ShipItWorks

Claims and sources

The factual sentences on this site, each with the file it was taken from.

Line numbers point into our own working files, which are not public. The point of this table is that each claim has one named source, and that we can be held to it.

Claim to source
PageClaim on the siteSource file and line
/A helper that does tasks, asks before saving anything, and stops at the spending cap you set.scorecards/yield.json:128
/Eleven products. Each scored 0 to 100 on our own published rubric, with what is not finished listed on every page.site/products.json:3
/Turns the CISA KEV catalog into vulnerability notices routed to the owner of an affected item. Built; seven of eight features proven on a sample inventory, one tested with sample data; relevance is not measured and it has not been tried on an organization's own inventory.scorecards/patchowner.json:95
/patchowner score 84scorecards/patchowner.json:80
/patchowner: 10 not finishedscorecards/patchowner.json:83
/patchowner demo video, 2:32site/videos.json:88
/A design-time environment for graph-based AI and automation workflows.scorecards/graphsmith.json:62
/Graphsmith score 82scorecards/graphsmith.json:49
/Graphsmith: 9 not finishedscorecards/graphsmith.json:51
/Graphsmith demo video, 2:10site/videos.json:41
/Plain-language help with your rights when AI makes decisions about you.scorecards/aiconsumerrights.org.json:113
/AI Consumer Rights score 78scorecards/aiconsumerrights.org.json:91
/AI Consumer Rights: 8 not finishedscorecards/aiconsumerrights.org.json:103
/AI Consumer Rights demo video, 1:58site/videos.json:4
/Yield score 70scorecards/yield.json:110
/Yield: 13 not finishedscorecards/yield.json:113
/Yield demo video, 3:45site/videos.json:154
/Model AI ROI, P&L margins, Balance Sheet cash flow & 30-day adoption pilots.scorecards/aivalue.json:80
/AI Value score 68scorecards/aivalue.json:61
/AI Value: 5 not finishedscorecards/aivalue.json:73
/AI Value demo video, 3:08site/videos.json:16
/You type what you want; it rewrites a prompt an AI understands, then explains changes.scorecards/plainspoken.json:84
/Plainspoken score 67scorecards/plainspoken.json:73
/Plainspoken: 7 not finishedscorecards/plainspoken.json:75
/Plainspoken demo video, 1:40site/videos.json:106
/Audit home Wi-Fi security, discover smart devices, harden your connected home.scorecards/HomeIoTGuardian.json:81
/HomeIoT Guardian score 66scorecards/HomeIoTGuardian.json:68
/HomeIoT Guardian: 8 not finishedscorecards/HomeIoTGuardian.json:71
/HomeIoT Guardian demo video, 2:55site/videos.json:70
/Unified RMM and PSA platform for managed service providers, one multi-tenant schemascorecards/rmm-psa-platform.json:119
/Helmline score 65scorecards/rmm-psa-platform.json:105
/Helmline: 9 not finishedscorecards/rmm-psa-platform.json:108
/Helmline demo video, 3:39site/videos.json:58
/Offline-first scam-safety app built around Prevent, Protect, Recover; built so analysis runs on the device (offline use not yet tested).scorecards/scamshield-companion.json:87
/ScamShield Companion score 65scorecards/scamshield-companion.json:74
/ScamShield Companion: 8 not finishedscorecards/scamshield-companion.json:77
/ScamShield Companion demo video, 2:54site/videos.json:136
/Give your AI coding assistant a map of your code.scorecards/graph-app.json:85
/graph-app score 64scorecards/graph-app.json:67
/graph-app: 9 not finishedscorecards/graph-app.json:74
/graph-app demo video, 1:50site/videos.json:29
/Find out how hackable you are. The scan runs in your browser; what leaves the device is not yet traced (the password check sends a 5-character hash prefix to Have I Been Pwned).scorecards/pocketsec.json:87
/PocketSec score 56scorecards/pocketsec.json:73
/PocketSec: 10 not finishedscorecards/pocketsec.json:75
/PocketSec demo video, 1:56site/videos.json:118
/All eleven products, highest score first, on the same 0 to 100 rubricPLAN.md:94
/yield/transcript/Screen recording of Yield, 3:45, file dated 2026-11-08. The voice is AI-generated (ElevenLabs) and the data on screen is made upsite/videos.json:154
/yield/transcript/Recorded 2026-11-08. This video shows one journey: a real run on Claude, the Needs-you approval clicked by the recording script (as its caption says), the spending cap, and the length-limit warning on a staged reply from a stand-in model (as its caption says). It does not show every page; the full-product video is in production. The scorecard in the video reads 76; the site shows 70/100 on our own rubric (2026-11-08).scorecards/yield.json:112
/yield/transcript/Re-recorded 2026-11-08 against agentorchestration-autonomous-aigov-platform main dfaae6c; caption at 1:04-1:17 now reads $0.25, $1.00 or $5.00; added the Needs-you length-limit warning (#9), shown on a staged reply from a stand-in model; the card text and date are updated. Encoded CRF 16, -16.3 LUFS.videos/rerecord-2026-11-08/evidence-yield.md:5
/Recorded 2026-11-08. This video shows one journey: a real run on Claude, the Needs-you approval clicked by the recording script (as its caption says), the spending cap, and the length-limit warning on a staged reply from a stand-in model (as its caption says). It does not show every page; the full-product video is in production. The scorecard in the video reads 76; the site shows 70/100 on our own rubric (2026-11-08).scorecards/yield.json:112
/Re-recorded 2026-11-08 against agentorchestration-autonomous-aigov-platform main dfaae6c; caption at 1:04-1:17 now reads $0.25, $1.00 or $5.00; added the Needs-you length-limit warning (#9), shown on a staged reply from a stand-in model; the card text and date are updated. Encoded CRF 16, -16.3 LUFS.videos/rerecord-2026-11-08/evidence-yield.md:5
/Scored 2026-11-08scorecards/yield.json:130
/Primary journey: shown with sample datascorecards/yield.json:7
/Yield: Google Play: No Android appscorecards/yield.json:112
/Helmline: Google Play: No Android appscorecards/rmm-psa-platform.json:107
/patchowner: Google Play: No Android appscorecards/patchowner.json:82
/Primary journey: not shownscorecards/aiconsumerrights.org.json:6
/AI Consumer Rights: Google Play: Not on Playscorecards/aiconsumerrights.org.json:89
/HomeIoT Guardian: Google Play: Not on Playscorecards/HomeIoTGuardian.json:66
/ScamShield Companion: Google Play: Not on Playscorecards/scamshield-companion.json:72
/AI Value: Google Play: Not on Playscorecards/aivalue.json:59
/PocketSec: Google Play: No Android appscorecards/pocketsec.json:74
/Plainspoken: Google Play: Web onlyscorecards/plainspoken.json:74
/graph-app: Google Play: No Android appscorecards/graph-app.json:69
/Graphsmith: Google Play: Web onlyscorecards/graphsmith.json:50
/yield/Paperclip: Approval stages (README)research/yield-competitors.md:7
/yield/Paperclip: Budgets that pause at limits (README)research/yield-competitors.md:7
/yield/Paperclip: 109.6kresearch/yield-competitors.md:7
/yield/Omnigent: Policies ask before shell or file writes (README)research/yield-competitors.md:8
/yield/Omnigent: Can cap spend (README)research/yield-competitors.md:8
/yield/Omnigent: 11.1kresearch/yield-competitors.md:8
/yield/AnythingLLM: Not mentioned on its READMEresearch/yield-competitors.md:11
/yield/AnythingLLM: 67.8kresearch/yield-competitors.md:11
/yield/Approval bound to exact bytes, hard + soft spend cap, tamper-evident recordscorecards/yield.json:14
/yield/0.5.0scorecards/yield.json:5
/yield/A helper that does tasks, asks before saving anything, and stops at the spending cap you set.scorecards/yield.json:128
/yield/Score 70 of 100scorecards/yield.json:110
/yield/Stage: Beta on our own rubricscorecards/yield.json:112
/yield/Scored 2026-11-08scorecards/yield.json:130
/yield/commit dfaae6cscorecards/yield.json:3
/yield/Google Play: No Android appscorecards/yield.json:112
/yield/Primary journey: shown with sample datascorecards/yield.json:7
/yield/Recorded 2026-11-08. This video shows one journey: a real run on Claude, the Needs-you approval clicked by the recording script (as its caption says), the spending cap, and the length-limit warning on a staged reply from a stand-in model (as its caption says). It does not show every page; the full-product video is in production. The scorecard in the video reads 76; the site shows 70/100 on our own rubric (2026-11-08).scorecards/yield.json:112
/yield/Re-recorded 2026-11-08 against agentorchestration-autonomous-aigov-platform main dfaae6c; caption at 1:04-1:17 now reads $0.25, $1.00 or $5.00; added the Needs-you length-limit warning (#9), shown on a staged reply from a stand-in model; the card text and date are updated. Encoded CRF 16, -16.3 LUFS.videos/rerecord-2026-11-08/evidence-yield.md:5
/yield/32 jobs in six kinds, practice helper (mock) onlyscorecards/yield.json:20
/yield/Connect a real AI with encrypted key: Anthropic re-run by the reviewer; OpenAI, OpenRouter, HF, Ollama and xAI recorded by the builderscorecards/yield.json:26
/yield/MCP server (tools by key type, start task, approval refused)scorecards/yield.json:32
/yield/Results page (cost, hours freed from user-entered baselines, CSV)scorecards/yield.json:8
/yield/Helpers per AI: state (working/waiting/stalled/idle), job props, 4 monitor scenes (code, bird, space, maze)scorecards/yield.json:44
/yield/Click-to-choose a helper + 5-second 'on stage' previewscorecards/yield.json:50
/yield/Done celebrationscorecards/yield.json:56
/yield/.deb installerscorecards/yield.json:74
/yield/Results by P&L line, with a worked calculation for every money number (Lane 1b)scorecards/yield.json:80
/yield/Warn on the approval screen when the AI's answer was cut off at its length limit; strip a whole-answer code fence from CSV/JSON/text before the fingerprintscorecards/yield.json:86
/yield/Real runs for five of the six services were recorded by the builder, not independently verified; the sixth (Anthropic) was re-run on 2026-11-03 by the Claude session that reviewed this project, approved by a person in the app, final status done, cost $0.003969.scorecards/yield.json:114
/yield/The stage walkthrough was filmed with the states held in turn by the demo harness, not during one live run; no playable gamescorecards/yield.json:115
/yield/native/ is a stub; no independent security audit has passedscorecards/yield.json:117
/yield/xAI us-central-1 is priced about 10 percent above the table; the on-screen workings use today's price, not the price at the time of the step (proof/proof-pack.json:401)scorecards/yield.json:118
/yield/gitleaks flags a fake key joined from parts in e2e/d1-adversarial.spec.ts:14 (a false positive); the allowlist is not yet extended (proof/proof-pack.json:61)scorecards/yield.json:119
/yield/Feature 13 (the cut-off warning and fence stripping) is on main (4108613) with a logged run on a stand-in AI; it has not been seen with a real AI answer. Opus and Fable were not tested against the thinking change; Sonnet 5.5 rejects thinking:disabled (HTTP 400), which is why it is sent to Haiku 5.x only. Commits 48be421 and 3547323 are not on main under those hashes (not verified whether squashed into 4108613).scorecards/yield.json:120
/yield/A task refused by the hard cap shows 'price not known' and is counted as an unpriced step on Results, although no call was made (seen on camera 2026-11-03). The wording is wrong; not fixed.scorecards/yield.json:121
/yield/The before/after ROI runs (videos/yield/roi/RESULTS.md) stop at the approval step: no manual-vs-agent comparison exists and approval time was not measured. One Sonnet reply in 18 after-fix runs still reached its 1,024-token limit (flagged on the approval).scorecards/yield.json:122
/yield/The v5 video (published 2026-11-05) shows one journey: a real run on Claude, the Needs-you approval clicked by the recording script (captioned on screen; not evidence of a person approving) and the spending cap. It does not show every page; the full-product video (v6, BACKLOG.md item 2) is not recorded yet.scorecards/yield.json:123
/yield/The demo video's 1:04 to 1:17 section shows spend choices of $0.25, $1 and $4; the app now offers $0.25, $1.00 and $5.00 (CHANGELOG.md on main, 4108613). Needs a re-record.scorecards/yield.json:124
/yield/Hosted CI on main: runs for 4108613 and d55a2e1 succeeded (gh run list, 2026-11-08); the run for dfaae6c was queued when checked, so CI on the current HEAD is not verified.scorecards/yield.json:125
/yield/Work in lane rounds 8 to 12 (native Linux window, money amounts on Needs you, why a task stopped, What it saved, Download this record and more; PRs #75 to #121) is on open branches, not merged to main, and is not counted in this score.scorecards/yield.json:126
/yield/2026-11-08: Re-scored 70/100 on our own rubric (was 76 on the old held rule). The 25 feature points are split over 13 features: one proven by a logged test run (the cut-off warning, PR #9, checked with a stand-in AI, not a real AI answer), ten built and tested with sample data, two not built or not tested yet. Tagged v0.4.0 at main dfaae6c.scorecards/yield.json:169
/yield/2026-11-08: Hosted CI now runs on the owner's self-hosted runner (PR #123). The README matches the recorded real runs (PR #10, release v0.3.0); notes-only pull requests #24 and #33 changed no code.scorecards/yield.json:170
/yield/2026-11-07: The Needs you card now warns when the AI's answer stopped at its length limit, and a CSV, JSON or text answer is saved without the code fence around it. Tested with a stand-in AI, not with a real AI answer. Release v0.3.0.scorecards/yield.json:171
/yield/2026-11-07: The README now matches the recorded real AI runs (release v0.3.0). The demo video's 1:04 to 1:17 section shows the older behaviour and has not been re-recorded.scorecards/yield.json:172
/helmline/Each line carries a proof label: proven (run against the real thing), built (code and tests, not run against the real thing) or not built.docs/helmline-build-notes.md:46
/helmline/Proven lines come from runs recorded on 2026-11-03 against a real Postgres 16 and the real API; demo agents posted the device data, so the data is sample data.docs/helmline-build-notes.md:47
/helmline/65 / 100 · Beta on our own rubric · 9 not finished in Helmlinedocs/helmline-build-notes.md:46
/helmline/Proof, by scorecard line: zero proven, 15 built, two not built, which names six features.docs/helmline-build-notes.md:47
/helmline/65 / 100docs/helmline-build-notes.md:168
/helmline/Scored 2026-11-08 on our own rubric; repository at commit dd7cf78.docs/helmline-build-notes.md:169
/helmline/17 scorecard lines, eight listed under Works today and nine under Not finished, by proof level: zero proven, 15 built, two not built.docs/helmline-build-notes.md:170
/helmline/(0)docs/helmline-build-notes.md:171
/helmline/(15)docs/helmline-build-notes.md:172
/helmline/(2)docs/helmline-build-notes.md:173
/helmline/2026-11-08: Tags v0.3.2 (836e078) and v0.3.3 (dd7cf78) cut; the only change after 836e078 is a FOUND.md notes update (PR 32).docs/helmline-build-notes.md:174
/helmline/No new run log, PRIVACY.md or LICENSE on the default branch; CI install job still failing at v0.3.3.docs/helmline-build-notes.md:175
/helmline/Score unchanged at 65/100 on our own rubric.docs/helmline-build-notes.md:176
/helmline/2026-11-08: Rescored against the default branch only (rule D32).docs/helmline-build-notes.md:177
/helmline/Three features whose run logs are on an unmerged branch (browser console, AI features, and the Linux install, which has no log on main) are not counted; no feature is labelled Proven because no log on main prints an exit code.docs/helmline-build-notes.md:178
/helmline/CI on main failed on the latest commit at that time (install job; cause not verified). 65/100 on our own rubric, was 78/100.docs/helmline-build-notes.md:179
/helmline/Latest tag is v0.3.3 on the default branch HEAD.docs/helmline-build-notes.md:180
/helmline/2026-11-08: CI moved to the self-hosted runner (PR 29, commit 836e078).docs/helmline-build-notes.md:181
/helmline/The test job passed there; the install job failed on that commit.docs/helmline-build-notes.md:182
/helmline/2026-11-08: Run logs merged for the agent sandbox score (PR 8), the unsigned-script refusal (PR 9), reproducible linux-x64 archives (PR 11), the virus-scan fail-closed test (PR 13) and a real ClamAV EICAR run (PR 14), plus a CHANGELOG (PR 6) and a billed-once concurrency test (PRs 3 and 4).docs/helmline-build-notes.md:183
/helmline/Tag v0.3.1 (49f2dfa).docs/helmline-build-notes.md:184
/helmline/No feature is proven yet; the eight that run were tested with sample data.docs/helmline-build-notes.md:152
/helmline/For managed service providersscorecards/rmm-psa-platform.json:119
/helmline/Helmline is a codename. It is one app for managed service providers: device alerts, tickets, time and invoices in one place.docs/helmline-build-notes.md:19
/helmline/Unified RMM and PSA platform for managed service providers, one multi-tenant schemascorecards/rmm-psa-platform.json:119
/helmline/Helmline score 65scorecards/rmm-psa-platform.json:105
/helmline/Helmline: 9 not finishedscorecards/rmm-psa-platform.json:108
/helmline/Score 65 of 100scorecards/rmm-psa-platform.json:105
/helmline/Stage: Beta on our own rubricscorecards/rmm-psa-platform.json:107
/helmline/Scored 2026-11-08scorecards/rmm-psa-platform.json:125
/helmline/commit dd7cf78scorecards/rmm-psa-platform.json:4
/helmline/Google Play: No Android appscorecards/rmm-psa-platform.json:107
/helmline/Primary journey: shown with sample datascorecards/rmm-psa-platform.json:8
/helmline/transcript/Screen recording of Helmline, 3:39, file dated 2026-11-05. The voice is AI-generated (ElevenLabs) and the data on screen is made upsite/videos.json:58
/helmline/transcript/Audio loudness adjusted on 2026-11-05. Re-encoded on 2026-11-05 for faster seeking. Wording and picture content unchanged.docs/video-quality-2026-11-05.md:185
/helmline/Audio loudness adjusted on 2026-11-05. Re-encoded on 2026-11-05 for faster seeking. Wording and picture content unchanged.docs/video-quality-2026-11-05.md:185
/helmline/A sustained threshold breach on a device opens one alert and, optionally, one ticket on that device.docs/helmline-build-notes.md:30
/helmline/Tickets also arrive by email (email-to-ticket with quarantine) and from a customer portal, where contacts sign in with an emailed single-use link.docs/helmline-build-notes.md:31
/helmline/Each ticket's priority and SLA clock come from the alert severity and the customer's SLA policy; in the recorded run the first staff reply met the response target.docs/helmline-build-notes.md:32
/helmline/A breached SLA state is covered by unit tests only.docs/helmline-build-notes.md:33
/helmline/Business-hours SLA calendars.docs/helmline-build-notes.md:34
/helmline/Time logged on a ticket becomes invoice lines.docs/helmline-build-notes.md:35
/helmline/Every invoice line names the devices or time entries it came from, and a second invoice does not bill time that was already billed.docs/helmline-build-notes.md:36
/helmline/Payment collection.docs/helmline-build-notes.md:37
/helmline/Summarize a ticket and draft a reply, or draft a fix script; both are off by default and need a person's click.docs/helmline-build-notes.md:38
/helmline/When an admin turns it on, ticket text goes from the Helmline server to Anthropic's Claude through a Supabase Edge Function, which holds the Anthropic API key.docs/helmline-build-notes.md:39
/helmline/Spend is capped at 5 USD per organisation per month by default, a hard stop; the refusal at the cap has not run against the real database.docs/helmline-build-notes.md:40
/helmline/One multi-tenant Postgres schema links endpoint telemetry to alerts, tickets, SLAs, time tracking and billing.docs/helmline-build-notes.md:53
/helmline/Every table has a tenant_id column with a forced row-level security policy, and requests run as the restricted role helmline_app with the tenant set, so a query missing its WHERE clause is still limited to its tenant (covered by the database and HTTP tests).docs/helmline-build-notes.md:54
/helmline/Limit: this protects against missing filters and privilege escalation, not against injected SQL; every query is parameterised.docs/helmline-build-notes.md:55
/helmline/Sign-in and data are Helmline's own Postgres, not Supabase Auth: scrypt-hashed passwords, signed session tokens with expiry, a login throttle per email, and two roles, admin and technician.docs/helmline-build-notes.md:56
/helmline/SSO and MFA.docs/helmline-build-notes.md:57
/helmline/Linux: one-line install as a sandboxed service; CI builds the Docker image and installs the agent as a customer would; the agent is exercised in CI and with demo agents only.docs/helmline-build-notes.md:58
/helmline/macOS and Windows: packages built and structurally checked only, never run on real machines.docs/helmline-build-notes.md:59
/helmline/The agent runs as an unprivileged account and sends telemetry only by default; it runs scripts only when started with scripts enabled, and only scripts signed by a key the server does not hold.docs/helmline-build-notes.md:60
/helmline/Self-hosted on one machine you control, with Docker or Podman Compose: Postgres, a one-shot migrate step, and the app (API and console in one), plus an HTTPS proxy when installed with a domain.docs/helmline-build-notes.md:61
/helmline/The database is not published to the network, and the app does tenant work as helmline_app, a role without the right to bypass row-level security.docs/helmline-build-notes.md:62
/helmline/Limit: one machine with no high availability; backing up the database, the attachments volume and the secrets file is the operator's job.docs/helmline-build-notes.md:63
/helmline/Optional: a ClamAV container scans attachments, and an upload is refused when the scanner cannot be reached.docs/helmline-build-notes.md:64
/helmline/Browsersdocs/helmline-build-notes.md:72
/helmline/staff console, customer portaldocs/helmline-build-notes.md:73
/helmline/Endpoint agentsdocs/helmline-build-notes.md:74
/helmline/Linux: built, run in CIdocs/helmline-build-notes.md:75
/helmline/macOS, Windows: built, not rundocs/helmline-build-notes.md:76
/helmline/telemetry, script resultsdocs/helmline-build-notes.md:77
/helmline/Your server: one machinedocs/helmline-build-notes.md:78
/helmline/Docker or Podman Composedocs/helmline-build-notes.md:79
/helmline/HTTPS proxy (with a domain)docs/helmline-build-notes.md:80
/helmline/App: API and consoledocs/helmline-build-notes.md:81
/helmline/Postgresdocs/helmline-build-notes.md:82
/helmline/one schema, forced RLSdocs/helmline-build-notes.md:83
/helmline/migrate (one-shot)docs/helmline-build-notes.md:84
/helmline/ClamAV (optional)docs/helmline-build-notes.md:85
/helmline/Mail serverdocs/helmline-build-notes.md:86
/helmline/email in, SMTP outdocs/helmline-build-notes.md:87
/helmline/AI assist, off by defaultdocs/helmline-build-notes.md:88
/helmline/Supabase Edge Functiondocs/helmline-build-notes.md:89
/helmline/Anthropic API (Claude)docs/helmline-build-notes.md:90
/helmline/How Helmline is deployed: endpoint agents and browsers reach one self-hosted server running the app and Postgres; mail and the optional AI assist sit outside it.docs/helmline-build-notes.md:91
/helmline/Boxes from the Helmline README (Layout, Install, Adding machines, Virus scanning) and docs/AI.md at commit d57c9dd.docs/helmline-build-notes.md:92
/helmline/Proof label: Built: Unified RMM+PSA: device -> alert -> ticket with SLA clock -> time -> invoice linesdocs/helmline-build-notes.md:100
/helmline/Unified RMM+PSA: device -> alert -> ticket with SLA clock -> time -> invoice linesscorecards/rmm-psa-platform.json:9
/helmline/Proof label: Built: Multi-tenant isolation (forced RLS)docs/helmline-build-notes.md:101
/helmline/Multi-tenant isolation (forced RLS)scorecards/rmm-psa-platform.json:21
/helmline/Proof label: Built: Remote scripts: offline-key signing, agent verifies, containmentdocs/helmline-build-notes.md:102
/helmline/Remote scripts: offline-key signing, agent verifies, containmentscorecards/rmm-psa-platform.json:27
/helmline/Proof label: Built: Per-run approval (tier 1 console, tier 2 offline key)docs/helmline-build-notes.md:103
/helmline/Per-run approval (tier 1 console, tier 2 offline key)scorecards/rmm-psa-platform.json:33
/helmline/Proof label: Built: Hash-chained audit log, receipts, off-server anchorsdocs/helmline-build-notes.md:104
/helmline/Hash-chained audit log, receipts, off-server anchorsscorecards/rmm-psa-platform.json:39
/helmline/Proof label: Built: Customer portal (emailed single-use link), outgoing maildocs/helmline-build-notes.md:105
/helmline/Customer portal (emailed single-use link), outgoing mailscorecards/rmm-psa-platform.json:45
/helmline/Proof label: Built: Email-to-ticket with quarantinedocs/helmline-build-notes.md:106
/helmline/Email-to-ticket with quarantinescorecards/rmm-psa-platform.json:51
/helmline/Proof label: Built: Attachments + optional ClamAV fail-closeddocs/helmline-build-notes.md:107
/helmline/Attachments + optional ClamAV fail-closedscorecards/rmm-psa-platform.json:57
/helmline/Proof label: Built: The web console in a browser, the alert-to-invoice run on a real database and the AI features have run logs only on an unmerged branch, not on maindocs/helmline-build-notes.md:108
/helmline/The web console in a browser, the alert-to-invoice run on a real database and the AI features have run logs only on an unmerged branch, not on mainscorecards/rmm-psa-platform.json:109
/helmline/Proof label: Built: macOS and Windows agents not run on real machines; the Linux install has no run log on main, and the CI install job failed on the last two main commits (cause not verified)docs/helmline-build-notes.md:109
/helmline/macOS and Windows agents not run on real machines; the Linux install has no run log on main, and the CI install job failed on the last two main commits (cause not verified)scorecards/rmm-psa-platform.json:110
/helmline/Proof label: Built: CI on main is red at dd7cf78 and 836e078 (install job, no failing step listed); the test job passed on both on the self-hosted runnerdocs/helmline-build-notes.md:110
/helmline/CI on main is red at dd7cf78 and 836e078 (install job, no failing step listed); the test job passed on both on the self-hosted runnerscorecards/rmm-psa-platform.json:111
/helmline/Proof label: Built: Virus scanning: the fake-scanner and real-ClamAV logs print no exit code line; not run through deploy/install.sh --scan, the compose network or the HTTP upload routedocs/helmline-build-notes.md:111
/helmline/Virus scanning: the fake-scanner and real-ClamAV logs print no exit code line; not run through deploy/install.sh --scan, the compose network or the HTTP upload routescorecards/rmm-psa-platform.json:112
/helmline/Proof label: Built: The suite figure of 611 passing is from the unmerged branch; tests were not run on main for this rescoredocs/helmline-build-notes.md:112
/helmline/The suite figure of 611 passing is from the unmerged branch; tests were not run on main for this rescorescorecards/rmm-psa-platform.json:113
/helmline/Proof label: Not built: PRIVACY.md and LICENSE are not on the default branchdocs/helmline-build-notes.md:113
/helmline/PRIVACY.md and LICENSE are not on the default branchscorecards/rmm-psa-platform.json:114
/helmline/Proof label: Built: A breached SLA state is covered by unit tests only; the AI feature's monthly-cap refusal has not run against the real databasedocs/helmline-build-notes.md:114
/helmline/A breached SLA state is covered by unit tests only; the AI feature's monthly-cap refusal has not run against the real databasescorecards/rmm-psa-platform.json:115
/helmline/Proof label: Not built: Not built: patching, software inventory, interactive remote shell, SSO and MFA, payment collection, business-hours SLA calendars (README Known limits)docs/helmline-build-notes.md:115
/helmline/Not built: patching, software inventory, interactive remote shell, SSO and MFA, payment collection, business-hours SLA calendars (README Known limits)scorecards/rmm-psa-platform.json:116
/helmline/Proof label: Built: Auth and data are Helmline's own Postgres, not Supabase Auth as PLAN section 7 assumesdocs/helmline-build-notes.md:116
/helmline/Auth and data are Helmline's own Postgres, not Supabase Auth as PLAN section 7 assumesscorecards/rmm-psa-platform.json:117
/helmline/2026-11-08: Tags v0.3.2 (836e078) and v0.3.3 (dd7cf78) cut; the only change after 836e078 is a FOUND.md notes update (PR 32). No new run log, PRIVACY.md or LICENSE on the default branch; CI install job still failing at v0.3.3. Score unchanged at 65/100 on our own rubric.scorecards/rmm-psa-platform.json:222
/helmline/2026-11-08: Rescored against the default branch only (rule D32). Three features whose run logs are on an unmerged branch (browser console, AI features, and the Linux install, which has no log on main) are not counted; no feature is labelled Proven because no log on main prints an exit code. CI on main failed on the latest commit at that time (install job; cause not verified). 65/100 on our own rubric, was 78/100. Latest tag is v0.3.3 on the default branch HEAD.scorecards/rmm-psa-platform.json:223
/helmline/2026-11-08: CI moved to the self-hosted runner (PR 29, commit 836e078). The test job passed there; the install job failed on that commit.scorecards/rmm-psa-platform.json:224
/helmline/2026-11-08: Run logs merged for the agent sandbox score (PR 8), the unsigned-script refusal (PR 9), reproducible linux-x64 archives (PR 11), the virus-scan fail-closed test (PR 13) and a real ClamAV EICAR run (PR 14), plus a CHANGELOG (PR 6) and a billed-once concurrency test (PRs 3 and 4). Tag v0.3.1 (49f2dfa).scorecards/rmm-psa-platform.json:225
/helmline/2026-11-07: A CHANGELOG was added, and the private repo gained run logs for: the Linux agent's systemd sandbox score of 1.9 OK (a score computed from the generated unit text, not a run on a real host); scripts that are unsigned, signed with the wrong key, expired or tampered being refused (unit tests, not the installed service); and package archives being byte-identical across two builds (linux-x64 only; the other four targets were not built).scorecards/rmm-psa-platform.json:226
/helmline/2026-11-07: Virus scanning: a file that cannot be checked is refused and nothing is stored (tested against a fake scanner). A real ClamAV container detects the EICAR test file, and with the scanner stopped the same client refuses the file (local container, not the install path). Release v0.3.1.scorecards/rmm-psa-platform.json:227
/helmline/Agent platforms (Windows, macOS, Linux, mobile): Helmline: [proven in CI] Linux agent, one-command install. [built] macOS and Windows packages, never run on a real machine. [not built] mobile agent.research/helmline-comparison.md:7
/helmline/Agent platforms (Windows, macOS, Linux, mobile): Atera: Agent: Windows, Mac, Linux. Mobile app: iOS, Android.research/helmline-comparison.md:7
/helmline/Agent platforms (Windows, macOS, Linux, mobile): NinjaOne: Windows, Mac, Linux devices. Android and Apple mobile device management.research/helmline-comparison.md:7
/helmline/Agent platforms (Windows, macOS, Linux, mobile): Kaseya / Datto: Datto RMM: Windows, macOS, Linux devices, network devices, printers, ESXi hosts. VSA: Windows, macOS, Linux endpoints; mobile through device management (Apple, Android).research/helmline-comparison.md:7
/helmline/Agent platforms (Windows, macOS, Linux, mobile): N-able: Not stated on the N-central, platform and comparison pages read.research/helmline-comparison.md:7
/helmline/Agent platforms (Windows, macOS, Linux, mobile): SuperOps: Discovers Windows, macOS, Linux, iOS and Android devices automatically, syncs them from Intune, and picks up switches and routers through SNMP. Agent operating-system support: not stated.research/helmline-comparison.md:7
/helmline/Remote access or remote control: Helmline: [not built]research/helmline-comparison.md:8
/helmline/Remote access or remote control: Atera: Splashtop included; AnyDesk; TeamViewer and ScreenConnect with the customer's own licences.research/helmline-comparison.md:8
/helmline/Remote access or remote control: NinjaOne: Remote access with end-to-end encryption and MFA.research/helmline-comparison.md:8
/helmline/Remote access or remote control: Kaseya / Datto: Datto RMM: Web Remote on supported Windows and macOS devices. VSA: remote desktop, private RDP, on-demand sessions.research/helmline-comparison.md:8
/helmline/Remote access or remote control: N-able: Take Control is listed as the remote access and remote support product.research/helmline-comparison.md:8
/helmline/Remote access or remote control: SuperOps: "Use remote control, an SSH terminal, file transfer, and scripting on any endpoint or network device, all from one console."research/helmline-comparison.md:8
/helmline/Operating-system patching: Helmline: [not built]research/helmline-comparison.md:9
/helmline/Operating-system patching: Atera: "Automate update and patch deployment".research/helmline-comparison.md:9
/helmline/Operating-system patching: NinjaOne: Patches across Windows, macOS, Linux.research/helmline-comparison.md:9
/helmline/Operating-system patching: Kaseya / Datto: Datto RMM: Windows patching by policy; macOS and Linux updates with reusable components. VSA: patch policies for operating systems.research/helmline-comparison.md:9
/helmline/Operating-system patching: N-able: N-central: "AI Accelerated vulnerability and patch management". N-central UEM: "built-in vulnerability management (coming soon)". The N-sight and N-central comparison table lists "Multi OS Device Patching" (product not attributed).research/helmline-comparison.md:9
/helmline/Operating-system patching: SuperOps: Patching across Windows, macOS, Linux and mobile; rings and maintenance windows; each patch carries a CVSS score and a Patch Confidence score.research/helmline-comparison.md:9
/helmline/Third-party application patching: Helmline: [not built]research/helmline-comparison.md:10
/helmline/Third-party application patching: Atera: Stated: "Does Atera's solution support third-party application patching? Yes" (WinGet, Chocolatey, Homebrew).research/helmline-comparison.md:10
/helmline/Third-party application patching: NinjaOne: Its own pages state three figures: 8,800+ and 6,000+ applications (patch page); "over 200" third-party applications (RMM page).research/helmline-comparison.md:10
/helmline/Third-party application patching: Kaseya / Datto: Datto RMM: "supported third-party applications". VSA: patch policies for third-party software.research/helmline-comparison.md:10
/helmline/Third-party application patching: N-able: Not stated on the pages read.research/helmline-comparison.md:10
/helmline/Third-party application patching: SuperOps: "Patch 10,000+ Windows apps from catalogs such as Winget and Chocolatey, and keep macOS and Linux apps current through Homebrew and your own custom apps."research/helmline-comparison.md:10
/helmline/Scripting and automation: Helmline: [built] Scripts signed offline; every run needs a second admin's approval; the agent verifies the signature. [proven live] AI drafts a script, saved unsigned and needing approval. Running one on a real device: not shown.research/helmline-comparison.md:11
/helmline/Scripting and automation: Atera: Shared Script Library; AI script generator. Scripting languages: not stated.research/helmline-comparison.md:11
/helmline/Scripting and automation: NinjaOne: Scripts in PowerShell, Batch, ShellScript, JavaScript, VBScript.research/helmline-comparison.md:11
/helmline/Scripting and automation: Kaseya / Datto: Datto RMM: "over 500 pre-built components" to install applications, run scripts and monitor conditions. VSA: scripts, tasks, visual workflows.research/helmline-comparison.md:11
/helmline/Scripting and automation: N-able: N-central comparison row: "Drag and Drop No-Code Automation". N-central UEM: "AI scripting".research/helmline-comparison.md:11
/helmline/Scripting and automation: SuperOps: Policies for "software patching, security, data backups, and scripting"; "AI-assisted scripting".research/helmline-comparison.md:11
/helmline/Monitoring and alerting: Helmline: [proven, demo agents] CPU, memory and disk threshold rules open an alert and optionally a ticket.research/helmline-comparison.md:12
/helmline/Monitoring and alerting: Atera: Remote monitoring and alerts; custom alert profiles.research/helmline-comparison.md:12
/helmline/Monitoring and alerting: NinjaOne: Alerts on "over 100 monitoring conditions"; delivery by in-app alert, email, SMS, mobile push, Slack, Teams.research/helmline-comparison.md:12
/helmline/Monitoring and alerting: Kaseya / Datto: Datto RMM: thresholds by policy; alert actions include ticketing, webhooks, automated response. VSA: health, services, performance, availability through profiles and notifications.research/helmline-comparison.md:12
/helmline/Monitoring and alerting: N-able: N-central: "hundreds of templates and monitors". The comparison table lists a remote monitoring and management row (product not attributed).research/helmline-comparison.md:12
/helmline/Monitoring and alerting: SuperOps: "Deploy and monitor antivirus and backup across your fleet"; discovery can "alert technicians when support may be needed".research/helmline-comparison.md:12
/helmline/Software deployment: Helmline: [not built]research/helmline-comparison.md:13
/helmline/Software deployment: Atera: Software management with Chocolatey, Homebrew, WinGet.research/helmline-comparison.md:13
/helmline/Software deployment: NinjaOne: Software Package Repository for custom installation packages.research/helmline-comparison.md:13
/helmline/Software deployment: Kaseya / Datto: Datto RMM: jobs to devices, sites, filters or groups. VSA: "deploy patches and software". Autotask PSA: not stated.research/helmline-comparison.md:13
/helmline/Software deployment: N-able: N-central UEM: "Automated deployment of security software".research/helmline-comparison.md:13
/helmline/Software deployment: SuperOps: "Advanced app distribution" listed; "deploy and update apps" on iPhone, iPad and Android; third-party apps deployed through the patch tool.research/helmline-comparison.md:13
/helmline/Network discovery: Helmline: [not built]research/helmline-comparison.md:14
/helmline/Network discovery: Atera: Listed under the Enterprise plan; also listed as an add-on at $29 per month per technician.research/helmline-comparison.md:14
/helmline/Network discovery: NinjaOne: Scans every IP-addressable device using standard TCP/IP protocols, "no credentials required".research/helmline-comparison.md:14
/helmline/Network discovery: Kaseya / Datto: Datto RMM: device discovery across site subnets, topology maps. VSA: discovers network devices.research/helmline-comparison.md:14
/helmline/Network discovery: N-able: N-central: "Automated onboarding and discovery".research/helmline-comparison.md:14
/helmline/Network discovery: SuperOps: "Discovery tools use a combination of probes and sensors or network traffic patterns to help with network discovery." Devices include "network switches, firewalls, servers, printers".research/helmline-comparison.md:14
/helmline/Ticketing: Helmline: [proven] Tickets from console, portal, email and alerts; internal notes; status changes.research/helmline-comparison.md:15
/helmline/Ticketing: Atera: Ticketing and service portal.research/helmline-comparison.md:15
/helmline/Ticketing: NinjaOne: Ticketing.research/helmline-comparison.md:15
/helmline/Ticketing: Kaseya / Datto: Autotask PSA: "ITIL-aligned ticketing module". Datto RMM: alerts can trigger ticketing. VSA: not stated.research/helmline-comparison.md:15
/helmline/Ticketing: N-able: MSP Manager: "a help desk offering ticketing, reporting, and billing management". The comparison table lists "Built in Ticketing and Billing".research/helmline-comparison.md:15
/helmline/Ticketing: SuperOps: "AI-powered ticket workflows"; "RMM alerts and PSA tickets exist in the same platform natively."research/helmline-comparison.md:15
/helmline/SLA tracking: Helmline: [proven] Due dates from a per-customer policy (high: response 60 min, resolution 480 min by default); first public staff reply meets the response target. [built, unit-tested] breached state. [not built] business-hours calendars.research/helmline-comparison.md:16
/helmline/SLA tracking: Atera: "SLA management" listed in the plan feature table.research/helmline-comparison.md:16
/helmline/SLA tracking: NinjaOne: SLA management; SLA tracking.research/helmline-comparison.md:16
/helmline/SLA tracking: Kaseya / Datto: Autotask PSA: visual timeline that highlights the SLA. Datto RMM, VSA: not stated.research/helmline-comparison.md:16
/helmline/SLA tracking: N-able: Not stated. "SLAs" appears only in a sentence about integrating third-party tech through open APIs.research/helmline-comparison.md:16
/helmline/SLA tracking: SuperOps: "SLA tracking & breach alerts".research/helmline-comparison.md:16
/helmline/Time tracking: Helmline: [proven] Time entries on tickets, rounded by customer rate card.research/helmline-comparison.md:17
/helmline/Time tracking: Atera: One mention: "time-tracking" in the ticketing description.research/helmline-comparison.md:17
/helmline/Time tracking: NinjaOne: "Track billable time, services, and automated work in one place."research/helmline-comparison.md:17
/helmline/Time tracking: Kaseya / Datto: Autotask PSA: "Accurately track time for services rendered". Datto RMM, VSA: not stated.research/helmline-comparison.md:17
/helmline/Time tracking: N-able: MSP Manager: "capture previously unbilled time and expenses".research/helmline-comparison.md:17
/helmline/Time tracking: SuperOps: "Automated worklogs" listed.research/helmline-comparison.md:17
/helmline/Billing and invoicing: Helmline: [proven] Invoice per period; each line names the devices or time entries it came from; billed time is not billed again. [not built] payment collection.research/helmline-comparison.md:18
/helmline/Billing and invoicing: Atera: "Flexible contracts and billing"; QuickBooks integration: "create customized invoices".research/helmline-comparison.md:18
/helmline/Billing and invoicing: NinjaOne: "Automated billing and invoicing software for MSPs".research/helmline-comparison.md:18
/helmline/Billing and invoicing: Kaseya / Datto: Autotask PSA: invoicing from tracked labor, contracts, expenses and services; contract types, terms, billing options. Datto RMM, VSA: not stated.research/helmline-comparison.md:18
/helmline/Billing and invoicing: N-able: MSP Manager: "billing management". The comparison table lists "Built in Ticketing and Billing for an All-In-One solution".research/helmline-comparison.md:18
/helmline/Billing and invoicing: SuperOps: "Connect contracts, billable work, and invoicing in one flow"; "One-click invoice conversion".research/helmline-comparison.md:18
/helmline/Customer portal: Helmline: [built] Emailed single-use link; needs an outgoing mail server. Not shown in the browser journey.research/helmline-comparison.md:19
/helmline/Customer portal: Atera: Service portal for submitting and tracking service requests.research/helmline-comparison.md:19
/helmline/Customer portal: NinjaOne: Portal where end users submit, track and update tickets.research/helmline-comparison.md:19
/helmline/Customer portal: Kaseya / Datto: Autotask PSA: Client Portal for customers to collaborate on tickets and projects. Datto RMM, VSA: not stated.research/helmline-comparison.md:19
/helmline/Customer portal: N-able: Passportal feature list includes "Custom Branded Portal" (listed without a description). Customer portal for tickets: not stated.research/helmline-comparison.md:19
/helmline/Customer portal: SuperOps: Not stated on the pages read.research/helmline-comparison.md:19
/helmline/Reporting: Helmline: [proven] Dashboard of devices, alerts, tickets, SLA state. [not built] SLA and billing exports.research/helmline-comparison.md:20
/helmline/Reporting: Atera: Classic reports (all plans); 11 preset reports (Expert); custom reports "up to 10" (Master), "unlimited" (Enterprise).research/helmline-comparison.md:20
/helmline/Reporting: NinjaOne: Not stated on the pages read (the reporting page loaded without reporting content).research/helmline-comparison.md:20
/helmline/Reporting: Kaseya / Datto: Datto RMM: scheduled, configurable reports. VSA: report designer without code. Autotask PSA: reports on resource utilization, ticket resolution times, profitability.research/helmline-comparison.md:20
/helmline/Reporting: N-able: Passportal: "complex reporting" beyond credential strength checks. MSP Manager: ticketing, reporting, billing. The comparison table lists a "Reporting" row (product not attributed).research/helmline-comparison.md:20
/helmline/Reporting: SuperOps: "Profitability Reports" listed.research/helmline-comparison.md:20
/helmline/AI features: Helmline: [proven live] Summarize and draft reply; draft a fix script. Off by default; ticket text is sent to Anthropic's Claude; monthly cap 5 USD per organisation by default. Cap refusal on the real database: not run.research/helmline-comparison.md:21
/helmline/AI features: Atera: AI Copilot in all plans: AI script generator, ticket summaries and solutions, reply generator.research/helmline-comparison.md:21
/helmline/AI features: NinjaOne: Katana AI: every recommendation needs a technician's approval before platform actions; a global kill switch.research/helmline-comparison.md:21
/helmline/AI features: Kaseya / Datto: Datto RMM: log insights through Kaseya Intelligence. VSA: Kaseya Assist suggests workflows. Autotask PSA: ticket classification and routing, summaries, writing assistant.research/helmline-comparison.md:21
/helmline/AI features: N-able: N-central: "N-zo, our AI assistant" that "answers questions, surfaces risks, and guides decisions without leaving the console"; an MCP Server connecting MCP-compatible AI tools to live N-central data; "Shadow AI visibility". N-central UEM: "AI scripting".research/helmline-comparison.md:21
/helmline/AI features: SuperOps: Monica AI: "Monica handles routine IT tasks within the guardrails you set"; autonomous L1 resolution and autonomous patching are listed as features.research/helmline-comparison.md:21
/helmline/Integrations: Helmline: [built] Inbound email to ticket, outgoing SMTP, audit-receipt webhook. [not built] billing, accounting or PSA connectors.research/helmline-comparison.md:22
/helmline/Integrations: Atera: Count not stated; the integrations page lists logos.research/helmline-comparison.md:22
/helmline/Integrations: NinjaOne: Count not stated.research/helmline-comparison.md:22
/helmline/Integrations: Kaseya / Datto: Autotask PSA: "250+ Third Party Integrations" (integration hub) and "170+" tools (overview): two figures on its own pages. Datto RMM, VSA: named examples; count not stated.research/helmline-comparison.md:22
/helmline/Integrations: N-able: "90+ Third-Party Integrations" (as shown on the page); "integrate third-party tech through open APIs"; the comparison table lists 3rd-party application and PSA integration rows.research/helmline-comparison.md:22
/helmline/Integrations: SuperOps: Marketplace integrations named on the PSA page: Splashtop, TeamViewer, ConnectWise Control, Xero, Webroot, QuickBooks Online, QuickBooks Desktop, Pax8. Also named: ServiceNow, Entra ID, Intune. Count not stated.research/helmline-comparison.md:22
/helmline/Security attestations the vendor states: Helmline: None held. A NIST CSF 2.0 mapping written by the project lists what is and is not built; it is not an attestation.research/helmline-comparison.md:23
/helmline/Security attestations the vendor states: Atera: ISO 27001, 27017, 27018, 27032; SOC 2 Type II; ISO 42001. States compliance with HIPAA and GDPR.research/helmline-comparison.md:23
/helmline/Security attestations the vendor states: NinjaOne: SOC 2; ISO 27001:2022; ISO 27018; ISO 42001; FedRAMP Rev5 Class C certification.research/helmline-comparison.md:23
/helmline/Security attestations the vendor states: Kaseya / Datto: Trust centre lists SOC 2 Type 2 reports (Kaseya, Datto), SOC 3 reports, a SOC 1 Type 2 report (ConnectBooster). ISO 27001: not stated.research/helmline-comparison.md:23
/helmline/Security attestations the vendor states: N-able: N-able's own attestations: not stated. The security statement says its data centres are "ISO27001 certified" and hold "Service Organization Control (SOC) 2 Type II attestation letters". N-central page: "N-able EDR FedRAMP Editions for federal and DIB fleets".research/helmline-comparison.md:23
/helmline/Security attestations the vendor states: SuperOps: "SOC II Type 2, GDPR, ISO 27001, and HIPAA compliance".research/helmline-comparison.md:23
/helmline/Pricing model and published price: Helmline: None set. Licence: all rights reserved.research/helmline-comparison.md:24
/helmline/Pricing model and published price: Atera: Per technician: Professional $149 per month billed annually ($169 monthly); Expert $189 ($229); Master $219 ($269); Enterprise "Let's talk". 30-day free trial.research/helmline-comparison.md:24
/helmline/Pricing model and published price: NinjaOne: Per endpoint: "as low as $1.50 per month at 10,000 endpoints, increasing to $3.75 at 50 or fewer" (commercial, non-FedRAMP instance). 14-day trial.research/helmline-comparison.md:24
/helmline/Pricing model and published price: Kaseya / Datto: Price: not stated; "request pricing". Datto RMM is sold through a "single, integrated subscription" (Kaseya 365 Endpoint). VSA price depends on deployment model, device volume, packaging, capabilities.research/helmline-comparison.md:24
/helmline/Pricing model and published price: N-able: Not stated. Buttons: "Try it free", "Get a quote".research/helmline-comparison.md:24
/helmline/Pricing model and published price: SuperOps: Per endpoint per month, "with unlimited technicians at no extra charge"; "Each plan has a minimum of 150 endpoints." Amounts: "Request pricing".research/helmline-comparison.md:24
/helmline/Hosting: Helmline: Self-hosted (Docker Compose, install script). [proven in CI] image build and install. No hosted service offered.research/helmline-comparison.md:25
/helmline/Hosting: Atera: Platform hosting: not stated. AI models are hosted in Microsoft's Azure environment.research/helmline-comparison.md:25
/helmline/Hosting: NinjaOne: Cloud-based, with "no infrastructure or VPN required" (patch page FAQ). Self-hosted: not stated.research/helmline-comparison.md:25
/helmline/Hosting: Kaseya / Datto: Datto RMM: cloud-based. Autotask PSA: cloud. VSA 10: SaaS and on-premises.research/helmline-comparison.md:25
/helmline/Hosting: N-able: N-central UEM: "A single SaaS solution for IT management, security, and automation at scale". Passportal: cloud-based. The comparison table lists "On-Premises Deployment Option" (product not attributed).research/helmline-comparison.md:25
/helmline/Hosting: SuperOps: "We are hosted on Amazon Web Services (AWS) cloud." Self-hosted: not stated.research/helmline-comparison.md:25
/patchowner/Turns the CISA KEV catalog into vulnerability notices routed to the owner of an affected item. Built; seven of eight features proven on a sample inventory, one tested with sample data; relevance is not measured and it has not been tried on an organization's own inventory.scorecards/patchowner.json:95
/patchowner/Score 84 of 100scorecards/patchowner.json:80
/patchowner/Stage: Beta on our own rubricscorecards/patchowner.json:82
/patchowner/Scored 2026-11-08scorecards/patchowner.json:105
/patchowner/commit f82c327scorecards/patchowner.json:3
/patchowner/Google Play: No Android appscorecards/patchowner.json:82
/patchowner/Primary journey: shown with sample datascorecards/patchowner.json:6
/patchowner/transcript/Screen recording of patchowner, 2:32, file dated 2026-11-08. The voice is AI-generated (ElevenLabs) and the data on screen is made upsite/videos.json:88
/patchowner/transcript/Recorded 2026-11-08. The scorecard shown in the video reads 83; the site shows 84/100 on our own rubric (2026-11-08). The recording shows the demo inventory only.scorecards/patchowner.json:82
/patchowner/transcript/Re-recorded 2026-11-08 against patchowner main f82c327 (tag v0.3.0); shows the Watch card, the report toolbar Tickets button, the keyboard focus ring and real tabs, the Health tab and the privacy page; replay numbers updated to 104 advisories, 25 notices, 2 suppressed; the gap list no longer says pages lack focus outlines and tab labels. Narration voice is AI-generated (ElevenLabs). Picture re-encoded for fast seeking; captions timed by forced alignment.videos/rerecord-2026-11-08/evidence-patchowner.md:5
/patchowner/Recorded 2026-11-08. The scorecard shown in the video reads 83; the site shows 84/100 on our own rubric (2026-11-08). The recording shows the demo inventory only.scorecards/patchowner.json:82
/patchowner/Re-recorded 2026-11-08 against patchowner main f82c327 (tag v0.3.0); shows the Watch card, the report toolbar Tickets button, the keyboard focus ring and real tabs, the Health tab and the privacy page; replay numbers updated to 104 advisories, 25 notices, 2 suppressed; the gap list no longer says pages lack focus outlines and tab labels. Narration voice is AI-generated (ElevenLabs). Picture re-encoded for fast seeking; captions timed by forced alignment.videos/rerecord-2026-11-08/evidence-patchowner.md:5
/patchowner/CLI replay of CISA KEV over inventory CSV -> HTML reportscorecards/patchowner.json:7
/patchowner/Web upload demo (patchowner serve)scorecards/patchowner.json:19
/patchowner/SSVC deployer tree, default SEI policy, custom --policy CSVscorecards/patchowner.json:25
/patchowner/Matching tiers, suppression, budget, routingscorecards/patchowner.json:31
/patchowner/Health tab (README says ten to twelve checks)scorecards/patchowner.json:37
/patchowner/Action buttons persist state (serve mode JSON; static mode browser storage)scorecards/patchowner.json:43
/patchowner/Interactive policy edit recomputes cards in pagescorecards/patchowner.json:49
/patchowner/Live demo patchowner.comscorecards/patchowner.json:55
/patchowner/Feature 7 (in-page policy edit) is built, tested with sample data: its browser log on main records '9 ok, 0 failed' but no exit code line; one browser engine; the edited policy CSV does not run with `replay --policy` on main (PR #31 not merged)scorecards/patchowner.json:84
/patchowner/Proof logs for features 1 to 5 and 8 were recorded on 2026-11-08 at the pre-merge commit (base f1da22e plus proof files); code merged after them (PRs #96, #97 matching, #88, #93 Watch card) was not re-recorded. Feature 6 was re-recorded at ab77bb6 code (PR #116)scorecards/patchowner.json:85
/patchowner/patchowner.com is the build of f1da22e: site/index.html is unchanged on main since then, so it has none of the 2026-11-08 changes; site/privacy.html is on main but its deploy was not checkedscorecards/patchowner.json:86
/patchowner/Test count on main not measured (README's 97 passed, 4 skipped is dated 2026-10-30); CI on main is green at f82c327 and ab77bb6 but what it ran was not readscorecards/patchowner.json:87
/patchowner/No PyPI release and no installer; running it needs uvscorecards/patchowner.json:88
/patchowner/CLI tests are thin: only the CSV encoding path calls cli.main directly (tests/test_cli_csv_encoding.py:27); proof logs cover the rest by handscorecards/patchowner.json:89
/patchowner/Browser runs are hand-recorded with Node and Playwright, not run in CI; Safari, a phone and a screen reader not runscorecards/patchowner.json:90
/patchowner/Not tried on an organization's own inventory; one machine's package list was run once (proof/real-software-list.log), where 111 name hits were refused and named; relevance is not measuredscorecards/patchowner.json:91
/patchowner/pyproject.toml says 0.1.0 while the tag is v0.3.0; CHANGELOG.md has no 0.2.0 or 0.3.0 section (changes sit under Unreleased)scorecards/patchowner.json:92
/patchowner/certifi PYSEC-2026-4320 unpatched (dev-only, via httpx); a11y open: no skip link, contrast not verified, no screen reader runscorecards/patchowner.json:93
/patchowner/2026-11-08: Action-buttons proof log now states its exit code and was re-recorded at current main (PR #116; tag v0.3.0). Feature 6 is proven; 7 of 8 features proven. 84/100 on our own rubric. CI on main completed success on f82c327 and ab77bb6.scorecards/patchowner.json:97
/patchowner/2026-11-08: Proof logs merged for the core features (PRs #33, #34, #35, #37, #38, #39, #40, #44, #50; tag v0.2.0). Features 1, 2, 3, 4, 5 and 8 were proven (a log on main with date, commit, command, exit code); features 6 and 7 stayed built, tested with sample data at that point because their logs carried no exit code line. 83/100 on our own rubric.scorecards/patchowner.json:98
/patchowner/2026-11-08: Fixes to what the report says and does (PRs #36, #53, #54, #60, #65, #66, #67, #69, #70, #72, #74, #77, #78, #79, #84, #85, #86, #88, #90, #92, #93, #47; tag v0.2.0): a refused action is no longer shown as recorded, a CSV asset name no longer runs as script in the Policy tree, keyboard focus ring and real tabs, Reopen on a suppressed notice, a bad download keeps the saved catalog.scorecards/patchowner.json:99
/patchowner/2026-11-08: Matching and output changes (PRs #48 Tickets button saves open notices as a CSV, #51 upload-form labels, #95 long warning lists fold, #96 and #97 a name inside another word is likely, not exact, and a row with no vendor no longer matches inside a word; tag v0.2.0). The proof logs were recorded before #96 and #97 and were not re-run.scorecards/patchowner.json:100
/patchowner/2026-11-08: Docs and housekeeping on main (PRs #32 README says ten to twelve Health checks, #99 privacy page site/privacy.html, #100 CHANGELOG.md, #107 CI on a self-hosted runner; tag v0.2.0). patchowner.com is not rebuilt; its page is still the build of f1da22e.scorecards/patchowner.json:101
/patchowner/2026-11-07: Corrected the one-line description. It said "Only verified, relevant, actionable ... notices"; no measure of relevance exists and the run covers a sample inventory only. The line now says what ran and the stage.scorecards/patchowner.json:102
/aiconsumerrights/Plain-language help with your rights when AI makes decisions about you.scorecards/aiconsumerrights.org.json:113
/aiconsumerrights/Score 78 of 100scorecards/aiconsumerrights.org.json:91
/aiconsumerrights/Stage: Beta on our own rubricscorecards/aiconsumerrights.org.json:102
/aiconsumerrights/Scored 2026-11-08scorecards/aiconsumerrights.org.json:114
/aiconsumerrights/commit 4f25b37scorecards/aiconsumerrights.org.json:3
/aiconsumerrights/Google Play: Not on Playscorecards/aiconsumerrights.org.json:89
/aiconsumerrights/Primary journey: not shownscorecards/aiconsumerrights.org.json:6
/aiconsumerrights/transcript/Screen recording of AI Consumer Rights, 1:58, file dated 2026-11-05. The voice is AI-generated (ElevenLabs) and the data on screen is made upsite/videos.json:4
/aiconsumerrights/transcript/Audio loudness adjusted on 2026-11-05. Re-encoded on 2026-11-05 for faster seeking. Wording and picture content unchanged.docs/video-quality-2026-11-05.md:185
/aiconsumerrights/Audio loudness adjusted on 2026-11-05. Re-encoded on 2026-11-05 for faster seeking. Wording and picture content unchanged.docs/video-quality-2026-11-05.md:185
/aiconsumerrights/Situation guides + rights by country (help pages)scorecards/aiconsumerrights.org.json:7
/aiconsumerrights/Dispute-kit letter (fill in, copy, mailto)scorecards/aiconsumerrights.org.json:19
/aiconsumerrights/Algorithm Decision Explorer (3 steps)scorecards/aiconsumerrights.org.json:25
/aiconsumerrights/Forum voting API + consensus across language groupsscorecards/aiconsumerrights.org.json:31
/aiconsumerrights/Suggest a statement (140 chars) + automated precheck + reportscorecards/aiconsumerrights.org.json:37
/aiconsumerrights/Admin review pagescorecards/aiconsumerrights.org.json:43
/aiconsumerrights/Privacy page, sources page, how-it-works pagescorecards/aiconsumerrights.org.json:49
/aiconsumerrights/8 languagesscorecards/aiconsumerrights.org.json:21
/aiconsumerrights/Live site reachablescorecards/aiconsumerrights.org.json:61
/aiconsumerrights/Forum voting, suggesting and reporting ran on a throwaway local Postgres 17 on 2026-11-07, not against the real Neon DB or a real sign-in; the admin page is tested only against mocks/jsdomscorecards/aiconsumerrights.org.json:104
/aiconsumerrights/The automated precheck call to OpenRouter was not exercised in any recorded run (key removed, proof/suggest-and-report.log), and no recorded run presses the dispute-kit mailto actionscorecards/aiconsumerrights.org.json:105
/aiconsumerrights/Numbers on the help pages were compared with archived copies of their sources on 2026-11-08: 29 of 30 passages found; the EU 12 months is not on its cited page (proof/help-numbers.log, exit 1). Not legal reviewscorecards/aiconsumerrights.org.json:106
/aiconsumerrights/No signed Android release, and assetlinks.json still lacks the Play App Signing SHA; Play status unknownscorecards/aiconsumerrights.org.json:107
/aiconsumerrights/Translations in all 8 languages are unreviewed by native speakers (README.md:39); legal content unreviewedscorecards/aiconsumerrights.org.json:108
/aiconsumerrights/No TalkBack run. Chrome 157 runs on a local build (2026-11-07) traced the help tools and dispute kit (13 routes, 575 requests, none off-site, none carrying the typed text) and exercised the deadline tracker in 8 languages; the live site and the Android app were not traced (not yet traced)scorecards/aiconsumerrights.org.json:109
/aiconsumerrights/Human moderation of suggested statements is a manual process, not exercisedscorecards/aiconsumerrights.org.json:110
/aiconsumerrights/2026-11-08: Rescored under the new feature rule: each of 10 features is worth 2.5 of 25. 2 count as proven by a logged run (Algorithm Decision Explorer; forum voting on a local Postgres 17, not the real database), 7 as built and tested with sample data, 1 not built. Score 78/100 on our own rubric (was 80/100 on the old rule). Ops line corrected: CHANGELOG.md exists. Tag v0.3.0 is on main.scorecards/aiconsumerrights.org.json:135
/aiconsumerrights/2026-11-08: California help text now says the 45 days can reach 90 if the business tells you it needs longer, in 8 languages; new run npm run proof:help-numbers compares help-page numbers with their sources: 29 of 30 found, exit 1 (EU 12 months not on its cited page). PR #81, tag v0.3.0. CI moved to a self-hosted runner, PR #79.scorecards/aiconsumerrights.org.json:136
/aiconsumerrights/2026-11-07: Recorded runs on a local production build, not the live site: the dispute-kit deadline tracker keeps its list on the device, survives a reload and clears (Chrome); the Algorithm Decision Explorer browser run in 8 languages; and the help tools made no off-site request, no write and no request carrying typed text (575 requests, 13 routes, Chrome 157). Each check also failed when a fault was planted.scorecards/aiconsumerrights.org.json:137
/aiconsumerrights/2026-11-07: Forum: suggesting a statement, reporting it, and the forum_voter cookie behave as the privacy page says, on a throwaway local Postgres 17, not the real database. Release v0.2.0.scorecards/aiconsumerrights.org.json:138
/homeiotguardian/Audit home Wi-Fi security, discover smart devices, harden your connected home.scorecards/HomeIoTGuardian.json:81
/homeiotguardian/Score 66 of 100scorecards/HomeIoTGuardian.json:68
/homeiotguardian/Stage: Beta on our own rubricscorecards/HomeIoTGuardian.json:70
/homeiotguardian/Scored 2026-11-08scorecards/HomeIoTGuardian.json:82
/homeiotguardian/commit 88fea44scorecards/HomeIoTGuardian.json:3
/homeiotguardian/Google Play: Not on Playscorecards/HomeIoTGuardian.json:66
/homeiotguardian/Primary journey: not shownscorecards/HomeIoTGuardian.json:6
/homeiotguardian/transcript/Screen recording of HomeIoT Guardian, 2:55, file dated 2026-11-05. The voice is AI-generated (ElevenLabs) and the data on screen is made upsite/videos.json:70
/homeiotguardian/transcript/Recorded 2026-11-01. The narration says you can export a PDF report; PDF export has not been run on a device yet.scorecards/HomeIoTGuardian.json:25
/homeiotguardian/transcript/Audio loudness adjusted on 2026-11-05. Re-encoded on 2026-11-05 for faster seeking. Wording and picture content unchanged.docs/video-quality-2026-11-05.md:185
/homeiotguardian/Recorded 2026-11-01. The narration says you can export a PDF report; PDF export has not been run on a device yet.scorecards/HomeIoTGuardian.json:25
/homeiotguardian/Audio loudness adjusted on 2026-11-05. Re-encoded on 2026-11-05 for faster seeking. Wording and picture content unchanged.docs/video-quality-2026-11-05.md:185
/homeiotguardian/Wi-Fi/router posture, mDNS+SSDP LAN scan, UPnP checkscorecards/HomeIoTGuardian.json:13
/homeiotguardian/Guided device checks + tasks list + readiness scorescorecards/HomeIoTGuardian.json:7
/homeiotguardian/JSON backup/restore, data erasescorecards/HomeIoTGuardian.json:31
/homeiotguardian/Review reminders (WorkManager)scorecards/HomeIoTGuardian.json:37
/homeiotguardian/Catalog seed + Room migrationscorecards/HomeIoTGuardian.json:43
/homeiotguardian/No feature has a proof log on main: five are built and tested with sample data on a desktop JVM, one (PDF export) is not tested yetscorecards/HomeIoTGuardian.json:72
/homeiotguardian/Not run on a phone or a real home network: the mDNS/SSDP scan, the router port check, the PDF render and the notification promptscorecards/HomeIoTGuardian.json:15
/homeiotguardian/The PDF export attempt on the JVM failed (4 of 4 tests, 2026-11-07); it needs a device or an instrumented testscorecards/HomeIoTGuardian.json:74
/homeiotguardian/README links proof/unit-tests.log, proof/catalog-counts.log and proof/upnp-fetch-http.log; none of the three is on mainscorecards/HomeIoTGuardian.json:75
/homeiotguardian/12x14 closed test not started per repo docs; no signed .aab built here (no upload key on this machine)scorecards/HomeIoTGuardian.json:76
/homeiotguardian/No CHANGELOG and no LICENSE file on main; no user guide beyond the release docs; lintDebug exit 1 on a ByteOrderMark false positive was reported earlier and not re-runscorecards/HomeIoTGuardian.json:67
/homeiotguardian/TalkBack, contrast and large-font checks not run; no reduced-motion setting in the appscorecards/HomeIoTGuardian.json:78
/homeiotguardian/Network use not yet traced (no network capture); cleartext traffic is permitted in the base network configscorecards/HomeIoTGuardian.json:79
/homeiotguardian/2026-11-08: Rescored under the per-feature rule: no core feature has a run log on main, so five count as built and tested with sample data (half share each) and the PDF export counts as not tested yet. 66/100 on our own rubric (was 73). Release tag v0.1.3.scorecards/HomeIoTGuardian.json:112
/homeiotguardian/2026-11-08: The UPnP description fetch now has tests of its HTTP behaviour over local sockets (PR #24, tag v0.1.3); the log it points to is not on main. CI now runs on the self-hosted runner (PR #23).scorecards/HomeIoTGuardian.json:113
/homeiotguardian/2026-11-07: The public contact is now support@shipitworks.com in the privacy policy, the Play listing draft and the project site pages, and the README has an AI use section. Release v0.1.2.scorecards/HomeIoTGuardian.json:114
/homeiotguardian/2026-11-07: A recorded attempt to run the PDF export in a JVM test failed (4 of 4 tests, in three graphics modes). The PDF export is still not proven; it needs a device or an instrumented test.scorecards/HomeIoTGuardian.json:115
/scamshield-companion/Offline-first scam-safety app built around Prevent, Protect, Recover; built so analysis runs on the device (offline use not yet tested).scorecards/scamshield-companion.json:87
/scamshield-companion/Score 65 of 100scorecards/scamshield-companion.json:74
/scamshield-companion/Stage: Beta on our own rubricscorecards/scamshield-companion.json:76
/scamshield-companion/Scored 2026-11-08scorecards/scamshield-companion.json:88
/scamshield-companion/commit ff87049scorecards/scamshield-companion.json:3
/scamshield-companion/Google Play: Not on Playscorecards/scamshield-companion.json:72
/scamshield-companion/Primary journey: shown with sample datascorecards/scamshield-companion.json:6
/scamshield-companion/transcript/Screen recording of ScamShield Companion, 2:54, file dated 2026-11-05. The voice is AI-generated (ElevenLabs) and the data on screen is made upsite/videos.json:136
/scamshield-companion/transcript/Recorded 2026-11-01. The narration says nothing leaves the device and the header on screen says the app is offline and private. Corrected 2026-11-07: that is not verified. No network capture of the Android app has been run; offline use was run once in the web build with Chrome's emulated offline mode (2026-11-08).scorecards/scamshield-companion.json:83
/scamshield-companion/transcript/Audio loudness adjusted on 2026-11-05. Re-encoded on 2026-11-05 for faster seeking. Wording and picture content unchanged.docs/video-quality-2026-11-05.md:185
/scamshield-companion/Recorded 2026-11-01. The narration says nothing leaves the device and the header on screen says the app is offline and private. Corrected 2026-11-07: that is not verified. No network capture of the Android app has been run; offline use was run once in the web build with Chrome's emulated offline mode (2026-11-08).scorecards/scamshield-companion.json:83
/scamshield-companion/Audio loudness adjusted on 2026-11-05. Re-encoded on 2026-11-05 for faster seeking. Wording and picture content unchanged.docs/video-quality-2026-11-05.md:185
/scamshield-companion/Inspect: Scam Message Coach, LinkLens, PausePay enginesscorecards/scamshield-companion.json:7
/scamshield-companion/Redact: black-box/pixelate + OCR auto-coverscorecards/scamshield-companion.json:25
/scamshield-companion/Harden: Scorecard, Passphrase Coach, Phish or Legit deckscorecards/scamshield-companion.json:31
/scamshield-companion/First Aid MA: playbooks, incident logscorecards/scamshield-companion.json:37
/scamshield-companion/Share-to-app (Android share target / PWA share_target)scorecards/scamshield-companion.json:43
/scamshield-companion/Offline PWA service workerscorecards/scamshield-companion.json:49
/scamshield-companion/No signed release .aab; a debug APK was built once (permissions dump only) and no release build has runscorecards/scamshield-companion.json:78
/scamshield-companion/The QR scanner and the Android share sheet were not run; text recognition (OCR) ran once on one synthetic screenshot and its auto-found boxes were not checked; the redacted-PNG check covers one hand-drawn box in the web build; the money playbook is unit-tested only, its UI not runscorecards/scamshield-companion.json:79
/scamshield-companion/Play listing copy, screenshots and the data-safety form are still missingscorecards/scamshield-companion.json:80
/scamshield-companion/No dark mode; contrast, keyboard and TalkBack not checked; comfort text was measured only at an emulated 320px width, not on a phonescorecards/scamshield-companion.json:81
/scamshield-companion/Offline was run once in the web build with Chrome's emulated offline mode (four tabs and one message analysis); offline OCR, airplane mode on a device and the Android app were not runscorecards/scamshield-companion.json:82
/scamshield-companion/No network capture of the Android app on a device: "nothing leaves the device" is not yet traced (web build walk and debug-APK manifest only)scorecards/scamshield-companion.json:83
/scamshield-companion/The PausePay and Phish or Legit advice, card labels and the Massachusetts crypto-kiosk figure on the STOP screen have no expert review or source check on main; money-playbook step wording not checked against FTC or issuer pagesscorecards/scamshield-companion.json:84
/scamshield-companion/Privacy policy contact is still the placeholder [YOUR CONTACT EMAIL] (PRIVACY_POLICY.md:71)scorecards/scamshield-companion.json:85
/scamshield-companion/2026-11-08: Release v0.2.3. The money playbook in First Aid now asks how you paid (card, bank transfer, payment app, gift card, crypto, cash) and shows only the matching steps; unit tests only, UI not run, step wording not checked against FTC or issuer pages (PR 20).scorecards/scamshield-companion.json:119
/scamshield-companion/2026-11-08: Two more recorded web-build runs: the built app reloads and opens all four tabs with the network off after one visit, message analysis included (OCR offline not covered; emulated offline, not a device) (PR 12); the Phish or Legit deck was played through by button and swipe, progress kept across a reload (PR 25). Neither log states an exit code, so these rows stay Tested with sample data.scorecards/scamshield-companion.json:120
/scamshield-companion/2026-11-08: Release v0.2.2. Four proof logs were added on main and the README lines scoped to the web build: the saved redacted PNG (black box changed exactly the dragged area, nothing outside it, no metadata chunks; one box, one image), the A/A+ comfort text (16px to 20px, no sideways scroll at 320px, 48px buttons, kept after reload) and the PausePay answer paths and STOP screen. None of the logs states an exit code, so these rows are Tested with sample data, not Proven (PRs 18, 21, 22).scorecards/scamshield-companion.json:121
/scamshield-companion/2026-11-08: A test now pins the README counts (16 message rules, 4 PausePay questions); vitest 311 passed in the log (PR 16).scorecards/scamshield-companion.json:122
/scamshield-companion/2026-11-08: The share_target manifest now declares enctype; the Chrome manifest warning went from 1 to 0 and the GET share text still reaches Inspect in the web build. The Android share sheet was not run (PR 27).scorecards/scamshield-companion.json:123
/scamshield-companion/2026-11-08: CI now runs on the self-hosted runner; the latest run result is not verified (PR 26).scorecards/scamshield-companion.json:124
/scamshield-companion/2026-11-07: The PausePay STOP screen now has a step to report fraud at ReportFraud.ftc.gov (with a unit test).scorecards/scamshield-companion.json:125
/scamshield-companion/2026-11-07: Privacy and network claims are scoped to what the code shows, and the README lists what the app does not do. Recorded checks: the built Android debug app declares CAMERA and no INTERNET or SMS permission (not a release build, not run on a device), and a scripted walk through all four tabs including text recognition requested nothing from any host except the app's own origin (web build, one headless Chrome run). Release v0.2.1.scorecards/scamshield-companion.json:126
/scamshield-companion/2026-11-07: The note under the video now says the narration line "nothing leaves the device" is not verified: no network capture of the Android app has run and offline use is untested. The video is not re-recorded yet.scorecards/scamshield-companion.json:127
/aivalue/Model AI ROI, P&L margins, Balance Sheet cash flow & 30-day adoption pilots.scorecards/aivalue.json:80
/aivalue/Score 68 of 100scorecards/aivalue.json:61
/aivalue/Stage: Beta on our own rubricscorecards/aivalue.json:62
/aivalue/Scored 2026-11-08scorecards/aivalue.json:81
/aivalue/commit 497c725scorecards/aivalue.json:3
/aivalue/Google Play: Not on Playscorecards/aivalue.json:59
/aivalue/Primary journey: not shownscorecards/aivalue.json:6
/aivalue/transcript/Screen recording of AI Value, 3:08, file dated 2026-11-05. The voice is AI-generated (ElevenLabs) and the data on screen is made upsite/videos.json:16
/aivalue/transcript/Audio loudness adjusted on 2026-11-05. Re-encoded on 2026-11-05 for faster seeking. Wording and picture content unchanged.docs/video-quality-2026-11-05.md:185
/aivalue/Audio loudness adjusted on 2026-11-05. Re-encoded on 2026-11-05 for faster seeking. Wording and picture content unchanged.docs/video-quality-2026-11-05.md:185
/aivalue/7 financial calculators (FinancialEngine)scorecards/aivalue.json:7
/aivalue/Catalog + Room database loadscorecards/aivalue.json:19
/aivalue/JSON backup/restorescorecards/aivalue.json:25
/aivalue/Executive PDF export: built, not tested yet. No run log on main; the instrumented test needs a device and a fresh installDebugAndroidTest, and the device check in HANDOFF.md has no saved log. The multi-page fix is on an unmerged PRscorecards/aivalue.json:74
/aivalue/UI screens: not tested yet; no instrumented or UI run, no tracked screenshotsscorecards/aivalue.json:75
/aivalue/Privacy: no permissions declared in the debug APK and no analytics library by name in release dependencies (2026-11-07 logs); no network capture, so runtime behaviour is not yet traced. README line 3 'runs entirely on the phone' is not yet traced either (fix PR #23 open)scorecards/aivalue.json:76
/aivalue/No signed release build and assembleRelease not run; the existing release APK is debug-key signed, so it cannot go to Playscorecards/aivalue.json:77
/aivalue/No user guide, no LICENSE, no CHANGELOG file; root still holds ~20 stray chat-dump files and wrong-path duplicate catalog JSONsscorecards/aivalue.json:78
/aivalue/2026-11-08: Score re-measured against main at 497c725 (tag v0.2.0): 68/100 on our own rubric, down from 72. Three of five features (calculators, catalog and database, backup and restore) now link a saved unit-test log from 2026-11-07 (58 tests, 0 failed, exit 0). Executive PDF export and the screens have no run log, so they are not tested yet.scorecards/aivalue.json:103
/aivalue/2026-11-08: The Home screen button now reads 'Privacy & Methodology: no network permission declared' instead of 'no data leaves this device', and the Play kit drops 'Zero Cloud Collection' (PR #25, tag v0.2.0); no network capture exists, so traffic is not yet traced.scorecards/aivalue.json:104
/aivalue/2026-11-08: CI on main now runs on the self-hosted runner (PR #24); the five latest main runs show success.scorecards/aivalue.json:105
/aivalue/2026-11-07: The README and the in-app privacy copy now say only what was checked: the debug build declares no permissions (so no INTERNET), the release dependencies include no analytics, crash-reporting or ads library (a name match, not a network capture), and 58 unit tests pass (no device or PDF rendering coverage). Release v0.1.1.scorecards/aivalue.json:106
/pocketsec/Find out how hackable you are. The scan runs in your browser; what leaves the device is not yet traced (the password check sends a 5-character hash prefix to Have I Been Pwned).scorecards/pocketsec.json:87
/pocketsec/Score 56 of 100scorecards/pocketsec.json:73
/pocketsec/Stage: Alpha on our own rubricscorecards/pocketsec.json:74
/pocketsec/Scored 2026-11-08scorecards/pocketsec.json:89
/pocketsec/commit af82be6scorecards/pocketsec.json:3
/pocketsec/Google Play: No Android appscorecards/pocketsec.json:74
/pocketsec/Primary journey: shown with sample datascorecards/pocketsec.json:6
/pocketsec/transcript/Screen recording of PocketSec, 1:56, file dated 2026-11-08. The voice is AI-generated (ElevenLabs) and the data on screen is made upsite/videos.json:118
/pocketsec/transcript/Recorded 2026-11-08 on the demo profile. The scorecard in the video shows 63; the site shows 56/100 on our own rubric (2026-11-08). The device check on a real device, the breach lookup and the PDF report were not run. The AUTO-5 menu wording is not confirmed on a real Chrome for Android or Android 16.scorecards/pocketsec.json:79
/pocketsec/transcript/Re-recorded 2026-11-08 against pocketsec main af82be6; shows #88 AUTO-5 menu wording and #65 shorter habit summaries on the demo profile; the unmeasured 'sixty seconds' narration is now attributed to the button label; the changelog gap line is removed. Captions aligned and checked (worst cue 0.05 s); frame scan no hits. Re-encoded 2026-11-08.videos/rerecord-2026-11-08/evidence-pocketsec.md:5
/pocketsec/Recorded 2026-11-08 on the demo profile. The scorecard in the video shows 63; the site shows 56/100 on our own rubric (2026-11-08). The device check on a real device, the breach lookup and the PDF report were not run. The AUTO-5 menu wording is not confirmed on a real Chrome for Android or Android 16.scorecards/pocketsec.json:79
/pocketsec/Re-recorded 2026-11-08 against pocketsec main af82be6; shows #88 AUTO-5 menu wording and #65 shorter habit summaries on the demo profile; the unmeasured 'sixty seconds' narration is now attributed to the button label; the changelog gap line is removed. Captions aligned and checked (worst cue 0.05 s); frame scan no hits. Re-encoded 2026-11-08.videos/rerecord-2026-11-08/evidence-pocketsec.md:5
/pocketsec/Shield Score + grade; demo = 66/C (CLAUDE.md claim)scorecards/pocketsec.json:7
/pocketsec/Static site builds and prerendersscorecards/pocketsec.json:43
/pocketsec/Live site reachablescorecards/pocketsec.json:49
/pocketsec/The web device check (AUTO-1..5), the habits audit (HAB-1..6), the password check and the PDF report have no test or proof log on the main branch; the web test suite and browser run of 2026-11-01 are on a branch that is not mergedscorecards/pocketsec.json:76
/pocketsec/Shield Score, the build and the live site are each half credit: a recorded run exists, but no proof log for them is on mainscorecards/pocketsec.json:77
/pocketsec/What leaves the device is not yet traced: no network capture is on main; the README on main says a no-transmission claim for the password and the page says '60-Second Security Scan' (not measured)scorecards/pocketsec.json:78
/pocketsec/AUTO-5 menu-path wording changed (#88), but its check script does not pass on Android and no log is committedscorecards/pocketsec.json:79
/pocketsec/No TWA or AAB; assetlinks.json still holds REPLACE_WITH_ placeholders; the Play 12x14 closed-test rule appliesscorecards/pocketsec.json:80
/pocketsec/LICENSE.md is PolyForm Noncommercial while the plan says All rights reserved - mismatch unresolvedscorecards/pocketsec.json:81
/pocketsec/No CSP header; no privacy page on main; contrast, keyboard and TalkBack not checked; dark theme is fixed with no light modescorecards/pocketsec.json:82
/pocketsec/Native fix-text Settings paths: 4 of 5 found on a stock Android 36 emulator, 1 not found (Software update), exit 1 (proof/native-fix-paths.log, 2026-11-08T06:14:48Z); not a phonescorecards/pocketsec.json:83
/pocketsec/CHANGELOG.md on main still says there are no release tags (tags v0.1.0 to v0.5.0 exist); package.json says 0.1.0scorecards/pocketsec.json:84
/pocketsec/Web code has no test script in package.json; the only test run on main is the 43 native engine tests, on a Linux JVM, not a phonescorecards/pocketsec.json:85
/pocketsec/2026-11-08: Native password-check copy now names the host it contacts (api.pwnedpasswords.com) and says the check shows your IP address to Have I Been Pwned; 4 source-reading tests added, 43 native tests pass on a JVM (#44). A run recorded that the habit-fix third-party phrases match six vendor pages, 6 of 6 (#43). A run on a stock Android 36 emulator found 4 of 5 native Settings paths; one not found, run exited 1 (#51). Release v0.5.0.scorecards/pocketsec.json:119
/pocketsec/2026-11-08: Two sentences no source backs were dropped from the habit summaries and the web password text, web and native (#62). Release v0.5.0.scorecards/pocketsec.json:120
/pocketsec/2026-11-08: Notes only: FOUND.md and LEARNINGS.md additions (#40). No app change.scorecards/pocketsec.json:121
/pocketsec/2026-11-08: Menu paths in the device-check fix steps now match the screens on Chrome for Android and Android 16, and a script to check them was added (#88). The script's Android step does not pass yet and no log is committed. Release v0.4.0.scorecards/pocketsec.json:122
/pocketsec/2026-11-08: Three long sentences in the habits summaries were split, web and native; punctuation only (#65). Release v0.4.0.scorecards/pocketsec.json:123
/pocketsec/2026-11-08: CI now runs on the self-hosted runner (#96); the CI run at 698dc92 passed lint and build (run 42482618888). Release v0.4.0.scorecards/pocketsec.json:124
/pocketsec/2026-11-07: The 39 native Android engine unit tests pass on a Linux JVM (logged; not run on a phone). The native README credits ShipItWorks and the public support address, a CHANGELOG was added, and the CI actions are pinned to commit SHAs. Release v0.3.0.scorecards/pocketsec.json:125
/plainspoken/You type what you want; it rewrites a prompt an AI understands, then explains changes.scorecards/plainspoken.json:84
/plainspoken/Score 67 of 100scorecards/plainspoken.json:73
/plainspoken/Stage: Beta on our own rubricscorecards/plainspoken.json:74
/plainspoken/Scored 2026-11-08scorecards/plainspoken.json:87
/plainspoken/commit 847a36dscorecards/plainspoken.json:3
/plainspoken/Google Play: Web onlyscorecards/plainspoken.json:74
/plainspoken/Primary journey: not shownscorecards/plainspoken.json:6
/plainspoken/transcript/Screen recording of Plainspoken, 1:40, file dated 2026-11-05. The voice is AI-generated (ElevenLabs) and the data on screen is made upsite/videos.json:106
/plainspoken/transcript/Audio loudness adjusted on 2026-11-05. Re-encoded on 2026-11-05 for faster seeking. Wording and picture content unchanged.docs/video-quality-2026-11-05.md:185
/plainspoken/Audio loudness adjusted on 2026-11-05. Re-encoded on 2026-11-05 for faster seeking. Wording and picture content unchanged.docs/video-quality-2026-11-05.md:185
/plainspoken/Prompt validation (3-2000 chars, intent hint)scorecards/plainspoken.json:13
/plainspoken/Rewrite via OpenRouter claude-haiku-4.5 with zdr + data_collection denyscorecards/plainspoken.json:7
/plainspoken/Rate limit 15/hour/IPscorecards/plainspoken.json:25
/plainspoken/Fill-in blanks + free self-checkscorecards/plainspoken.json:31
/plainspoken/Lessons (/learn, 9 paths) with sourcesscorecards/plainspoken.json:37
/plainspoken/e2e not run here (missing Chromium build); the live OpenRouter rewrite path and the live site have not been seen workingscorecards/plainspoken.json:76
/plainspoken/No dark mode; two token pairs measure under 4.5:1 by arithmetic (ink-faint on desk 2.88, pen links 3.98), not yet fixedscorecards/plainspoken.json:77
/plainspoken/Rate limit is per server instance (in-memory, lost on restart), so it is weak on serverlessscorecards/plainspoken.json:78
/plainspoken/.env.example is stale: it describes per-intent routing and a per-rewrite cost the README says was removed 2026-10-01scorecards/plainspoken.json:79
/plainspoken/No proof log for any feature on the main branch; five of seven are tested with sample data only, so they score halfscorecards/plainspoken.json:80
/plainspoken/64 open PRs (numbers 6 to 71, gh pr list 2026-11-08) are open and not merged to main; the privacy page, changelog and four test files from the audited branch are not on mainscorecards/plainspoken.json:81
/plainspoken/The repo is private (gh api 2026-11-08), so the live site and the source link cannot be checked by a visitor from this packet; privacy lines stay not yet traced (the full prompt goes to OpenRouter by design)scorecards/plainspoken.json:82
/plainspoken/2026-11-08: Re-scored against main (847a36d, tag v0.2.0): 67/100 on our own rubric, down from 75. Feature points now follow the proof rule: 25 points over 7 features, half for tested with sample data, none have a proof log on main. Tests on main are 50 passing (CI run 42485460787), not the 70 measured on an unmerged branch.scorecards/plainspoken.json:118
/plainspoken/2026-11-08: PR #64 merged: CI runs on the self-hosted runner; run 42485460787 on main is green. Tag v0.2.0. The build lane's open PRs (6 to 71) are not merged and earn nothing here.scorecards/plainspoken.json:119
/graph-app/Give your AI coding assistant a map of your code.scorecards/graph-app.json:85
/graph-app/Score 64 of 100scorecards/graph-app.json:67
/graph-app/Stage: Beta on our own rubricscorecards/graph-app.json:69
/graph-app/Scored 2026-11-08scorecards/graph-app.json:87
/graph-app/commit daaacbfscorecards/graph-app.json:3
/graph-app/Google Play: No Android appscorecards/graph-app.json:69
/graph-app/Primary journey: not shownscorecards/graph-app.json:6
/graph-app/transcript/Screen recording of graph-app, 1:50, file dated 2026-11-05. The voice is AI-generated (ElevenLabs) and the data on screen is made upsite/videos.json:29
/graph-app/transcript/Audio loudness adjusted on 2026-11-05. Re-encoded on 2026-11-05 for faster seeking. Wording and picture content unchanged.docs/video-quality-2026-11-05.md:185
/graph-app/Audio loudness adjusted on 2026-11-05. Re-encoded on 2026-11-05 for faster seeking. Wording and picture content unchanged.docs/video-quality-2026-11-05.md:185
/graph-app/Engine: parse Python/TS/JS into symbol+call graphscorecards/graph-app.json:7
/graph-app/API + job queue + indexing workerscorecards/graph-app.json:19
/graph-app/MCP endpoint for assistantsscorecards/graph-app.json:25
/graph-app/Benchmarks vs other engine (5 repos)scorecards/graph-app.json:37
/graph-app/Supabase auth (GitHub sign-in)scorecards/graph-app.json:43
/graph-app/Half the suite did not execute in the 2026-11-01 audit: 107 of 212 tests skipped because no Postgres was started for TEST_ADMIN_URL. A 2026-11-07 log shows 218 passed with Postgres up, from a dirty tree with no exit code; no clean run of main is recordedscorecards/graph-app.json:75
/graph-app/Not deployed; no live URL. Web app not tested yet: browser e2e and real GitHub sign-in not runscorecards/graph-app.json:76
/graph-app/MCP endpoint run with the official SDK client on a local stack only; not run from an AI assistantscorecards/graph-app.json:77
/graph-app/Benchmarks: 3 of 5 repos (click, marshmallow, toolz) re-scored from saved traces on 2026-11-07, self-run; the tests were not re-run to record new traces, the other engine was not re-run, toolz drove development, TypeScript repos not re-scoredscorecards/graph-app.json:78
/graph-app/The references tool's completeness has not been measured (README 'Not done yet')scorecards/graph-app.json:79
/graph-app/Network egress not yet traced: where data goes is read from code, not capturedscorecards/graph-app.json:80
/graph-app/No LICENSE and no CHANGELOG on main; source not published, licence not chosen (README)scorecards/graph-app.json:81
/graph-app/CI result on GitHub main not checked; the CI workflow moved to a self-hosted runner on 2026-11-08 (PR #21) and no run result is recordedscorecards/graph-app.json:82
/graph-app/Working copy ~/graph-app has uncommitted changes and a .env; the audited clone is cleanscorecards/graph-app.json:83
/graph-app/2026-11-08: Rescored under the per-feature rule against main daaacbf (tag v0.4.1): six features share the 25 feature points equally. The MCP endpoint is Proven locally (official SDK client, exit 0; not run from an AI assistant); engine, API, benchmarks and auth are tested with sample data; the web app is not tested yet (lint and build only). 64/100 on our own rubric, down from 67.scorecards/graph-app.json:117
/graph-app/2026-11-08: Benchmark misses for toolz added and the three-repo misses list published (PR #12, tag v0.4.1; PR #11, tag v0.4.0). Saved traces re-scored; tests not re-run; self-run.scorecards/graph-app.json:118
/graph-app/2026-11-08: CI workflow now runs on the self-hosted runner (PR #21, merged after tag v0.4.0, included in v0.4.1). No run result checked.scorecards/graph-app.json:119
/graph-app/2026-11-08: README now says where data goes and lists what is not done; its test count is dated and the benchmark table matches the saved reports (PRs #1, #6, #9; tags v0.3.0, v0.4.0). Network egress not yet traced.scorecards/graph-app.json:120
/graph-app/2026-11-08: MCP impact no longer fails on a hub symbol (lists cut to fit; PRs #4, #5; tag v0.1.0). MCP endpoint run end to end with the official SDK client on a local stack (PR #7, v0.1.1); references tool added (PR #8, v0.2.0).scorecards/graph-app.json:121
/graph-app/2026-11-07: A references tool was added to the MCP endpoint: it lists every call site of a symbol with exact totals. Built; run once against a local stack with the MCP Python SDK (one symbol, total 3, matching grep); not deployed and not run from an AI assistant.scorecards/graph-app.json:122
/graph-app/2026-11-07: The README now says where data goes and what is not done, drops an unproven absolute, and matches its measured-results table to the saved reports. The click and marshmallow benchmark numbers were reproduced by re-scoring saved runtime traces (the tests were not re-run), and the engine's misses are listed. Network egress is not yet traced. Release v0.4.0.scorecards/graph-app.json:123
/graphsmith/A design-time environment for graph-based AI and automation workflows.scorecards/graphsmith.json:62
/graphsmith/Score 82 of 100scorecards/graphsmith.json:49
/graphsmith/Stage: Beta on our own rubricscorecards/graphsmith.json:50
/graphsmith/Scored 2026-11-08scorecards/graphsmith.json:63
/graphsmith/commit b9aca48scorecards/graphsmith.json:3
/graphsmith/Google Play: Web onlyscorecards/graphsmith.json:50
/graphsmith/Primary journey: shown with sample datascorecards/graphsmith.json:6
/graphsmith/transcript/Screen recording of Graphsmith, 2:10, file dated 2026-11-08. The voice is AI-generated (ElevenLabs) and the data on screen is made upsite/videos.json:41
/graphsmith/transcript/Recorded 2026-11-08. The scorecard in the video shows 67; the site shows 82/100 on our own rubric (2026-11-08, per-feature rule D32). The phone-size fix (#28) is not shown.scorecards/graphsmith.json:65
/graphsmith/transcript/Re-recorded 2026-11-08 against graphsmith main b9aca48; adds the State tab tagging a reviewer decision chosen in Evaluate as user, not mocked (#66), shows the readiness coverage tiles (#75), and the score, how-checked and gaps cards are reworded (score 67 as published, newer audit pending). The phone-size tab row fix (#28) is not shown. Voice is AI-generated (ElevenLabs). Captions timed by forced alignment, 24 cues, worst cue 0.1 s from speech; frame scan found no keys, addresses or paths.videos/rerecord-2026-11-08/evidence-graphsmith.md:5
/graphsmith/Recorded 2026-11-08. The scorecard in the video shows 67; the site shows 82/100 on our own rubric (2026-11-08, per-feature rule D32). The phone-size fix (#28) is not shown.scorecards/graphsmith.json:65
/graphsmith/Re-recorded 2026-11-08 against graphsmith main b9aca48; adds the State tab tagging a reviewer decision chosen in Evaluate as user, not mocked (#66), shows the readiness coverage tiles (#75), and the score, how-checked and gaps cards are reworded (score 67 as published, newer audit pending). The phone-size tab row fix (#28) is not shown. Voice is AI-generated (ElevenLabs). Captions timed by forced alignment, 24 cues, worst cue 0.1 s from speech; frame scan found no keys, addresses or paths.videos/rerecord-2026-11-08/evidence-graphsmith.md:5
/graphsmith/Simulator, lint/readiness, export, share encoding, drafter (domain logic)scorecards/graphsmith.json:7
/graphsmith/Graph canvas, inspector, outline, tabs UIscorecards/graphsmith.json:19
/graphsmith/Live demo graphsmith.devscorecards/graphsmith.json:25
/graphsmith/Headless Chrome checks (check:ui 14/14, check:display 42/42) ran on one machine on 2026-11-07 and 2026-11-08; the read-only share view and other browsers are not covered, and no screen reader has been runscorecards/graphsmith.json:52
/graphsmith/graphsmith.dev was fetched once on 2026-11-07 and served the build checked then; a 2026-11-08 check:display run against it failed 4 of 42 (phone tab row), fixed on main in PR #28. Whether the live site serves b9aca48 is not yet traced; uptime was not measuredscorecards/graphsmith.json:53
/graphsmith/A request capture of one journey on graphsmith.dev (2026-11-07) saw 0 requests after load and 3 during load; it does not cover browser extensions or other browsersscorecards/graphsmith.json:54
/graphsmith/npm audit ran from an offline cache, so the 0-vulnerability result is not independently confirmedscorecards/graphsmith.json:55
/graphsmith/A privacy page exists (#/privacy) and its network, storage and redaction sentences are pinned to the app code by tests; whether it meets a legal privacy-policy requirement was not checkedscorecards/graphsmith.json:56
/graphsmith/CI on main head b9aca48 was queued, not green, when checked on 2026-11-08; last green run is 8b83b34scorecards/graphsmith.json:57
/graphsmith/package.json says 0.1.0 while the release tag is v0.4.0scorecards/graphsmith.json:58
/graphsmith/The independent proof pack (proof/proof-pack.json) is from 7c913f0 on 2026-11-02 with verdict STOP; its share-link defect is fixed by PR #20, but the pack was not regenerated, so test counts (153) are from that audit, not from b9aca48scorecards/graphsmith.json:59
/graphsmith/Proof logs cite the commit they ran on; except the three feature logs (bfa6b4d) those commits are branch tips replaced by squash merges, so they cannot be opened in main's historyscorecards/graphsmith.json:60
/graphsmith/2026-11-08: Release v0.4.0 on main head b9aca48. CI moved to the self-hosted runner (PR #107). Recorded browser run of the readiness report, coverage, State map, decision rules and connections: 28/28 on three templates, the control fails (PR #75, proof/readiness-state.log). Lane notes added to FOUND.md (PR #31).scorecards/graphsmith.json:94
/graphsmith/2026-11-08: Recorded runs for the three scorecard features: domain logic 107 tests, workspace UI 14/14, live demo build match (PR #8); network capture on graphsmith.dev, 0 requests after load, typed text in no request (PR #7). The three features are now Proven.scorecards/graphsmith.json:95
/graphsmith/2026-11-08: Phone-size workspace tab row now wraps; a new check runs every route at phone size and in dark mode, 42/42 (PR #28).scorecards/graphsmith.json:96
/graphsmith/2026-11-08: The State tab tags a reviewer decision chosen in Evaluate as user, not mocked, and the second-visit auto-approval as generated; the tab's note explains all four tags (PR #66).scorecards/graphsmith.json:97
/graphsmith/2026-11-08: Share links cap rules at 20 per decision and 400 in all, and clip quoted decision text to 80 characters (PR #20). Readiness checks carry the NIST AI RMF 1.0 subcategory each relates to; the mapping is a judgement, not measured (PR #21).scorecards/graphsmith.json:98
/graphsmith/2026-11-08: Privacy page and in-app copy pinned to the code: network and storage sentences (PR #10), the three page-load requests (PR #12), exclude fields removed not replaced (PR #27, PR #29); landing page templates and checks lines (PR #9, PR #26).scorecards/graphsmith.json:99
/graphsmith/2026-11-07: The readiness checks are tagged with the NIST AI RMF 1.0 subcategory each relates to (the subcategory text is quoted from NIST; which subcategory a check relates to is a judgement, not measured). Share links now cap rules and clip quoted decision text, fixing a defect found in the proof pack, and the export label, share toast and Privacy page say that exclude fields are removed from scenarios, not replaced. The Privacy page lists the three requests a browser makes at load.scorecards/graphsmith.json:100
/graphsmith/2026-11-07: A new check runs every route at phone size and in dark mode, and fixed a phone tab-row overflow. Recorded runs on one machine in headless Chrome: canvas, inspector, outline and tabs; no off-site request in the demo journey; the live demo served the build checked then; unit tests for simulator, lint, export, share and drafter. Release v0.3.0.scorecards/graphsmith.json:101
/apps/Google Play needs 12 testers for 14 days before an app can go to productionPLAN.md:18
/apps/Audit home Wi-Fi security, discover smart devices, harden your connected home.scorecards/HomeIoTGuardian.json:81
/apps/Score 66 of 100scorecards/HomeIoTGuardian.json:68
/apps/Stage: Beta on our own rubricscorecards/HomeIoTGuardian.json:70
/apps/Scored 2026-11-08scorecards/HomeIoTGuardian.json:82
/apps/commit 88fea44scorecards/HomeIoTGuardian.json:3
/apps/Google Play: Not on Playscorecards/HomeIoTGuardian.json:66
/apps/Primary journey: not shownscorecards/HomeIoTGuardian.json:6
/apps/HomeIoT Guardian: Google Play: Not on Playscorecards/HomeIoTGuardian.json:66
/apps/Recorded 2026-11-01. The narration says you can export a PDF report; PDF export has not been run on a device yet.scorecards/HomeIoTGuardian.json:25
/apps/Audio loudness adjusted on 2026-11-05. Re-encoded on 2026-11-05 for faster seeking. Wording and picture content unchanged.docs/video-quality-2026-11-05.md:185
/apps/Wi-Fi/router posture, mDNS+SSDP LAN scan, UPnP checkscorecards/HomeIoTGuardian.json:13
/apps/Guided device checks + tasks list + readiness scorescorecards/HomeIoTGuardian.json:7
/apps/JSON backup/restore, data erasescorecards/HomeIoTGuardian.json:31
/apps/Review reminders (WorkManager)scorecards/HomeIoTGuardian.json:37
/apps/Catalog seed + Room migrationscorecards/HomeIoTGuardian.json:43
/apps/No feature has a proof log on main: five are built and tested with sample data on a desktop JVM, one (PDF export) is not tested yetscorecards/HomeIoTGuardian.json:72
/apps/Not run on a phone or a real home network: the mDNS/SSDP scan, the router port check, the PDF render and the notification promptscorecards/HomeIoTGuardian.json:15
/apps/The PDF export attempt on the JVM failed (4 of 4 tests, 2026-11-07); it needs a device or an instrumented testscorecards/HomeIoTGuardian.json:74
/apps/README links proof/unit-tests.log, proof/catalog-counts.log and proof/upnp-fetch-http.log; none of the three is on mainscorecards/HomeIoTGuardian.json:75
/apps/12x14 closed test not started per repo docs; no signed .aab built here (no upload key on this machine)scorecards/HomeIoTGuardian.json:76
/apps/No CHANGELOG and no LICENSE file on main; no user guide beyond the release docs; lintDebug exit 1 on a ByteOrderMark false positive was reported earlier and not re-runscorecards/HomeIoTGuardian.json:67
/apps/TalkBack, contrast and large-font checks not run; no reduced-motion setting in the appscorecards/HomeIoTGuardian.json:78
/apps/Network use not yet traced (no network capture); cleartext traffic is permitted in the base network configscorecards/HomeIoTGuardian.json:79
/apps/Offline-first scam-safety app built around Prevent, Protect, Recover; built so analysis runs on the device (offline use not yet tested).scorecards/scamshield-companion.json:87
/apps/Score 65 of 100scorecards/scamshield-companion.json:74
/apps/commit ff87049scorecards/scamshield-companion.json:3
/apps/Primary journey: shown with sample datascorecards/scamshield-companion.json:6
/apps/ScamShield Companion: Google Play: Not on Playscorecards/scamshield-companion.json:72
/apps/Recorded 2026-11-01. The narration says nothing leaves the device and the header on screen says the app is offline and private. Corrected 2026-11-07: that is not verified. No network capture of the Android app has been run; offline use was run once in the web build with Chrome's emulated offline mode (2026-11-08).scorecards/scamshield-companion.json:83
/apps/Inspect: Scam Message Coach, LinkLens, PausePay enginesscorecards/scamshield-companion.json:7
/apps/Redact: black-box/pixelate + OCR auto-coverscorecards/scamshield-companion.json:25
/apps/Harden: Scorecard, Passphrase Coach, Phish or Legit deckscorecards/scamshield-companion.json:31
/apps/First Aid MA: playbooks, incident logscorecards/scamshield-companion.json:37
/apps/Share-to-app (Android share target / PWA share_target)scorecards/scamshield-companion.json:43
/apps/Offline PWA service workerscorecards/scamshield-companion.json:49
/apps/No signed release .aab; a debug APK was built once (permissions dump only) and no release build has runscorecards/scamshield-companion.json:78
/apps/The QR scanner and the Android share sheet were not run; text recognition (OCR) ran once on one synthetic screenshot and its auto-found boxes were not checked; the redacted-PNG check covers one hand-drawn box in the web build; the money playbook is unit-tested only, its UI not runscorecards/scamshield-companion.json:79
/apps/Play listing copy, screenshots and the data-safety form are still missingscorecards/scamshield-companion.json:80
/apps/No dark mode; contrast, keyboard and TalkBack not checked; comfort text was measured only at an emulated 320px width, not on a phonescorecards/scamshield-companion.json:81
/apps/Offline was run once in the web build with Chrome's emulated offline mode (four tabs and one message analysis); offline OCR, airplane mode on a device and the Android app were not runscorecards/scamshield-companion.json:82
/apps/No network capture of the Android app on a device: "nothing leaves the device" is not yet traced (web build walk and debug-APK manifest only)scorecards/scamshield-companion.json:83
/apps/The PausePay and Phish or Legit advice, card labels and the Massachusetts crypto-kiosk figure on the STOP screen have no expert review or source check on main; money-playbook step wording not checked against FTC or issuer pagesscorecards/scamshield-companion.json:84
/apps/Privacy policy contact is still the placeholder [YOUR CONTACT EMAIL] (PRIVACY_POLICY.md:71)scorecards/scamshield-companion.json:85
/apps/Model AI ROI, P&L margins, Balance Sheet cash flow & 30-day adoption pilots.scorecards/aivalue.json:80
/apps/Score 68 of 100scorecards/aivalue.json:61
/apps/commit 497c725scorecards/aivalue.json:3
/apps/AI Value: Google Play: Not on Playscorecards/aivalue.json:59
/apps/7 financial calculators (FinancialEngine)scorecards/aivalue.json:7
/apps/Catalog + Room database loadscorecards/aivalue.json:19
/apps/JSON backup/restorescorecards/aivalue.json:25
/apps/Executive PDF export: built, not tested yet. No run log on main; the instrumented test needs a device and a fresh installDebugAndroidTest, and the device check in HANDOFF.md has no saved log. The multi-page fix is on an unmerged PRscorecards/aivalue.json:74
/apps/UI screens: not tested yet; no instrumented or UI run, no tracked screenshotsscorecards/aivalue.json:75
/apps/Privacy: no permissions declared in the debug APK and no analytics library by name in release dependencies (2026-11-07 logs); no network capture, so runtime behaviour is not yet traced. README line 3 'runs entirely on the phone' is not yet traced either (fix PR #23 open)scorecards/aivalue.json:76
/apps/No signed release build and assembleRelease not run; the existing release APK is debug-key signed, so it cannot go to Playscorecards/aivalue.json:77
/apps/No user guide, no LICENSE, no CHANGELOG file; root still holds ~20 stray chat-dump files and wrong-path duplicate catalog JSONsscorecards/aivalue.json:78
/apps/Find out how hackable you are. The scan runs in your browser; what leaves the device is not yet traced (the password check sends a 5-character hash prefix to Have I Been Pwned).scorecards/pocketsec.json:87
/apps/Score 56 of 100scorecards/pocketsec.json:73
/apps/Stage: Alpha on our own rubricscorecards/pocketsec.json:74
/apps/commit af82be6scorecards/pocketsec.json:3
/apps/Google Play: No Android appscorecards/pocketsec.json:74
/apps/PocketSec: Google Play: No Android appscorecards/pocketsec.json:74
/apps/Recorded 2026-11-08 on the demo profile. The scorecard in the video shows 63; the site shows 56/100 on our own rubric (2026-11-08). The device check on a real device, the breach lookup and the PDF report were not run. The AUTO-5 menu wording is not confirmed on a real Chrome for Android or Android 16.scorecards/pocketsec.json:79
/apps/Re-recorded 2026-11-08 against pocketsec main af82be6; shows #88 AUTO-5 menu wording and #65 shorter habit summaries on the demo profile; the unmeasured 'sixty seconds' narration is now attributed to the button label; the changelog gap line is removed. Captions aligned and checked (worst cue 0.05 s); frame scan no hits. Re-encoded 2026-11-08.videos/rerecord-2026-11-08/evidence-pocketsec.md:5
/apps/Shield Score + grade; demo = 66/C (CLAUDE.md claim)scorecards/pocketsec.json:7
/apps/Static site builds and prerendersscorecards/pocketsec.json:43
/apps/Live site reachablescorecards/pocketsec.json:49
/apps/The web device check (AUTO-1..5), the habits audit (HAB-1..6), the password check and the PDF report have no test or proof log on the main branch; the web test suite and browser run of 2026-11-01 are on a branch that is not mergedscorecards/pocketsec.json:76
/apps/Shield Score, the build and the live site are each half credit: a recorded run exists, but no proof log for them is on mainscorecards/pocketsec.json:77
/apps/What leaves the device is not yet traced: no network capture is on main; the README on main says a no-transmission claim for the password and the page says '60-Second Security Scan' (not measured)scorecards/pocketsec.json:78
/apps/AUTO-5 menu-path wording changed (#88), but its check script does not pass on Android and no log is committedscorecards/pocketsec.json:79
/apps/No TWA or AAB; assetlinks.json still holds REPLACE_WITH_ placeholders; the Play 12x14 closed-test rule appliesscorecards/pocketsec.json:80
/apps/LICENSE.md is PolyForm Noncommercial while the plan says All rights reserved - mismatch unresolvedscorecards/pocketsec.json:81
/apps/No CSP header; no privacy page on main; contrast, keyboard and TalkBack not checked; dark theme is fixed with no light modescorecards/pocketsec.json:82
/apps/Native fix-text Settings paths: 4 of 5 found on a stock Android 36 emulator, 1 not found (Software update), exit 1 (proof/native-fix-paths.log, 2026-11-08T06:14:48Z); not a phonescorecards/pocketsec.json:83
/apps/CHANGELOG.md on main still says there are no release tags (tags v0.1.0 to v0.5.0 exist); package.json says 0.1.0scorecards/pocketsec.json:84
/apps/Web code has no test script in package.json; the only test run on main is the 43 native engine tests, on a Linux JVM, not a phonescorecards/pocketsec.json:85
/apps/You type what you want; it rewrites a prompt an AI understands, then explains changes.scorecards/plainspoken.json:84
/apps/Score 67 of 100scorecards/plainspoken.json:73
/apps/commit 847a36dscorecards/plainspoken.json:3
/apps/Google Play: Web onlyscorecards/plainspoken.json:74
/apps/Plainspoken: Google Play: Web onlyscorecards/plainspoken.json:74
/apps/Prompt validation (3-2000 chars, intent hint)scorecards/plainspoken.json:13
/apps/Rewrite via OpenRouter claude-haiku-4.5 with zdr + data_collection denyscorecards/plainspoken.json:7
/apps/Rate limit 15/hour/IPscorecards/plainspoken.json:25
/apps/Fill-in blanks + free self-checkscorecards/plainspoken.json:31
/apps/Lessons (/learn, 9 paths) with sourcesscorecards/plainspoken.json:37
/apps/e2e not run here (missing Chromium build); the live OpenRouter rewrite path and the live site have not been seen workingscorecards/plainspoken.json:76
/apps/No dark mode; two token pairs measure under 4.5:1 by arithmetic (ink-faint on desk 2.88, pen links 3.98), not yet fixedscorecards/plainspoken.json:77
/apps/Rate limit is per server instance (in-memory, lost on restart), so it is weak on serverlessscorecards/plainspoken.json:78
/apps/.env.example is stale: it describes per-intent routing and a per-rewrite cost the README says was removed 2026-10-01scorecards/plainspoken.json:79
/apps/No proof log for any feature on the main branch; five of seven are tested with sample data only, so they score halfscorecards/plainspoken.json:80
/apps/64 open PRs (numbers 6 to 71, gh pr list 2026-11-08) are open and not merged to main; the privacy page, changelog and four test files from the audited branch are not on mainscorecards/plainspoken.json:81
/apps/The repo is private (gh api 2026-11-08), so the live site and the source link cannot be checked by a visitor from this packet; privacy lines stay not yet traced (the full prompt goes to OpenRouter by design)scorecards/plainspoken.json:82
/apps/Give your AI coding assistant a map of your code.scorecards/graph-app.json:85
/apps/Score 64 of 100scorecards/graph-app.json:67
/apps/commit daaacbfscorecards/graph-app.json:3
/apps/graph-app: Google Play: No Android appscorecards/graph-app.json:69
/apps/Engine: parse Python/TS/JS into symbol+call graphscorecards/graph-app.json:7
/apps/API + job queue + indexing workerscorecards/graph-app.json:19
/apps/MCP endpoint for assistantsscorecards/graph-app.json:25
/apps/Benchmarks vs other engine (5 repos)scorecards/graph-app.json:37
/apps/Supabase auth (GitHub sign-in)scorecards/graph-app.json:43
/apps/Half the suite did not execute in the 2026-11-01 audit: 107 of 212 tests skipped because no Postgres was started for TEST_ADMIN_URL. A 2026-11-07 log shows 218 passed with Postgres up, from a dirty tree with no exit code; no clean run of main is recordedscorecards/graph-app.json:75
/apps/Not deployed; no live URL. Web app not tested yet: browser e2e and real GitHub sign-in not runscorecards/graph-app.json:76
/apps/MCP endpoint run with the official SDK client on a local stack only; not run from an AI assistantscorecards/graph-app.json:77
/apps/Benchmarks: 3 of 5 repos (click, marshmallow, toolz) re-scored from saved traces on 2026-11-07, self-run; the tests were not re-run to record new traces, the other engine was not re-run, toolz drove development, TypeScript repos not re-scoredscorecards/graph-app.json:78
/apps/The references tool's completeness has not been measured (README 'Not done yet')scorecards/graph-app.json:79
/apps/Network egress not yet traced: where data goes is read from code, not capturedscorecards/graph-app.json:80
/apps/No LICENSE and no CHANGELOG on main; source not published, licence not chosen (README)scorecards/graph-app.json:81
/apps/CI result on GitHub main not checked; the CI workflow moved to a self-hosted runner on 2026-11-08 (PR #21) and no run result is recordedscorecards/graph-app.json:82
/apps/Working copy ~/graph-app has uncommitted changes and a .env; the audited clone is cleanscorecards/graph-app.json:83
/apps/A design-time environment for graph-based AI and automation workflows.scorecards/graphsmith.json:62
/apps/Score 82 of 100scorecards/graphsmith.json:49
/apps/commit b9aca48scorecards/graphsmith.json:3
/apps/Graphsmith: Google Play: Web onlyscorecards/graphsmith.json:50
/apps/Recorded 2026-11-08. The scorecard in the video shows 67; the site shows 82/100 on our own rubric (2026-11-08, per-feature rule D32). The phone-size fix (#28) is not shown.scorecards/graphsmith.json:65
/apps/Re-recorded 2026-11-08 against graphsmith main b9aca48; adds the State tab tagging a reviewer decision chosen in Evaluate as user, not mocked (#66), shows the readiness coverage tiles (#75), and the score, how-checked and gaps cards are reworded (score 67 as published, newer audit pending). The phone-size tab row fix (#28) is not shown. Voice is AI-generated (ElevenLabs). Captions timed by forced alignment, 24 cues, worst cue 0.1 s from speech; frame scan found no keys, addresses or paths.videos/rerecord-2026-11-08/evidence-graphsmith.md:5
/apps/Simulator, lint/readiness, export, share encoding, drafter (domain logic)scorecards/graphsmith.json:7
/apps/Graph canvas, inspector, outline, tabs UIscorecards/graphsmith.json:19
/apps/Live demo graphsmith.devscorecards/graphsmith.json:25
/apps/Headless Chrome checks (check:ui 14/14, check:display 42/42) ran on one machine on 2026-11-07 and 2026-11-08; the read-only share view and other browsers are not covered, and no screen reader has been runscorecards/graphsmith.json:52
/apps/graphsmith.dev was fetched once on 2026-11-07 and served the build checked then; a 2026-11-08 check:display run against it failed 4 of 42 (phone tab row), fixed on main in PR #28. Whether the live site serves b9aca48 is not yet traced; uptime was not measuredscorecards/graphsmith.json:53
/apps/A request capture of one journey on graphsmith.dev (2026-11-07) saw 0 requests after load and 3 during load; it does not cover browser extensions or other browsersscorecards/graphsmith.json:54
/apps/npm audit ran from an offline cache, so the 0-vulnerability result is not independently confirmedscorecards/graphsmith.json:55
/apps/A privacy page exists (#/privacy) and its network, storage and redaction sentences are pinned to the app code by tests; whether it meets a legal privacy-policy requirement was not checkedscorecards/graphsmith.json:56
/apps/CI on main head b9aca48 was queued, not green, when checked on 2026-11-08; last green run is 8b83b34scorecards/graphsmith.json:57
/apps/package.json says 0.1.0 while the release tag is v0.4.0scorecards/graphsmith.json:58
/apps/The independent proof pack (proof/proof-pack.json) is from 7c913f0 on 2026-11-02 with verdict STOP; its share-link defect is fixed by PR #20, but the pack was not regenerated, so test counts (153) are from that audit, not from b9aca48scorecards/graphsmith.json:59
/apps/Proof logs cite the commit they ran on; except the three feature logs (bfa6b4d) those commits are branch tips replaced by squash merges, so they cannot be opened in main's historyscorecards/graphsmith.json:60
/how-we-score/Core features work end to end: 25 pointsPLAN.md:97
/how-we-score/Tests exist and pass: 15 pointsPLAN.md:98
/how-we-score/Reproducible build/artifact: 15 pointsPLAN.md:99
/how-we-score/Security & privacy: 10 pointsPLAN.md:100
/how-we-score/Docs: 10 pointsPLAN.md:101
/how-we-score/Accessibility & UX: 10 pointsPLAN.md:102
/how-we-score/Distribution readiness: 10 pointsPLAN.md:103
/how-we-score/Ops hygiene: 5 pointsPLAN.md:104
/how-we-score/0 to 24: Pre-alphaPLAN.md:87
/how-we-score/25 to 59: AlphaPLAN.md:88
/how-we-score/60 to 84: BetaPLAN.md:89
/how-we-score/85 to 99: Release candidatePLAN.md:90
/how-we-score/Google Play needs 12 testers for 14 days before an app can go to productionPLAN.md:18
/credits/GPT, by OpenAI: research drafts for AI Consumer Rightsresearch/ai-credits-2026-11-05.md:9
/credits/Gemini, by Google: research drafts for AI Consumer Rightsresearch/ai-credits-2026-11-05.md:10
/credits/Gemini, by Google: used to refine the research for patchownerresearch/ai-credits-2026-11-05.md:11
/credits/Gemini, by Google: used to refine the product critique for Graphsmithresearch/ai-credits-2026-11-05.md:12
/credits/Perplexity: where the research for patchowner beganresearch/ai-credits-2026-11-05.md:13
/credits/Perplexity: research for the product critique for Graphsmithresearch/ai-credits-2026-11-05.md:14
/credits/Other AI models reached through OpenRouter: research drafts for AI Consumer Rights; the chat exports do not record their namesresearch/ai-credits-2026-11-05.md:15
/privacy/Cloudflare, which serves this site, currently adds its own Web Analytics script (from static.cloudflareinsights.com) to each page. We did not add it, and we are switching it offresearch/cloudflare-web-analytics-2026-11-05.md:22
/privacy/Cloudflare's documentation says this script does not store data in your browser and does not read cookies, local storage or session storageresearch/cloudflare-web-analytics-2026-11-05.md:6
/yield/Yield score 70scorecards/yield.json:110
/yield/Yield: 13 not finishedscorecards/yield.json:113
/patchowner/patchowner score 84scorecards/patchowner.json:80
/patchowner/patchowner: 10 not finishedscorecards/patchowner.json:83
/aiconsumerrights/AI Consumer Rights score 78scorecards/aiconsumerrights.org.json:91
/aiconsumerrights/AI Consumer Rights: 8 not finishedscorecards/aiconsumerrights.org.json:103