Expected activation failures
No real owner
Example CODEOWNERS entries must be replaced with valid people or teams who are accountable for control-plane changes.
No detected stack
A generic starter cannot infer build, coverage, mutation, or release behavior until it is applied to an actual project.
No project fuzz harness
The full profile requires a real target and useful assertions—not a placeholder command that exits successfully.
No independent verifier
Candidate-produced evidence is diagnostic until a separately administered producer verifies the exact subject and scope.
The rule
missing | stale | malformed | skipped | inconclusive => not_evaluated not_evaluated + required_control => denyHow green is earned
- Bind every adapter to real project commands and machine-readable reports.
- Prove negative controls: a survivor, missing tool, stale report, and policy drift must fail.
- Move the authoritative judge outside the candidate’s write boundary.
- Require the resulting check identities in a protected GitHub ruleset.
- Re-run against the final revision and promote the same artifact by digest.