Home patchowner
patchowner
84 / 100 · Beta on our own rubric · 10 not finished in patchowner
This button opens your email app with the subject already filled in. Your message comes to support@shipitworks.com. There is no form and no database. Privacy notice.
Scorecard
84/ 100
Stage: Beta on our own rubric. Google Play: No Android app.
Primary journey: shown with sample data
Scored 2026-11-08 on our own rubric; repository at commit f82c327.
Recorded 2026-11-08. The scorecard shown in the video reads 83; the site shows 84/100 on our own rubric (2026-11-08). The recording shows the demo inventory only. Re-recorded 2026-11-08 against patchowner main f82c327 (tag v0.3.0); shows the Watch card, the report toolbar Tickets button, the keyboard focus ring and real tabs, the Health tab and the privacy page; replay numbers updated to 104 advisories, 25 notices, 2 suppressed; the gap list no longer says pages lack focus outlines and tab labels. Narration voice is AI-generated (ElevenLabs). Picture re-encoded for fast seeking; captions timed by forced alignment. Voice is AI-generated (ElevenLabs). Shows made-up demo data. Read the transcript.
What we promised, and what we have not finished. We promised one public rubric for every product, a list of what is not finished on every page, and a named source for every number. Most of these products are not finished, and each page says where it stops. Read the rubric or every claim and its source.
Works today
Each line links to the scorecard row that backs it.
- CLI replay of CISA KEV over inventory CSV -> HTML report
- Web upload demo (patchowner serve)
- SSVC deployer tree, default SEI policy, custom --policy CSV
- Matching tiers, suppression, budget, routing
- Health tab (README says ten to twelve checks)
- Action buttons persist state (serve mode JSON; static mode browser storage)
- Interactive policy edit recomputes cards in page
- Live demo patchowner.com
Not finished
From the same scorecard, next to the claims.
- Feature 7 (in-page policy edit) is built, tested with sample data: its browser log on main records '9 ok, 0 failed' but no exit code line; one browser engine; the edited policy CSV does not run with `replay --policy` on main (PR #31 not merged)
- Proof logs for features 1 to 5 and 8 were recorded on 2026-11-08 at the pre-merge commit (base f1da22e plus proof files); code merged after them (PRs #96, #97 matching, #88, #93 Watch card) was not re-recorded. Feature 6 was re-recorded at ab77bb6 code (PR #116)
- patchowner.com is the build of f1da22e: site/index.html is unchanged on main since then, so it has none of the 2026-11-08 changes; site/privacy.html is on main but its deploy was not checked
- Test count on main not measured (README's 97 passed, 4 skipped is dated 2026-10-30); CI on main is green at f82c327 and ab77bb6 but what it ran was not read
- No PyPI release and no installer; running it needs uv
- CLI tests are thin: only the CSV encoding path calls cli.main directly (tests/test_cli_csv_encoding.py:27); proof logs cover the rest by hand
- Browser runs are hand-recorded with Node and Playwright, not run in CI; Safari, a phone and a screen reader not run
- Not tried on an organization's own inventory; one machine's package list was run once (proof/real-software-list.log), where 111 name hits were refused and named; relevance is not measured
- pyproject.toml says 0.1.0 while the tag is v0.3.0; CHANGELOG.md has no 0.2.0 or 0.3.0 section (changes sit under Unreleased)
- certifi PYSEC-2026-4320 unpatched (dev-only, via httpx); a11y open: no skip link, contrast not verified, no screen reader run
What changed
Dated lines from the scorecard. The source code is private, so these lines are the public record.
- 2026-11-08: Action-buttons proof log now states its exit code and was re-recorded at current main (PR #116; tag v0.3.0). Feature 6 is proven; 7 of 8 features proven. 84/100 on our own rubric. CI on main completed success on f82c327 and ab77bb6.
- 2026-11-08: Proof logs merged for the core features (PRs #33, #34, #35, #37, #38, #39, #40, #44, #50; tag v0.2.0). Features 1, 2, 3, 4, 5 and 8 were proven (a log on main with date, commit, command, exit code); features 6 and 7 stayed built, tested with sample data at that point because their logs carried no exit code line. 83/100 on our own rubric.
- 2026-11-08: Fixes to what the report says and does (PRs #36, #53, #54, #60, #65, #66, #67, #69, #70, #72, #74, #77, #78, #79, #84, #85, #86, #88, #90, #92, #93, #47; tag v0.2.0): a refused action is no longer shown as recorded, a CSV asset name no longer runs as script in the Policy tree, keyboard focus ring and real tabs, Reopen on a suppressed notice, a bad download keeps the saved catalog.
- 2026-11-08: Matching and output changes (PRs #48 Tickets button saves open notices as a CSV, #51 upload-form labels, #95 long warning lists fold, #96 and #97 a name inside another word is likely, not exact, and a row with no vendor no longer matches inside a word; tag v0.2.0). The proof logs were recorded before #96 and #97 and were not re-run.
- 2026-11-08: Docs and housekeeping on main (PRs #32 README says ten to twelve Health checks, #99 privacy page site/privacy.html, #100 CHANGELOG.md, #107 CI on a self-hosted runner; tag v0.2.0). patchowner.com is not rebuilt; its page is still the build of f1da22e.
- 2026-11-07: Corrected the one-line description. It said "Only verified, relevant, actionable ... notices"; no measure of relevance exists and the run covers a sample inventory only. The line now says what ran and the stage.
The next step for patchowner.
Email us about patchowner