation Command](https://github.com/ravisingh11/ai-engineering-guardrails/blob/f095db2e8b3cc34eb737f53bab8809fdbb7a07e7/.proof/providers.yaml) · [Latest reported run](https://github.com/ravisingh11/ai-engineering-guardrails/actions/runs/41676047233/job/126056813855) | Advisory | Passed | Validate repository-specific database and data migration safety |
| Build | `build` | [Repository Build Command](https://github.com/ravisingh11/ai-engineering-guardrails/blob/f095db2e8b3cc34eb737f53bab8809fdbb7a07e7/.proof/providers.yaml) · [Latest reported run](https://github.com/ravisingh11/ai-engineering-guardrails/actions/runs/41676046835/job/126056812721) | Advisory | Passed | Detect compilation, packaging, and build-time regressions |
| Unit Tests | `unit-tests` | [Repository Unit Test Command](https://github.com/ravisingh11/ai-engineering-guardrails/blob/f095db2e8b3cc34eb737f53bab8809fdbb7a07e7/.proof/providers.yaml) · [Latest reported run](https://github.com/ravisingh11/ai-engineering-guardrails/actions/runs/41676046944/job/126057595993) | Advisory | Passed | Detect functional regressions in changed behavior |
| Changed Code Coverage | `changed-code-coverage` | [Repository Changed Code Coverage Command](https://github.com/ravisingh11/ai-engineering-guardrails/blob/f095db2e8b3cc34eb737f53bab8809fdbb7a07e7/.proof/providers.yaml) · [Latest reported run](https://github.com/ravisingh11/ai-engineering-guardrails/actions/runs/41676047089/job/126057121192) | Advisory | Passed | Measure test coverage for changed code |
| Custom Static Analysis | `custom-static-analysis` | [Semgrep Community Edition](https://github.com/ravisingh11/ai-engineering-guardrails/blob/f095db2e8b3cc34eb737f53bab8809fdbb7a07e7/.proof/providers.yaml) · [Latest reported run](https://github.com/ravisingh11/ai-engineering-guardrails/actions/runs/41676046891/job/126056812230) | Advisory | Passed | Run repository and organization-specific static rules |
| Secret Detection | `secret-detection` | [Gitleaks CLI](https://github.com/ravisingh11/ai-engineering-guardrails/blob/f095db2e8b3cc34eb737f53bab8809fdbb7a07e7/.proof/providers.yaml) · [Latest reported run](https://github.com/ravisingh11/ai-engineering-guardrails/actions/runs/41676046890/job/126056812103) | Advisory | Passed | Detect credentials and authentication material in source history |
| Deep SAST | `deep-sast` | [GitHub CodeQL](https://github.com/ravisingh11/ai-engineering-guardrails/blob/f095db2e8b3cc34eb737f53bab8809fdbb7a07e7/.proof/providers.yaml) · [Latest reported run](https://github.com/ravisingh11/ai-engineering-guardrails/actions/runs/41676047163/job/126056813119) | Advisory | Passed | Detect security vulnerabilities through semantic source analysis |
| Dependency Change Review | `dependency-change-review` | [GitHub Dependency Review](https://github.com/ravisingh11/ai-engineering-guardrails/blob/f095db2e8b3cc34eb737f53bab8809fdbb7a07e7/.proof/providers.yaml) · [Latest reported run](https://github.com/ravisingh11/ai-engineering-guardrails/actions/runs/41676046993/job/126056812628) | Advisory | Passed | Review security and license risk introduced by dependency changes |
| Platform Secret Protection | `platform-secret-protection` | [GitHub Secret Protection](https://github.com/ravisingh11/ai-engineering-guardrails/blob/f095db2e8b3cc34eb737f53bab8809fdbb7a07e7/.proof/providers.yaml) · [Latest reported run](https://github.com/ravisingh11/ai-engineering-guardrails/runs/126056856131) | Advisory | Passed | Verify platform secret scanning and push protection |
| Dependency Remediation | `dependency-remediation` | [GitHub Dependabot](https://github.com/ravisingh11/ai-engineering-guardrails/blob/f095db2e8b3cc34eb737f53bab8809fdbb7a07e7/.proof/providers.yaml) · [Latest reported run](https://github.com/ravisingh11/ai-engineering-guardrails/runs/126056843093) | Advisory | Passed | Verify automated dependency security remediation is configured |
### Tools available to adopt

| Check | ID | Provider | Mode | Result | Purpose |
| --- | --- | --- | --- | --- | --- |
| Functional QA | `functional-qa` | [QA Bootstrap Workflow](https://github.com/ravisingh11/ai-engineering-guardrails/blob/f095db2e8b3cc34eb737f53bab8809fdbb7a07e7/.proof/providers.yaml) | — | Available to adopt | Exercise the running application as a user to detect functional regressions in changed behavior |
| Static Quality | `static-quality` | [SonarQube](https://github.com/ravisingh11/ai-engineering-guardrails/blob/f095db2e8b3cc34eb737f53bab8809fdbb7a07e7/.proof/providers.yaml) | — | Available to adopt | Evaluate maintainability, reliability, and static quality gates |
| Dependency Vulnerability | `dependency-vulnerability` | [Snyk Open Source](https://github.com/ravisingh11/ai-engineering-guardrails/blob/f095db2e8b3cc34eb737f53bab8809fdbb7a07e7/.proof/providers.yaml) | — | Available to adopt | Detect known vulnerabilities in resolved dependencies |
| License Compliance | `license-compliance` | [FOSSA](https://github.com/ravisingh11/ai-engineering-guardrails/blob/f095db2e8b3cc34eb737f53bab8809fdbb7a07e7/.proof/providers.yaml) | — | Available to adopt | Evaluate dependency licenses against repository policy |
| AI Engineering Review | `ai-engineering-review` | [Codex Code Review](https://github.com/ravisingh11/ai-engineering-guardrails/blob/f095db2e8b3cc34eb737f53bab8809fdbb7a07e7/.proof/providers.yaml) | — | Available to adopt | Review correctness, architecture, maintainability, and regression risk |
| AI QA Review | `ai-qa-review` | [AI QA Review Adapter](https://github.com/ravisingh11/ai-engineering-guardrails/blob/f095db2e8b3cc34eb737f53bab8809fdbb7a07e7/.proof/providers.yaml) | — | Available to adopt | Review tests, edge cases, failure paths, and assertions |
| AI Security Review | `ai-security-review` | [AI Security Review Adapter](https://github.com/ravisingh11/ai-engineering-guardrails/blob/f095db2e8b3cc34eb737f53bab8809fdbb7a07e7/.proof/providers.yaml) | — | Available to adopt | Review authentication, isolation, injection, secrets, and privilege risks |
| AI Repository Standards Review | `ai-repository-standards-review` | [AI Repository Standards Review Adapter](https://github.com/ravisingh11/ai-engineering-guardrails/blob/f095db2e8b3cc34eb737f53bab8809fdbb7a07e7/.proof/providers.yaml) | — | Available to adopt | Review changes against repository-owned engineering ground truth |
| IaC Misconfiguration | `iac-misconfiguration` | [Trivy IaC Configuration](https://github.com/ravisingh11/ai-engineering-guardrails/blob/f095db2e8b3cc34eb737f53bab8809fdbb7a07e7/.proof/providers.yaml) | — | Available to adopt | Detect insecure infrastructure-as-code configuration |

Excluded from this stage's score. Adopt when useful: add the producer workflow, configure its inputs, then select Advisory in .proof/policy.yaml. Manual workflows remain manual.

- Functional QA: useful during pull-request development.
- Static Quality: useful during pull-request development.
- Dependency Vulnerability: useful during pull-request development.
- License Compliance: useful during pull-request development.
- AI Engineering Review: useful during pull-request development.
- AI QA Review: useful during pull-request development.
- AI Security Review: useful during pull-request development.
- AI Repository Standards Review: useful during pull-request development.
- IaC Misconfiguration: useful during pull-request development.
### Checks relevant later

| Check | ID | Provider | Mode | Result | Purpose |
| --- | --- | --- | --- | --- | --- |
| Artifact Provenance | `artifact-provenance` | [GitHub Artifact Attestations](https://github.com/ravisingh11/ai-engineering-guardrails/blob/f095db2e8b3cc34eb737f53bab8809fdbb7a07e7/.proof/providers.yaml) | — | Relevant later | Attest where and how a release artifact was built |
| Runtime Soak | `runtime-soak` | [Repository Soak Command](https://github.com/ravisingh11/ai-engineering-guardrails/blob/f095db2e8b3cc34eb737f53bab8809fdbb7a07e7/.proof/providers.yaml) | — | Relevant later | Detect runtime degradation, leaks, and performance drift over time |
| Container Vulnerability | `container-vulnerability` | [Trivy Container Image](https://github.com/ravisingh11/ai-engineering-guardrails/blob/f095db2e8b3cc34eb737f53bab8809fdbb7a07e7/.proof/providers.yaml) | — | Relevant later | Detect vulnerabilities in container images |
| Artifact SBOM | `artifact-sbom` | [Trivy Artifact SBOM](https://github.com/ravisingh11/ai-engineering-guardrails/blob/f095db2e8b3cc34eb737f53bab8809fdbb7a07e7/.proof/providers.yaml) | — | Relevant later | Record the software components contained in an artifact |
| Artifact Vulnerability | `artifact-vulnerability` | [Trivy Artifact Vulnerabilities](https://github.com/ravisingh11/ai-engineering-guardrails/blob/f095db2e8b3cc34eb737f53bab8809fdbb7a07e7/.proof/providers.yaml) | — | Relevant later | Detect vulnerabilities in a built release artifact |
| Deployment Policy | `deployment-policy` | [Verification Deployment Policy](https://github.com/ravisingh11/ai-engineering-guardrails/blob/f095db2e8b3cc34eb737f53bab8809fdbb7a07e7/.proof/providers.yaml) | — | Relevant later | Verify deployment approval and environment policy |
| Dynamic Application Security | `dynamic-application-security` | [OWASP ZAP Local Baseline](https://github.com/ravisingh11/ai-engineering-guardrails/blob/f095db2e8b3cc34eb737f53bab8809fdbb7a07e7/.proof/providers.yaml) | — | Relevant later | Detect vulnerabilities in a running application |
| Runtime Assurance | `runtime-assurance` | [Verification Runtime Assurance](https://github.com/ravisingh11/ai-engineering-guardrails/blob/f095db2e8b3cc34eb737f53bab8809fdbb7a07e7/.proof/providers.yaml) | — | Relevant later | Verify runtime security and operational safeguards |

Excluded from this stage's score. Adopt when useful: add the producer workflow, configure its inputs, then select Advisory in .proof/policy.yaml. Manual workflows remain manual.

- Artifact Provenance: useful during Release.
- Runtime Soak: useful during Pre-release.
- Container Vulnerability: useful during Release.
- Artifact SBOM: useful during Release.
- Artifact Vulnerability: useful during Release.
- Deployment Policy: useful during Deployment.
- Dynamic Application Security: useful during Post-deployment.
- Runtime Assurance: useful during Runtime.

### Failure details

- PR Metadata: Missing required PR body section: ## Verification. Update the PR description and collect a fresh metadata result.

### Self-reported measurements

Self-reported by the pull request's own workflow run; not independently verified and never used for the result.

- Repository Validation: 4 passed · 0 failed · 0 not run (4 contract groups)
- Documentation Validation: 202 Markdown files · 487 local links checked · 0 broken · 1 documentation mapping failures
- Repository Ground Truth: 6 of 6 declared documents found · 0 missing
- Migration Validation: No migrations found to check
- Unit Tests: 1,155 passed · 0 failed · 2 skipped (1,157 tests)
- Changed Code Coverage: 5 of 5 changed lines covered (100.0%) · target 90%
- Custom Static Analysis: No findings reported
- Secret Detection: No findings reported
- Deep SAST: 0 critical · 3 high · 0 medium · 0 low

### PR metadata

Evaluated by the trusted base-branch PR metadata validator. The title, description, and section names are not published.

- PR Metadata: Title does not match the required format · 0 of 1 required section present