Expand description
Readiness scoring over the normalized contract + detected facts (ADR-0001 §3).
audit is a read-only function of (repo tree, contract, facts) that
produces a gap-report: the gated core (README + LICENSE + CI, tier-scaled
so a spike is gated on README + LICENSE alone), the tier-scaled canon
(recommended artifacts scaled to the contract’s maturity), the
producer-existence obligations the contract declared (a fragment
changelog needs its dir, a coverage/scorecard badge needs its CI
producer, a registry target needs an SPDX license), and the GitHub
community standards (gh api …/community/profile). Feeds ossctl audit
and the /oss-readiness skill.
Read-only, always. Every probe goes through the Fs and
CommandRunner ports; nothing here writes the repo. The git remote and
gh api calls are read-only. A registry/GitHub lookup that fails yields
Presence::Unknown, never Presence::Absent — an outage is never read
as “the artifact is missing” (issue: registry/GH-API failure ⇒ unknown,
never false).
The engine takes the already-normalized Contract and detected Facts
by reference — it never re-parses OSS-RELEASE.md nor re-derives facts. The
ossctl-cli handler runs contract::normalize and facts::gather (the same
code paths behind contract show and facts) and hands their results here,
so the audit, /oss-init, and every other member agree on maturity and the
gated core down to the byte (ADR-0001 §3).
Functions§
- audit
- Score the repo at
repo_rootagainst itscontractand detectedfacts.