Repository navigation
Publish live Claude per-repository evidence for every selected component and record the workflow review - #56
Merged
seathatflowsinourveins merged 2 commits intoSep 22, 2026
Conversation
…ent and record the workflow review Adds the sanitized 70-row report (47 asserted functional rows, 10 readiness, 3 version/help, 10 without local execution), 14 reviewed dashboard screenshots, a compact summary, projection provenance with names, sizes and hashes of all 266 privately retained streams, and a receipt whose embedded artifacts are a small declared subset. A check that does not invoke its component is labelled a local integration check and never counts toward a row. The page carries a Content-Security-Policy with a computed script hash. A new hash-listed unit test, run by the required validate job, enforces the bundle's invariants (five negative controls caught locally). GitHub workflow review, 2026-09-21: zizmor 1.30.1 regular persona 0 findings, attested actionlint 1.7.12 exit 0 on all nine workflows, all seven action pins resolve to their named and latest releases. Exact release comments added in two workflows; the same edit was reverted in three whose bytes are hash-bound (two frozen into recovery plans, where the repository's tests failed, and one recorded in four execution receipts), leaving six comments for the next functional change. Stricter-persona findings are retained with reasons. Reviewed before publication by a native Codex review and two Opus evidence reviewers; supported findings fixed (two rows no longer count local checks as component evidence; repository deep links; exact counts and bindings). Local CI-equivalent sequence: zizmor, actionlint, five validators, explorer rebuild check and 759 unit tests pass. Co-Authored-By: Claude Fable 5.1 <[email protected]>
…ents An independent evidence reviewer checked the branch at 34e2959: all 14 public screenshots and every new text file passed its privacy review, and all class, hash, tier and lifetime numbers recomputed exactly. It found that the guide said 25 rows have no audit record where 26 do (uv is listed as not contestable), that one anomaly sentence inverted the recorded Grafana defect and dropped its unexplained part, and that nothing bound the narrative counts in the guide, the explorer entry and the receipt claim to the results. Both statements are corrected and a tenth test now recomputes those counts. Local CI-equivalent sequence passes again: zizmor, actionlint, five validators, explorer rebuild check and 760 unit tests. Co-Authored-By: Claude Fable 5.1 <[email protected]>
seathatflowsinourveins
added a commit
that referenced
this pull request
Sep 22, 2026
Merges the four open PRs (#55 with #56, #57, #58) into main with unioned shared indexes; validators, unit tests, CI, an Opus evidence review and a bounded Codex cross-family review passed on the branch. Co-Authored-By: Claude Fable 5.1 <[email protected]>
seathatflowsinourveins
deleted the
claude/repository-evidence-v2-20260921
branch
September 25, 2026 18:47
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this adds
A second live-Claude evidence publication that covers every selected catalog component, beside the 38-row report from PR 53 (unchanged).
docs/ecosystem/claude-repository-evidence.html: one card per repository with its upstream commands, returned results, declared assertions, reviewed dashboard screenshots, lifetime figures and selection-evidence chain, plus the GPT-6 and research convergence and the method. Guide:docs/claude-repository-evidence.md.evidence/artifacts/claude-repository-evidence-20260921/: sanitizedresults.json, compactsummary.json,provenance.json(names, sizes and hashes of all 266 privately retained streams; all 115 current stdout hashes match one) and 14 reviewed public screenshots.evidence/receipts/claude-repository-evidence-20260921.json, registered for 58 components. Only a small declared subset of artifacts is embedded into the explorer; the rest are hash-listed.tests/test_claude_repository_evidence.py: ten invariants enforced by the requiredvalidatejob, including one that recomputes the narrative counts in the guide, the explorer entry and the receipt claim (five negative controls were caught locally).70 rows: 47 functional (a functional-class command exited 0 and its declared assertion passed), 10 readiness, 3 version/help, 10 without local execution evidence. A check that does not invoke its component is labelled a local integration check and never counts toward a row. Exit 0 alone is never counted as functional. One command is retained as failing (
dagu validate). Lifetime figures are each tool's own non-additive estimate: no combined figure, no provider-token savings. No row claims universal superiority; only three rows have a local measurement.GitHub workflow review (2026-09-21)
regularpersona used by CIChanges are comments only: exact release comments (
# v7.0.1) innative-service-reboot.ymlandnative-foundation-e2e.yml, and explanatory comments on the publication job's two write permissions (resolves zizmor'sundocumented-permissions). The same comment edit was reverted in three workflows whose bytes are hash-bound:native-offhost-restore.ymlandnative-offhost-app-state.ymlare frozen sources of active recovery plans (the repository's tests failed), andnative-token-e2e.yml's SHA-256 is recorded in four execution receipts. Six such comments wait for the next functional change. Stricter-persona findings (secrets-outside-env,concurrency-limits,anonymous-definition) are retained with reasons indocs/github-automation-evidence.json.Review before publication
Source reviewed three ways in agent-lab (saved review workflow, native Codex review, three-reviewer Opus content audit: 30 findings, all supported ones fixed). This branch was then reviewed before any push by a native Codex review and two Opus evidence reviewers. Codex found that two functional rows (LEAN, alpaca-py) counted checks that never invoke the component: LEAN is now a readiness row and alpaca-py rests on a real offline SDK call, which moved functional from 48 to 47. The privacy reviewer opened all 14 screenshots and scanned every new text file: nothing private. Local CI-equivalent sequence passes: zizmor, actionlint, five validators, explorer rebuild check, 760 unit tests.
Overlap: PR 55 touches seven of the same registration and generated files (
docs/ecosystem/index.html,manifests/evidence.json,manifests/stack.jsonand others). Both branches append to the same JSON arrays, so this one should land second. A structural re-apply script was proven on a fresh checkout ofmain: it reproduces this branch's file records exactly and the same explorer build hash, and the validators pass. Once PR 55 lands, this branch is regenerated with that script rather than hand-merged. The projection passes the repository's private-content patterns, a leak gate (paths, login, host name, e-mail) and gitleaks.This is dated source-host evidence: not an installation certificate for another PC, not a lifecycle acceptance, not a measurement of provider usage.
🤖 Generated with Claude Code