Borehole · Risk register · free tier
virgili0/virgilio
Free reading: not for reliance
Borehole badge for virgili0/virgilio
678bd1a · 1,373 commits · 164 files
Issued 2026-10-23

CC-BY-NC-SA-4.0 since 2020-05-03: source available, not open source; commercial use not allowed.

105 checks ran across 6 assessable dimensions. 2 findings are worth checking first. 10 findings, each with evidence. One dimension cannot be assessed without an acquirer.

What matters most
  • 05.60 CC-BY-NC-SA-4.0 since 2020-05-03: source available, not open source; commercial use not allowed
What the repository says about itself
  • 05.66 The licence is CC-BY-NC-SA-4.0: source available, not open source LICENSE:1
  • 05.60 Relicensed: GPL-3.0 → CC-BY-NC-SA-4.0 (2020-05-03) LICENSE.md
Worth checking first

Borehole's proprietary scoring is calibrated across hundreds of repositories. Each finding here reads significant, but its check has not yet held up often enough in that calibration to rate significant on its own. If one holds when someone checks it, it is significant.

  • 02.3 Tests are absent or token
  • 03.5 The contributor who wrote more than half of this has not committed here for more than a year
Published under today's rules. The verification code attests to this reading as it was stored. This page differs from it as follows.
  • Words about people are today's: bands rather than exact shares, dates or day counts, and what the history measured rather than why.
  • 1 finding from checks Borehole's calibration found wrong more often than right is no longer published.
strong adequate significant findings not assessable from a repository
Provenance disclosure does not affect any rating
0% of the code standing today was written in AI-declared commits
0% of lines still in the tree 0 of 72,352 0% of lines ever added these differ when early hand-written code has since been replaced
0/1,247 commits declaring an agent
confidence: moderate
  • 0% of non-merge commits carry any trailer at all
  • low trailer coverage: the convention may not be in consistent use
  • no widespread author/committer date divergence
  • deep scan blamed 159 of 159 counted files
540 lines excluded as lockfiles, vendored or generated.
This is a lower bound. It counts what the repository declares. Undeclared AI authorship is invisible here, and a single rebase removes the trailers this rests on. Absence of a declaration is absence of disclosure, not absence of AI authorship.

Architecture & Codebase — including AI provenance

01 · strong · ratings ↑
A note that does not affect this rating
01.3

Commit messages are templated rather than written

adequate

67% of commit subjects are exact repeats of another subject, and subject length varies by only 15.0 characters. A log written by someone explaining their reasoning to a future reader does not look like this. The log is therefore weak evidence of intent, whatever the code is like.

A note that does not affect this rating: in Borehole's calibration, this check's notes were usually true but overstated.

Evidence
commit-subjects 316× 'Update README.md'
commit-subjects 57× 'Add files via upload'
commit-subjects 34× 'Update DataPreprocessing.md'
Respond to this finding

Your response is published beside the finding, not instead of it. A finding you can argue with is the point — and a wrong one is calibration data we want.

An owner's response is removed only when it is unlawful, impersonates someone, publishes personal data or a credential, or is not about the finding. Disagreeing with the report is never a reason. To report a response, or to reach us about one, write to takedown@borehole.dev.

Engineering Process & SDLC Maturity

02 · adequate · ratings ↑
02.3

Tests are absent or token

adequate worth checking first

0 test files against 22 source files (0.0%). This does not measure whether the tests are good, only whether enough of them exist for the codebase to be changed safely by someone who did not write it — which is exactly the situation after an acquisition.

The check that found this reads significant, but it has not yet held up often enough in Borehole's calibration to rate a finding significant on its own. If it holds when someone checks it, this finding is significant.

Evidence
test-file-ratio 0 test files / 22 source files
Respond to this finding

Your response is published beside the finding, not instead of it. A finding you can argue with is the point — and a wrong one is calibration data we want.

An owner's response is removed only when it is unlawful, impersonates someone, publishes personal data or a credential, or is not about the finding. Disagreeing with the report is never a reason. To report a response, or to reach us about one, write to takedown@borehole.dev.

02.4

Nothing in the history is tagged as a release

adequate

Across 6.6 years of history there is not one tag. There may still be a deployment process, but this repository holds no record of what shipped when — which is the record a buyer needs to reconstruct an incident or a regression after the fact.

Evidence
tag-list 0 tags across 1,373 commits and 2408 days
Respond to this finding

Your response is published beside the finding, not instead of it. A finding you can argue with is the point — and a wrong one is calibration data we want.

An owner's response is removed only when it is unlawful, impersonates someone, publishes personal data or a credential, or is not about the finding. Disagreeing with the report is never a reason. To report a response, or to reach us about one, write to takedown@borehole.dev.

A note that does not affect this rating
02.6

Almost no process scaffolding exists in the repository

adequate

Of five ordinary markers — CI workflows, CODEOWNERS, a pull-request template, pre-commit hooks, contribution guidance — 1 is present: CI workflows. Branch protection itself is a GitHub setting rather than a file, so this is a reading of proxies and not of the rules themselves. What it does establish is that the process is not written down anywhere a new engineer would find it.

A note that does not affect this rating: in Borehole's calibration, this check's notes were usually true but overstated.

Evidence
process-scaffolding 1 of 5 markers present across 164 tracked files
Respond to this finding

Your response is published beside the finding, not instead of it. A finding you can argue with is the point — and a wrong one is calibration data we want.

An owner's response is removed only when it is unlawful, impersonates someone, publishes personal data or a credential, or is not about the finding. Disagreeing with the report is never a reason. To report a response, or to reach us about one, write to takedown@borehole.dev.

Organization & Key-Person Risk

03 · adequate · ratings ↑
03.1

Bus factor 1: the history is concentrated in one contributor

adequate

In the whole history, one contributor authored more than half of 1,247 non-merge commits among 34 authors; across all history, more than half of 1,247. In a project with 34 recent contributors and 7 years of history, that is a question about one person's role rather than a fragile team — but it is the question to ask.

Evidence
git shortlog -sn whole history: top author more than half of 1,247 commits; bus factor 1; 34 authors
Respond to this finding

Your response is published beside the finding, not instead of it. A finding you can argue with is the point — and a wrong one is calibration data we want.

An owner's response is removed only when it is unlawful, impersonates someone, publishes personal data or a credential, or is not about the finding. Disagreeing with the report is never a reason. To report a response, or to reach us about one, write to takedown@borehole.dev.

03.5

The contributor who wrote more than half of this has not committed here for more than a year

adequate worth checking first

One person authored more than half of 1,247 commits and has not committed here for more than a year, while the repository has kept moving. The concentration figure alone would not show this. Whoever is changing this code now is not the person who wrote most of it, which is the situation an acquirer is usually told they are avoiding. The history shows only that no commits of theirs landed here, not why.

The check that found this reads significant, but it has not yet held up often enough in Borehole's calibration to rate a finding significant on its own. If it holds when someone checks it, this finding is significant.

Evidence
last-commit-by-top-author last commit more than a year ago, measured to the survey
git shortlog -sn top author more than half of 1,247 commits
Respond to this finding

Your response is published beside the finding, not instead of it. A finding you can argue with is the point — and a wrong one is calibration data we want.

An owner's response is removed only when it is unlawful, impersonates someone, publishes personal data or a credential, or is not about the finding. Disagreeing with the report is never a reason. To report a response, or to reach us about one, write to takedown@borehole.dev.

Product & Engineering Maturity

04 · not assessable · ratings ↑

Not rated: only 7 of 19 checks could reach a conclusion here; the rest do not apply to this repository or could not read it. The findings below are what it could still read.

A note that does not affect this rating
04.1

Change keeps returning to the same few files

adequate

Five files out of 586 absorb 25% of all file-level change. Concentration like this is where debt is usually being serviced rather than repaid: the same code is reopened because it is load-bearing, fragile, or both. A repository cannot tell you which — that is a conversation with the team.

A note that does not affect this rating: in Borehole's calibration, this check's notes were usually true but overstated.

Evidence
touch-count README.md — 344 commits touched it
touch-count Topics/prerequisites.md — 34 commits touched it
touch-count Topics/frame-the-problem.md — 34 commits touched it
touch-count Specializations/DataPreprocessing.md — 30 commits touched it
touch-count Topics/teaching.md — 30 commits touched it
Respond to this finding

Your response is published beside the finding, not instead of it. A finding you can argue with is the point — and a wrong one is calibration data we want.

An owner's response is removed only when it is unlawful, impersonates someone, publishes personal data or a credential, or is not about the finding. Disagreeing with the report is never a reason. To report a response, or to reach us about one, write to takedown@borehole.dev.

Security & Reliability Posture

05 · adequate · ratings ↑
05.2

None of the standard security guard rails are configured

adequate

There is no disclosure policy, no automated dependency updates, no named code owners and no pre-commit configuration. None of these is load-bearing on its own. Their collective absence says that security posture here is whatever the current team happens to remember to do, which is not a posture that survives the team changing.

Evidence
guardrail-scan checked 5 kinds of guard rail across 164 tracked files; 0 present
Respond to this finding

Your response is published beside the finding, not instead of it. A finding you can argue with is the point — and a wrong one is calibration data we want.

An owner's response is removed only when it is unlawful, impersonates someone, publishes personal data or a credential, or is not about the finding. Disagreeing with the report is never a reason. To report a response, or to reach us about one, write to takedown@borehole.dev.

Notes that do not affect this rating
05.66

The licence is CC-BY-NC-SA-4.0: source available, not open source

adequate

LICENSE grants CC-BY-NC-SA-4.0: source available, not open source; commercial use not allowed. The reading comes from the licence's own title and clauses. Whether the terms fit the buyer's intended use, and whether any paid licence transfers with the code, is a question for counsel and the licensor.

A note that does not affect this rating: it names the project's licence, a fact for the first screen rather than a weakness.

Evidence
LICENSE LICENSE:1 — 437 lines, CC-BY-NC-SA-4.0
Respond to this finding

Your response is published beside the finding, not instead of it. A finding you can argue with is the point — and a wrong one is calibration data we want.

An owner's response is removed only when it is unlawful, impersonates someone, publishes personal data or a credential, or is not about the finding. Disagreeing with the report is never a reason. To report a response, or to reach us about one, write to takedown@borehole.dev.

05.60

Relicensed: GPL-3.0 → CC-BY-NC-SA-4.0 (2020-05-03)

adequate

The root licence changed 1 time(s). The latest terms restrict what users, hosts or a buyer may do in ways the earlier ones did not. Code taken under the old terms stays under them, so both matter in diligence.

A note that does not affect this rating: a licence change is a fact for the first screen, and only a narrowing of rights within two years of the surveyed commit costs "strong".

Evidence
6d1de58de LICENSE.md — GPL-3.0 from 2019-03-24
47341d7b6 LICENSE — CC-BY-NC-SA-4.0 from 2020-05-03
Respond to this finding

Your response is published beside the finding, not instead of it. A finding you can argue with is the point — and a wrong one is calibration data we want.

An owner's response is removed only when it is unlawful, impersonates someone, publishes personal data or a credential, or is not about the finding. Disagreeing with the report is never a reason. To report a response, or to reach us about one, write to takedown@borehole.dev.

Observability & Operations

06 · not assessable · ratings ↑

Not rated: only 5 of 16 checks could reach a conclusion here; the rest do not apply to this repository or could not read it. What a person adds here.

Fit with the Acquirer

07 · not assessable · ratings ↑

Not rated: structurally not assessable from a repository. What a person adds here.

Check it on the running system

3 checks against the running system follow from the findings above: what a buyer's engineer will try, how to run it first, and what to have ready. A paid survey of this repository includes them. See the tiers.

A paid survey of a public repository is also reviewed: a language model reads each finding against the code and withdraws only findings it judges the code contradicts, each listed with its reason. The review is a language model's reading of the findings against the code, and it can be wrong. It never adds a finding, never raises a band, and never removes a finding from a proven check or an advisory that affects the surveyed version.

What a person adds

The survey reads what the repository can show. The code cannot settle these questions, and on them this report states nothing. Each says where its answer lives: your own engineer, the company, or an assessor you choose can settle it. Questions marked measured open with something this repository shows.

Architecture & Codebase — including AI provenance

01 · full coverage
  1. Is the architecture right for the next three years of the product? Answer lives in: Your architects, with the product roadmap01.39
  2. Were the home-grown components reasonable choices when they were made, and are they now? Answer lives in: The team's reasoning at the time01.40

Engineering Process & SDLC Maturity

02 · high coverage
  1. Is review real or a rubber stamp? Comment depth and time to approve need the pull request history. Answer lives in: The code host's pull request data02.32
  2. Is delivery planned and measured, or heroic? Answer lives in: The issue tracker: backlog, sprint history, estimate accuracy02.38
  3. How are incidents run, reviewed and learned from? Answer lives in: Tickets, chat and postmortems02.37

Organization & Key-Person Risk

03 · partial coverage
  1. measured One contributor authored more than half of the commits in this history. Is that person part of the transaction, and for how long after it? Answer lives in: The deal terms03.29
  2. measured Topics/, content/ (nearly all of the files) have not changed in 18 months while the rest of the repository moved. Is that code finished, or abandoned, and who still knows how it works? Answer lives in: The team03.22
  3. Who mentors whom, and would that survive a departure? Answer lives in: The team; review history only suggests candidates03.28
  4. Can the team grow, and who stands behind the top three contributors? Answer lives in: Recruiting data and the org chart03.30
  5. Is the seniority mix sound, and will pay survive your salary bands? Answer lives in: HR data03.31
  6. Is the pace sustainable? Commit times cannot say: git keeps no reliable local time. Answer lives in: Interviews and on-call history03.14
  7. Does the team want to stay after close? Answer lives in: Interviews03.32
  8. How are decisions made and disagreements resolved? Answer lives in: Time with the team03.33

Product & Engineering Maturity

04 · minimal coverage

Not rated: only 7 of 19 checks could reach a conclusion here; the rest do not apply to this repository or could not read it.

  1. measured No experiment tracking is configured in the repository. How was the shipped model trained and evaluated, and could it be reproduced? Answer lives in: The ML team and its run history04.34
  2. measured No model card is in the tree. What is the model's intended use, what was it trained on, and where does it fail? Answer lives in: The ML team04.35
  3. Can this team deliver the stated roadmap on the stated timeline? Answer lives in: The data room and the team's record of estimates04.32
  4. Does leadership know about the debt, and is time budgeted to repay it? Answer lives in: Budget and roadmap decisions04.31
  5. Is the engineering shape consistent with the commercial story? Answer lives in: Revenue, customer and churn data04.33

Security & Reliability Posture

05 · partial coverage
  1. What has actually broken, how often, and how badly? Answer lives in: Ticketing and chat05.41
  2. What did external testing find, and was it fixed? Answer lives in: Reports in the data room05.42
  3. What is the SOC 2, ISO 27001 or GDPR status, and where is the evidence? Answer lives in: Audit reports; policy files in the tree are not evidence05.44

Observability & Operations

06 · partial coverage

Not rated: only 5 of 16 checks could reach a conclusion here; the rest do not apply to this repository or could not read it.

  1. Are the dashboards opened, the alerts acknowledged and the pages answered? Answer lives in: Pager history and dashboard logs06.29
  2. Are the service-level objectives actually met? Answer lives in: Production metrics06.30
  3. Who carries the pager, and how often does it go off? Answer lives in: Pager exports and interviews06.31
  4. What does it cost to run, and how much headroom is there? Answer lives in: Cloud billing and capacity plans06.32

Fit with the Acquirer

07 · none coverage

Not rated: structurally not assessable from a repository.

  1. This is primarily a JavaScript codebase. Does your engineering organisation already run JavaScript in production, or would this be the first? 07.1
  2. The bulk of this system sits in content/, Topics/, Specializations/. Which of your existing systems would each of those have to absorb or replace? 07.10
  3. Nothing in the repository says how this is deployed. Is it shipped as a library, a binary or a service, and if it runs somewhere, who owns that environment? 07.2
  4. What is your tolerance for the findings above remaining unaddressed for the first two quarters after close, given everything else that will compete for this team's time?
  5. Which of these systems duplicate yours, and which get retired? Answer lives in: Your architecture07.11
  6. What will integration cost, and in what order? Answer lives in: The engagement07.12
  7. Where does the team land in your organisation, and who reports to whom? Answer lives in: Your org design07.13
  8. Are there earn-outs, retention packages or contractor IP to assign? Answer lives in: Deal terms07.14
  9. Do customer contracts limit hosting, regions or vendors? Answer lives in: Customer contracts07.15

A human assessment is Borehole's own paid service, €12,000+ (total price is determined per engagement; travel billed at cost). It is not independent of this report: the same business produced both. It is a separate contract, with its own scope, terms and reliance.

Embed the badge

Tied to this commit and this date, and it fades after 90 days — an honest badge is one that expires. A repository with significant findings gets a neutral "read" badge rather than a red one: the library is where the range is visible, not someone else's README.

Borehole badge for virgili0/virgilio
[![Borehole](/badge/virgili0/virgilio.svg "Borehole free reading: not for reliance. See the full report.")](/r/virgili0/virgilio/678bd1a)

If you embed it: link it to the report, remove it if the report is delisted, and do not present it as a certification or an endorsement.

Was this reading useful?
Rejection log — 95 signals that ran and did not fire

Appendix: rejection log — 95 signals that ran and did not fire

Published on purpose. A signal that looked and decided not to fire has told you something, and this is the calibration data behind every threshold above.

Looked, and found nothing — 47

SignalWhat it found
04.debt_markers debt markers are sparsemarkers 0 · per kloc 0.0 · lines read 14,503
04.dependency_sprawl direct dependency counts are unremarkable
04.churn_trend rework is not rising against new worklate delete per insert 0.0 · early delete per insert 0.139
06.telemetry_presence this repository does not deploy a running service, so instrumentation is not expected of itbasis nothing in this repository deploys a long-running server; if it runs as one, its deployment lives elsewhere · files read 111
06.structured_logging not a running service; structured logging is not expected of a librarybasis nothing in this repository deploys a long-running server; if it runs as one, its deployment lives elsewhere
06.healthcheck_presence not a running service, so a health endpoint is not expectedbasis nothing in this repository deploys a long-running server; if it runs as one, its deployment lives elsewhere
06.usage_reporting_default the product's code names no reporting hostsettings on 0 · settings off 0
06.migrate_on_start migrations do not run at container start
03.active_contributors nobody committed in the trailing yearall time 34 · active 12mo 0
03.drive_by_contributors a healthy share of contributors committed more than onceshare 0.529 · authors 34 · one commit authors 18
02.merge_discipline a meaningful share of recent change carries evidence of reviewmerges 126 · window all history · with tracked 0
02.ci_presence CI configuration is present in the working treecount 1
02.conventional_commits commit subjects generally carry contentsampled 1,247 · low content share 0.035
02.ci_test_gating no test run in CI is written so that it cannot failconfigs 1
02.flaky_test_markers tests are not retried until they passtest retries 0 · suite retries 0
01.burst_import no commit run met both the rate and the net-addition thresholdgap seconds 180 · min add ratio 3.0 · min net added 2,000
01.initial_dump first commit is not a disproportionate share of the codebaseinsertions 2 · share of insertions 0.0
01.revision_depth most files were revisited after they were first writtenfiles seen 81 · write once share 0.481
01.duplicated_blocks little shipping code is repeated verbatim across filesshare 0.0 · product files 22 · distinct blocks 1,603
01.swallowed_errors errors are rarely thrown awayloc 14,589 · files 0 · per kloc 0.0
01.unfinished_migration no language migration is stalled halfway
01.notebook_outputs notebooks are committed cleannotebooks 9 · with outputs 1 · stripping configured False
01.weights_in_git no model weights are committedfiles 0
05.committed_secrets no credential-shaped strings outside test and fixture pathsnote the working tree only; the history is 05.5 · patterns 8 · files read 111
05.dependency_pinning dependencies are substantially pinnedunpinned 2
05.license_present a licence file is presentfound True
05.secrets_in_history no credential-shaped string was ever added outside test and fixture pathspatterns 8 · truncated False · added lines 58,964
05.secrets_management_pattern no environment file is committed outside tests and examplesenv files 0
05.supply_chain_pinning third-party build steps are pinned, or fewaction refs 4 · pipe to shell 0 · unpinned third party 0
05.shell_from_strings product code does not build shell commands from stringssites 0
05.unsafe_deserialization no code-executing deserialiser in product codesites 0
05.tls_verification_off no TLS verification is switched off in product codefiles 0 · sites 0 · pinned instead 0
05.privileged_workloads no workload runs privileged or in the host's namespacessites 0 · behind a setting or built here 0
05.credentials_in_deploy_config deployment configuration references secrets, never holds themfiles 0 · sites 0
05.signing_material no signing keystore or profile is committedfiles 0
05.dataset_provenance little data is committeddata files 0 · licence or card files 0
05.license_vendored_unlicensed no vendored third-party code is committedcomponents 0
05.committed_native_libraries no widely used compiled library is committed to the productlibraries 0
04.dependency_churn few dependencies were added and dropped within 60 daysdependencies seen 4 · added in two years 0 · removed within 60 days 0
04.ci_platforms_dropped no platform was dropped from CI in the last two years
04.repository_status the README's first screen states no end, move or freezestatements 0
02.development_elsewhere nothing says development happens elsewhereno pr statements 0 · mirror statements 0 · replayed commit share 0.0
05.paid_edition no directory carries a separate paid-edition licencedirectories 0
03.single_maintainer no file says one person maintains itstatements 0
05.project_advisories no published advisory affects the surveyed versionaffecting 0 · exploited 0 · advisories 0
05.advisory_record no advisory against the project in the last 24 monthscritical 0 · affecting 0 · could not tell 0
05.project_exploited no affecting advisory is on CISA's Known Exploited listexploited 0

Could not conclude, or did not apply — 48

Not a clean result. Each says why it could not answer here.

SignalWhy
04.test_growthnot enough code written in either half to compare
04.eol_runtimeno pinned runtime version to check
04.fixes_with_testsno tests to add to (02.3)
04.fix_share_trendfewer than six busy quarters to compare
04.schema_churnno schema migrations to read
04.compat_layersa library, whose compatibility code is usually deliberate
04.dependency_redundancyno JavaScript manifest to read
06.telemetry_depthnot expected of it: nothing in this repository deploys a long-running server; if it runs as one, its deployment lives elsewhere
06.print_loggingnot expected of it: nothing in this repository deploys a long-running server; if it runs as one, its deployment lives elsewhere
06.correlation_idsnot expected of it: nothing in this repository deploys a long-running server; if it runs as one, its deployment lives elsewhere
06.error_reportingnot expected of it: nothing in this repository deploys a long-running server; if it runs as one, its deployment lives elsewhere
06.alert_rulesnot expected of it: nothing in this repository deploys a long-running server; if it runs as one, its deployment lives elsewhere
06.deployed_image_floatsnot expected of it: nothing in this repository deploys a long-running server; if it runs as one, its deployment lives elsewhere
06.probes_identicalno Kubernetes probes
06.single_replicano Kubernetes deployments
06.environment_branchingnot expected of it: nothing in this repository deploys a long-running server; if it runs as one, its deployment lives elsewhere
06.release_markersnot expected of it: nothing in this repository deploys a long-running server; if it runs as one, its deployment lives elsewhere
06.feature_flagsno feature-flag service; flags may live elsewhere
03.knowledge_silostoo few substantial top-level directories to read ownership
03.critical_path_ownershipa team this small is 03.1's question
03.second_contributor_attritionthe repository itself is quiet
03.bus_factor_trendfewer than three active years to compare
03.joiners_and_leaverstoo few regular contributors to see a trend
02.skipped_teststoo few test files to judge how many are switched off
02.revert_sharetoo few recent commits to judge how often change is undone
02.dependency_update_cadenceno lockfile to date
02.lint_in_buildtoo small, or no CI to wire a linter into (02.2)
02.long_lived_branchestoo few merges to judge (squash and rebase leave none)
02.commit_sizetoo few recent commits
01.oversized_modulestoo few source files to establish a norm to compare against
01.build_reproducibilityno product Dockerfile to read
05.container_runs_as_rootno Dockerfile to read
05.outbound_timeoutsnot a running service
05.migration_reversibilitytoo few migrations to judge
05.sql_from_stringsnot a running service; a library that builds SQL is doing its job
05.resource_limitsno Kubernetes workload manifests
05.known_vulnerabilitiesno lockfile this survey can read, or a collector older than 0.4.0
05.public_env_secretnot a frontend
05.unsafe_htmlnot a frontend
05.source_maps_shippednot a frontend
05.cleartext_trafficnot a mobile app
05.license_copyleft_inheritedno third-party code is committed to this repository, so the licences it depends on are resolved at build time and are not readable here
05.license_manifest_conflictno packaging manifest states a licence
04.flags_accumulatingfew or no feature flags in the history
04.api_versions_coexistingnot a running service
04.deprecations_lingeringa library, which keeps deprecated interfaces for its users
04.releases_stoppedtoo few tagged releases to judge a cadence
04.release_branchtoo few release tags to tell
BOREHOLE READING NOT A CERTIFICATION 0ZYB-R2VG-QJXD 2026-10-23 · 678BD1A BOREHOLE.DEV/VERIFY

Anyone can check this report against the authoritative record — click the stamp, or enter 0ZYB-R2VG-QJXD at borehole.dev/verify.

The code commits to the 106 checks this run performed, the bands they produced, and the commit they were read at. It does not cover checks written since.

Put the mark in your README

The image is wrapped in a link to the verification page, so a reader can check it rather than take it on trust. If you embed it: link it to the report, remove it if the report is delisted, and do not present it as a certification or an endorsement.

[![Borehole reading, not a certification](https://borehole.dev/badge/virgili0/virgilio/678bd1a.svg "Borehole free reading: not for reliance. See the full report.")](https://borehole.dev/verify/0ZYBR2VGQJXD?via=badge)

Borehole reading 0ZYB-R2VG-QJXD, not a certification

Where this scan ran

This scan ran on ordinary cloud infrastructure (cloud-run), not in a hardware-isolated confidential VM. Nothing about it is attested by Google.

What an attested survey proves, and what it does not.

What this scan did with the repository — 7 steps

Written by the steps themselves as they ran, not described afterwards. A hand-written account of a data flow drifts the first time somebody changes the flow and not the account.

AtStepDetail
0.0s read repository metadata from the GitHub API size mb: 33.1authenticated: False
3.2s cloned the repository to a temporary directory depth: full
3.7s read the git history commits: 1373tracked files: 164
10.2s ran the deterministic checks blame pass: Trueread working tree: False
10.2s recorded where this scan ran attested: Falseenvironment: cloud-run
12.7s kept the facts, never the source, for re-reading under new checks
12.7s deleting the working copy

Total 12.7s ·source content sent off this machine: none · calls to a language model: 0 · the clone was deleted when the survey ended

An automated reading of a repository's code and its history up to one commit, with public advisory records. It may be wrong, it is not legal, financial, investment or security advice, and it does not replace diligence by a qualified person. It is provided for information: nobody may rely on it (Borehole's terms, section 3).

BOREHOLE 0.7.15 DETERMINISTIC LAYER · NO MODEL CALLSREAD ON BOREHOLE'S SERVER · CLONE DELETED TAKEDOWNCONTRIBUTED TO THIS REPOSITORY? YOUR RIGHTS