Tests Present
not checked
not_applicable: no test suite detected; recorded honestly, not scored as a failure
- outcome=not_applicable
- derived_has_tests=False
portfolio-verification-checkrun
Boundary
This receipt is not a safety certification, security approval, or live health guarantee. It summarizes the public-safe evidence, checks, exclusions, freshness, and limitations listed below.
Not Checked
Tests Pass
not checked
not_applicable: no detected test suite to run
- outcome=not_applicable
portfolio-verification-checkrun
Ci Present
not checked
not_applicable: no CI workflows detected
- outcome=not_applicable
- derived_has_ci=False
portfolio-verification-checkrun
Ci Green
not checked
not_applicable: CI was not detected
- outcome=not_applicable
portfolio-verification-checkrun
Claims Match
not checked
not_applicable: no mechanically checkable claims found
- outcome=not_applicable
- ledger_count=0
portfolio-verification-checkrun
Liveness
not checked
not_applicable: liveness only applies to web-deploy stack
- outcome=not_applicable
portfolio-verification-checkrun
Passed
License Present
passed
pass: truth data reports a license file
- outcome=pass
- derived_has_license=True
portfolio-verification-checkrun
Evidence
Evidence entries are public-safe references and digests, not raw private reports.
| ID | Title | Kind | Reference | Digest |
|---|---|---|---|---|
| portfolio-verification-checkrun | Portfolio repository verification check-run | json | local-public-safe-input:portfolio-verification-checkrun | f31389ecf4a51814... |
Intentionally Excluded
Local filesystem paths and raw logs
The receipt includes bounded outcomes, counts, and short reasons only.
Secrets and private configuration
The check-run contract excludes credentials, token values, environment dumps, and private config.
Mutable repository state
The runner is read-only for target repositories and does not record unbounded working-tree detail.
Limitations
A receipt is not a certification, approval, or live health guarantee.
External checks depend on local CLI availability, network access, and current provider state.
Claims matching is limited to mechanically checkable README signals in v1.
Passing checks do not prove security posture, maintainability, or release readiness.
Reproduce Or Inspect
Run a bounded portfolio verification check-run.
python3 scripts/portfolio_verify_run.py --repo-id <repo> --repo-path <repo> --repo-full-name <owner/name> --stack <stack> --truth <truth.json> --out <check-run.json>
Generate this receipt.
trust-receipt repo-verify --input <check-run.json>