# Latest PR Scorecard

![ORANGE 12/16](proof-badge.svg)

- Pull request: [#71](https://github.com/ravisingh11/ai-software-toolkit-reference-app/pull/71)
- Evaluated commit: [55f159118b08](https://github.com/ravisingh11/ai-software-toolkit-reference-app/commit/55f159118b0881c01ceb38e8a738ff70b9a45de6)
- PR base: [6126f500b4b3](https://github.com/ravisingh11/ai-software-toolkit-reference-app/commit/6126f500b4b3c724961a70de3379dcdade47f3a9)
- Policy / runtime: [6126f500b4b3](https://github.com/ravisingh11/ai-software-toolkit-reference-app/commit/6126f500b4b3c724961a70de3379dcdade47f3a9)
- Page renderer: [6126f500b4b3](https://github.com/ravisingh11/ai-software-toolkit-reference-app/commit/6126f500b4b3c724961a70de3379dcdade47f3a9)

| Field | Value |
| --- | --- |
| Repository | ravisingh11/ai-software-toolkit-reference-app |
| Operation | change |
| Evaluation stage | pull-request-development |
| Status | ORANGE |
| Selected checks | 12/16 passed |
| Enforced | No checks enforced |
| Advisory | 12/16 passed |
| Source run | [41245328105 attempt 1](https://github.com/ravisingh11/ai-software-toolkit-reference-app/actions/runs/41245328105/attempts/1) |
| Source created | 2026-10-31T21:48:55Z |
| Published | 2026-11-01T05:59:26Z |
| Subject digest | sha256:3616c1568eb99e2a569798d4679d34bd3d3e4d4620f6b5ded9a8816b76ca803a |

| Evidence results | Passed | Unavailable evidence |
| --- | ---: | ---: |
| All selected checks | 12 | 4 |
| Advisory | 12 | 4 |

Failed means a reported failure. Blocked means the producer reported a blocker. Unavailable evidence includes not configured, disabled, awaiting manual run, and checks marked Unable to verify; see their separate counts and labels below. Tools available to adopt and checks relevant later are excluded from this stage’s score. Checks evaluated on another subject are identified separately. Unreported checks have unknown selection and are not assumed excluded.

No enforced controls are configured, so the policy decision is not gated by any control and every result is advisory. It does not establish mergeability or release readiness. GitHub required merge checks are separate. Advisory results do not block the toolkit policy decision. Enforced checks require a pass: a failed, blocked, or unverifiable enforced check blocks that decision. GitHub blocks merging only through its configured required checks and rulesets.
This is a published PR snapshot. The source timestamp does not prove it matches the current PR head or current main.
Test totals, coverage, validator counts, and scanner finding counts, where shown, are self-reported by the pull request's own workflow run and are not independently verified. A scanner card without counts says where that scanner keeps its findings.

## PR Size · Files & LOC

Large PRs can overwhelm human reviewers; smaller, focused PRs make feedback more actionable.

Advisory — warns only; does not block the policy decision.

| Measurement | Counted | Limit | Result |
| --- | ---: | ---: | --- |
| Counted files | 1 | 12 | Within limit |
| Added lines | 1 | 300 | Within limit |
| Added + deleted lines | 2 | 500 | Within limit |
| Most added lines in one file | 1 | 150 | Within limit |

Total: 1 files; 1 added lines; 2 added + deleted lines.
Excluded: 0 files; 0 added lines; 0 added + deleted lines.
Binary files: 0 counted; 0 excluded. Binary contents have no line count.

## Checks by stage

Built-in activation and evidence availability: Unable to verify: 4. Advisory is a policy mode, independent of provider activation. These categories split unavailable evidence for built-in checks; none counts as passed.

Only policy-selected checks for the evaluated stage enter the score. Unselected tools are adoption options, not failures.

### Selected checks

| Check | ID | Provider | Mode | Result | Purpose |
| --- | --- | --- | --- | --- | --- |
| Repository Validation | `repository-validation` | [Repository Validators](https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml) · [Latest reported run](https://github.com/ravisingh11/ai-software-toolkit-reference-app/actions/runs/41245328701/job/124667450816) | Advisory | Passed | Validate repository-owned contracts and configuration |
| Documentation Validation | `documentation-validation` | [Repository Validators](https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml) · [Latest reported run](https://github.com/ravisingh11/ai-software-toolkit-reference-app/actions/runs/41245328701/job/124667450752) | Advisory | Passed | Validate documentation structure, links, and declared targets |
| Repository Ground Truth | `repository-ground-truth` | [Repository Validators](https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml) · [Latest reported run](https://github.com/ravisingh11/ai-software-toolkit-reference-app/actions/runs/41245328701/job/124667450742) | Advisory | Passed | Validate declared repository architecture and engineering documents |
| PR Size | `change-scope` | [PR Size / Files & LOC](https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml) · [Latest reported run](https://github.com/ravisingh11/ai-software-toolkit-reference-app/runs/124667541822) | Advisory | Passed | Detect oversized or unexpectedly broad changes |
| PR Metadata | `pr-metadata` | [Repository PR Metadata](https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml) · [Latest reported run](https://github.com/ravisingh11/ai-software-toolkit-reference-app/actions/runs/41245328105/attempts/1) | Advisory | Passed | Validate pull-request title and body requirements against mutable PR state |
| Format and Lint | `format-and-lint` | [Repository Format and Lint Command](https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml) · [Latest reported run](https://github.com/ravisingh11/ai-software-toolkit-reference-app/actions/runs/41245328697/job/124667450515) | Advisory | Passed | Verify repository formatting and lint rules with the repository-owned command |
| Migration Validation | `migration-validation` | [Repository Migration Validation Command](https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml) · [Latest reported run](https://github.com/ravisingh11/ai-software-toolkit-reference-app/actions/runs/41245328599/job/124667450442) | Advisory | Passed | Validate repository-specific database and data migration safety |
| Build | `build` | [Repository Build Command](https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml) · [Latest reported run](https://github.com/ravisingh11/ai-software-toolkit-reference-app/actions/runs/41245328705/job/124667450625) | Advisory | Passed | Detect compilation, packaging, and build-time regressions |
| Unit Tests | `unit-tests` | [Repository Unit Test Command](https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml) · [Latest reported run](https://github.com/ravisingh11/ai-software-toolkit-reference-app/actions/runs/41245328703/job/124667450455) | Advisory | Passed | Detect functional regressions in changed behavior |
| Changed Code Coverage | `changed-code-coverage` | [Repository Changed Code Coverage Command](https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml) · [Latest reported run](https://github.com/ravisingh11/ai-software-toolkit-reference-app/actions/runs/41245328638/job/124667487401) | Advisory | Unable to verify | Measure test coverage for changed code |
| Custom Static Analysis | `custom-static-analysis` | [Semgrep Community Edition](https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml) · [Latest reported run](https://github.com/ravisingh11/ai-software-toolkit-reference-app/actions/runs/41245328622/job/124667768200) | Advisory | Passed | Run repository and organization-specific static rules |
| Secret Detection | `secret-detection` | [Gitleaks CLI](https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml) · [Latest reported run](https://github.com/ravisingh11/ai-software-toolkit-reference-app/actions/runs/41245328692/job/124667450429) | Advisory | Passed | Detect credentials and authentication material in source history |
| Deep SAST | `deep-sast` | [GitHub CodeQL default setup](https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml) | Advisory | Unable to verify | Detect security vulnerabilities through semantic source analysis |
| Dependency Change Review | `dependency-change-review` | [GitHub Dependency Review](https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml) · [Latest reported run](https://github.com/ravisingh11/ai-software-toolkit-reference-app/actions/runs/41245328647/job/124667450152) | Advisory | Passed | Review security and license risk introduced by dependency changes |
| Platform Secret Protection | `platform-secret-protection` | [GitHub Secret Protection](https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml) · [Latest reported run](https://github.com/ravisingh11/ai-software-toolkit-reference-app/runs/124667462068) | Advisory | Unable to verify | Verify platform secret scanning and push protection |
| Dependency Remediation | `dependency-remediation` | [GitHub Dependabot](https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml) · [Latest reported run](https://github.com/ravisingh11/ai-software-toolkit-reference-app/runs/124667545639) | Advisory | Unable to verify | Verify automated dependency security remediation is configured |
### Tools available to adopt

| Check | ID | Provider | Mode | Result | Purpose |
| --- | --- | --- | --- | --- | --- |
| Functional QA | `functional-qa` | [QA Bootstrap Workflow](https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml) | — | Available to adopt | Exercise the running application as a user to detect functional regressions in changed behavior |
| Static Quality | `static-quality` | [SonarQube](https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml) | — | Available to adopt | Evaluate maintainability, reliability, and static quality gates |
| Dependency Vulnerability | `dependency-vulnerability` | [Snyk Open Source](https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml) | — | Available to adopt | Detect known vulnerabilities in resolved dependencies |
| License Compliance | `license-compliance` | [FOSSA](https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml) | — | Available to adopt | Evaluate dependency licenses against repository policy |
| AI Engineering Review | `ai-engineering-review` | [Codex Code Review](https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml) | — | Available to adopt | Review correctness, architecture, maintainability, and regression risk |
| AI QA Review | `ai-qa-review` | [AI QA Review Adapter](https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml) | — | Available to adopt | Review tests, edge cases, failure paths, and assertions |
| AI Security Review | `ai-security-review` | [AI Security Review Adapter](https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml) | — | Available to adopt | Review authentication, isolation, injection, secrets, and privilege risks |
| AI Repository Standards Review | `ai-repository-standards-review` | [AI Repository Standards Review Adapter](https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml) | — | Available to adopt | Review changes against repository-owned engineering ground truth |
| IaC Misconfiguration | `iac-misconfiguration` | [Trivy IaC Configuration](https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml) | — | Available to adopt | Detect insecure infrastructure-as-code configuration |

Excluded from this stage's score. Adopt when useful: add the producer workflow, configure its inputs, then select Advisory in .proof/policy.yaml. Manual workflows remain manual.

- Functional QA: useful during pull-request development.
- Static Quality: useful during pull-request development.
- Dependency Vulnerability: useful during pull-request development.
- License Compliance: useful during pull-request development.
- AI Engineering Review: useful during pull-request development.
- AI QA Review: useful during pull-request development.
- AI Security Review: useful during pull-request development.
- AI Repository Standards Review: useful during pull-request development.
- IaC Misconfiguration: useful during pull-request development.
### Checks relevant later

| Check | ID | Provider | Mode | Result | Purpose |
| --- | --- | --- | --- | --- | --- |
| Artifact Provenance | `artifact-provenance` | [GitHub Artifact Attestations](https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml) | — | Relevant later | Attest where and how a release artifact was built |
| Runtime Soak | `runtime-soak` | [Repository Soak Command](https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml) | — | Relevant later | Detect runtime degradation, leaks, and performance drift over time |
| Container Vulnerability | `container-vulnerability` | [Trivy Container Image](https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml) | — | Relevant later | Detect vulnerabilities in container images |
| Artifact SBOM | `artifact-sbom` | [Trivy Artifact SBOM](https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml) | — | Relevant later | Record the software components contained in an artifact |
| Artifact Vulnerability | `artifact-vulnerability` | [Trivy Artifact Vulnerabilities](https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml) | — | Relevant later | Detect vulnerabilities in a built release artifact |
| Deployment Policy | `deployment-policy` | [Verification Deployment Policy](https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml) | — | Relevant later | Verify deployment approval and environment policy |
| Dynamic Application Security | `dynamic-application-security` | [OWASP ZAP Local Baseline](https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml) | — | Relevant later | Detect vulnerabilities in a running application |
| Runtime Assurance | `runtime-assurance` | [Verification Runtime Assurance](https://github.com/ravisingh11/ai-software-toolkit-reference-app/blob/6126f500b4b3c724961a70de3379dcdade47f3a9/.proof/providers.yaml) | — | Relevant later | Verify runtime security and operational safeguards |

Excluded from this stage's score. Adopt when useful: add the producer workflow, configure its inputs, then select Advisory in .proof/policy.yaml. Manual workflows remain manual.

- Artifact Provenance: useful during Release.
- Runtime Soak: useful during Pre-release.
- Container Vulnerability: useful during Release.
- Artifact SBOM: useful during Release.
- Artifact Vulnerability: useful during Release.
- Deployment Policy: useful during Deployment.
- Dynamic Application Security: useful during Post-deployment.
- Runtime Assurance: useful during Runtime.

### Missing verification evidence

- Changed Code Coverage: Missing: a usable producer result for this evaluated revision. Open the source CI run to check whether the producer ran, has its required configuration, and published revision-bound evidence. This snapshot does not establish the exact cause. This is not a passing result.
- Deep SAST: Missing: a usable producer result for this evaluated revision. Open the source CI run to check whether the producer ran, has its required configuration, and published revision-bound evidence. This snapshot does not establish the exact cause. This is not a passing result.
- Platform Secret Protection: Missing: a usable producer result for this evaluated revision. Open the source CI run to check whether the producer ran, has its required configuration, and published revision-bound evidence. This snapshot does not establish the exact cause. This is not a passing result.
- Dependency Remediation: Missing: verified Dependabot settings evidence for this revision. Check Dependabot Verification and whether SECURITY_SETTINGS_TOKEN can read vulnerability alerts and automated security fix settings. Dependabot may already be enabled even when its verification evidence is missing. This snapshot does not establish the exact cause. This is not a passing result.

### Self-reported measurements

Self-reported by the pull request's own workflow run; not independently verified and never used for the result.

- Repository Validation: 4 passed · 0 failed · 0 not run (4 contract groups)
- Documentation Validation: 56 Markdown files · 136 local links checked · 0 broken · 0 documentation mapping failures
- Repository Ground Truth: 1 of 1 declared documents found · 0 missing
- Custom Static Analysis: No findings reported
- Secret Detection: No findings reported

### PR metadata

Evaluated by the trusted base-branch PR metadata validator. The title, description, and section names are not published.

- PR Metadata: Title matches the required format · No required sections configured