Relationships
#4015 extension quality: a collective-attested private repository scores provisional, and --json omits ifProvisionalEarned
Opened by skunk-ape · 10/27/2026
Two gaps left by swamp-club#3845 (swamp 7011f4ea), now that the CLI percentage divides by the full rubric maximum.
A collective-attested private repository should be earned, not provisional. In packages/extension-scoring/rubric/score.ts, repositoryVerifiedRow returns status provisional, 0/2, for predicted evidence whose privateSource.kind is attested. The registry awards those 2 points on the attestation alone, with no outside check, and the CLI already holds that answer (quality resolves it through resolvePrivateSourceStanding). Since #3845 that caution costs a private extension on a private-source-hosting collective 13 points: 14/16 = 87% (B) locally, though the registry will score it 16/16 = 100% (A). Fix: in the predicted branch, attested returns earned, 2/2, label Private repository (collective attested). The registry scores the confirmed branch only, so no registry score moves and RUBRIC_VERSION stays 5. The two attested cases in vectors/rubric.json move from 87 back to 100. The public-repository case stays provisional, since only the registry calls the host API.
extension quality --json should emit ifProvisionalEarned. scoreExtensionRubric computes ifProvisionalEarned as an object with percentage and grade (null when nothing is pending), and the text rubric line prints it, but the JSON output drops it. Expected: --json carries ifProvisionalEarned right after grade, an object with percentage (number) and grade (string), or null when provisionalPoints is 0.
Observed on stable 20261027.084341.0-sha.5cd17869 with a public-repository extension: the text line reads 14/16 points (87%, grade B, +2 pending server verification: 100% (A) if the registry verifies them, all factors earned), and --json has percentage 87 and grade B but no ifProvisionalEarned.
The manual update in swamp-club#3989 documents both as the target behavior.
Open
No activity in this phase yet.
skunk-ape commented 10/27/2026, 3:33:06 PM
Third gap for this issue, an output quirk from the rubric v5 factor order.
In src/presentation/renderers/extension_quality.ts, the completed handler prints the dependency-trust detail block (each audited dependency, or "No npm/jsr dependencies to audit", then trust errors and not-audited warnings) after the whole score.factors loop. That block used to land under dependency-trust because dependency-trust was the last factor. In the package order it is now the sixth row, so the detail prints under repository-verified instead.
Observed on stable 20261027.084341.0-sha.5cd17869:
"✓" "dependency-trust" ["2/2"] — "Dependencies pass trust audit" "✓" "secret-safe-docs" ["1/1"] — "Docs keep secrets in a vault" ... description, platforms, has-license, license-file ... "~" "repository-verified" ["0/2"] — "Verified public repository" No npm/jsr dependencies to audit
Expected: the dependency detail prints directly under the dependency-trust row, whatever its position in score.factors.
The swamp-club#3989 manual samples show the current output, so they will need regenerating once this ships.
Sign in to post a ripple.