agtmls-scorecard 0.0.3__py3-none-any.whl

agtmls_scorecard/__init__.py

@@ -0,0 +1,5 @@
+# SPDX-FileCopyrightText: 2026 Sebastien Rousseau
+# SPDX-License-Identifier: Apache-2.0 OR MIT
+"""Score a repository against the AgtMLS rubric, honestly."""
+
+__version__ = "0.0.3"

agtmls_scorecard/__main__.py

@@ -0,0 +1,10 @@
+# SPDX-FileCopyrightText: 2026 Sebastien Rousseau
+# SPDX-License-Identifier: Apache-2.0 OR MIT
+"""Allow `python -m agtmls_scorecard`."""
+
+import sys
+
+from agtmls_scorecard.cli import main
+
+if __name__ == "__main__":
+    sys.exit(main())

agtmls_scorecard/checks/__init__.py

@@ -0,0 +1,68 @@
+# SPDX-FileCopyrightText: 2026 Sebastien Rousseau
+# SPDX-License-Identifier: Apache-2.0 OR MIT
+"""The ten categories of the rubric.
+
+All ten are implemented. Four of them -- performance, developer experience,
+observability and interoperability -- were whole-category placeholders until
+now, which meant the tool reported 0.0 at zero coverage for 40 of the 100
+criteria. That was honest, and it was also the reason a repository could read
+9.3/10 while nothing had ever checked whether it was fast, diagnosable,
+scriptable or conformant.
+
+Implementing them is expected to *lower* published scores, because criteria
+that were invisible become criteria that can fail. A number that only ever
+moves up is not measuring anything.
+
+PENDING is kept, empty, on purpose: it is the mechanism for declaring a
+category nobody has written a checker for, and deleting it would make the next
+omission silent instead of counted.
+"""
+
+from __future__ import annotations
+
+from ..model import CategoryReport, Result, Status
+from ..repo import Repo
+from . import (
+    correctness,
+    documentation,
+    dx,
+    governance,
+    interoperability,
+    maintainability,
+    observability,
+    performance,
+    release,
+    security,
+)
+
+IMPLEMENTED = [
+    ("correctness", correctness),
+    ("security", security),
+    ("performance", performance),
+    ("dx", dx),
+    ("documentation", documentation),
+    ("observability", observability),
+    ("release", release),
+    ("interoperability", interoperability),
+    ("maintainability", maintainability),
+    ("governance", governance),
+]
+
+#: (id, title, why no checker exists yet)
+PENDING: list[tuple[str, str, str]] = []
+
+
+def evaluate(repo: Repo) -> list[CategoryReport]:
+    reports = [
+        CategoryReport(id=identifier, title=module.TITLE, results=module.run(repo))
+        for identifier, module in IMPLEMENTED
+    ]
+    reports.extend(
+        CategoryReport(
+            id=identifier,
+            title=title,
+            results=[Result(f"{identifier}.*", f"All of {title}", Status.UNVERIFIED, reason)],
+        )
+        for identifier, title, reason in PENDING
+    )
+    return reports

agtmls_scorecard/checks/correctness.py

@@ -0,0 +1,108 @@
+# SPDX-FileCopyrightText: 2026 Sebastien Rousseau
+# SPDX-License-Identifier: Apache-2.0 OR MIT
+"""Category 1 — Correctness & Test Depth."""
+
+from __future__ import annotations
+
+import re
+
+from ..model import Result, Status
+from ..repo import Repo
+
+TITLE = "Correctness & Test Depth"
+
+#: Backtick spans and string literals. Anything inside one is shown, not done.
+QUOTED = re.compile(r"`[^`]*`|\"[^\"]*\"|'[^']*'")
+
+
+def _tests_exist(repo: Repo) -> Result:
+    candidates = [
+        p for p in repo.files
+        if "test" in p.name.lower() or "tests" in p.relative_to(repo.root).parts
+    ]
+    if not candidates:
+        return Result("1.0", "Tests exist", Status.FAIL, "no test files found")
+    return Result("1.0", "Tests exist", Status.PASS, f"{len(candidates)} test file(s)")
+
+
+def _discovery(repo: Repo) -> Result:
+    """A hand-maintained list of tests is a list someone will forget to update.
+
+    The repository this tool was written for had exactly that: a `CASES` tuple
+    that a new test class had to be added to, or it silently never ran.
+    """
+    offenders: list[str] = []
+    for path in repo.by_suffix(".py"):
+        text = path.read_text(encoding="utf-8", errors="replace")
+        if "unittest" not in text:
+            continue
+        if re.search(r"^CASES\s*=\s*\(", text, re.MULTILINE) and "loadTestsFromModule" not in text:
+            offenders.append(str(path.relative_to(repo.root)))
+    if offenders:
+        return Result("1.3", "Tests are discovered, not hand-registered", Status.FAIL,
+                      f"hand-maintained registry in {offenders[0]}")
+    return Result("1.3", "Tests are discovered, not hand-registered", Status.PASS,
+                  "no hand-maintained test registry")
+
+
+def _no_silent_skips(repo: Repo) -> Result:
+    """A skipped test reports green while proving nothing."""
+    skips: list[str] = []
+    patterns = (
+        re.compile(r"#\[ignore\]"),
+        re.compile(r"@(unittest\.)?skip\b"),
+        # `it.skip(` / `test.skip(` / `describe.skip(` -- not `args.skip(1)`,
+        # which is how you drop argv[0] and not a skipped test at all.
+        re.compile(r"\b(it|test|describe|context)\.(skip|todo)\s*\("),
+        re.compile(r"\btodo!\s*\("),
+    )
+    linked = re.compile(r"(#\d+|issues?/\d+|reason\s*=)")
+    for path in repo.by_suffix(".rs", ".py", ".mjs", ".js", ".ts"):
+        lines = path.read_text(encoding="utf-8", errors="replace").splitlines()
+        for index, line in enumerate(lines):
+            # A marker inside a string or a backtick span is being quoted --
+            # a pattern that defines skip detection, or a fixture. This check
+            # matched its own regex before the strip.
+            bare = QUOTED.sub("", line)
+            if any(p.search(bare) for p in patterns) and not linked.search(bare):
+                skips.append(f"{path.relative_to(repo.root)}:{index + 1}")
+    if skips:
+        return Result("1.6", "No unexplained skipped test", Status.FAIL,
+                      f"{len(skips)}, e.g. {skips[0]}")
+    return Result("1.6", "No unexplained skipped test", Status.PASS, "none")
+
+
+def _matrix(repo: Repo) -> Result:
+    text = repo.workflow_text
+    if not text:
+        return Result("1.9", "CI exercises the declared floor and ceiling", Status.NOT_APPLICABLE,
+                      "no workflows")
+    if "matrix:" in text and re.search(r"(os|python-version|node|toolchain)", text):
+        return Result("1.9", "CI exercises the declared floor and ceiling", Status.PASS,
+                      "a version or platform matrix is configured")
+    return Result("1.9", "CI exercises the declared floor and ceiling", Status.FAIL,
+                  "no matrix: a single configuration proves one configuration")
+
+
+def run(repo: Repo) -> list[Result]:
+    return [
+        _tests_exist(repo),
+        Result("1.1", "Every public entry point is executed by a test", Status.UNVERIFIED,
+               "enumerating entry points and matching them to invocations needs the language's "
+               "own tooling; the repository's dispatch test is the pattern that does it"),
+        Result("1.2", "Coverage of the public surface >= 90%", Status.UNVERIFIED,
+               "needs an instrumented run; no coverage artifact is read here"),
+        _discovery(repo),
+        Result("1.4", "Every fix lands with a test seen to fail first", Status.UNVERIFIED,
+               "would mean replaying each fix commit against its parent; possible, not implemented"),
+        Result("1.5", "Property or fuzz tests for every untrusted parser", Status.UNVERIFIED,
+               "identifying which parsers take untrusted input needs intent"),
+        _no_silent_skips(repo),
+        Result("1.7", "Error paths tested, not only happy paths", Status.UNVERIFIED,
+               "needs branch coverage, not a static read"),
+        Result("1.8", "Golden outputs byte-exact and regenerable", Status.UNVERIFIED,
+               "requires running each generator in --check mode"),
+        _matrix(repo),
+        Result("1.10", "Mutation score >= 70% on core logic", Status.UNVERIFIED,
+               "needs cargo-mutants or mutmut; both are long-running build-environment tools"),
+    ]

agtmls_scorecard/checks/documentation.py

@@ -0,0 +1,110 @@
+# SPDX-FileCopyrightText: 2026 Sebastien Rousseau
+# SPDX-License-Identifier: Apache-2.0 OR MIT
+"""Category 5 — Documentation."""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+from ..model import Result, Status
+from ..repo import Repo
+
+TITLE = "Documentation"
+
+LINK = re.compile(r"\[[^\]]*\]\(([^)#][^)]*)\)")
+#: A target inside a code span is an example of link syntax, not a link. A
+#: target containing `::` is a language path -- Rust intra-doc links are the
+#: common case -- and no file was ever meant to exist there.
+CODE_SPAN = re.compile(r"`[^`]*`")
+
+
+def _adrs(repo: Repo) -> Result:
+    directory = repo.root / "docs" / "adr"
+    records = sorted(directory.glob("[0-9]*.md")) if directory.is_dir() else []
+    if records:
+        return Result("5.3", "Architectural decisions recorded", Status.PASS,
+                      f"{len(records)} ADR(s)")
+    return Result("5.3", "Architectural decisions recorded", Status.FAIL, "no docs/adr")
+
+
+def _links(repo: Repo) -> Result:
+    """Relative links that point at nothing.
+
+    Only local targets: a network check would make the score depend on whether
+    a site was up, which is not a property of the repository.
+    """
+    broken: list[str] = []
+    for path in repo.by_suffix(".md"):
+        text = CODE_SPAN.sub("", path.read_text(encoding="utf-8", errors="replace"))
+        for target in LINK.findall(text):
+            if "::" in target:
+                continue
+            target = target.split("#", 1)[0].strip()
+            if not target or "://" in target or target.startswith("mailto:"):
+                continue
+            # A relative path does not contain a sentence. Markdown prose is
+            # full of bracket-then-paren sequences that are not links at all,
+            # and treating them as broken ones is how a checker earns its
+            # first blanket suppression.
+            if any(c in target for c in " \t") or len(target) > 200:
+                continue
+            resolved = (path.parent / target).resolve()
+            if not resolved.exists():
+                broken.append(f"{path.relative_to(repo.root)} -> {target}")
+    if not broken:
+        return Result("5.5", "No broken local link", Status.PASS, "all local targets resolve")
+    return Result("5.5", "No broken local link", Status.FAIL,
+                  f"{len(broken)}: {broken[0]}")
+
+
+def _readme(repo: Repo) -> Result:
+    text = repo.read("README.md")
+    if not text:
+        return Result("5.6", "README states what, why now, and non-goals", Status.FAIL, "no README.md")
+    lowered = text.lower()
+    has_why = any(k in lowered for k in ("## why", "why this exists", "why now", "# why"))
+    has_limits = any(
+        k in lowered
+        for k in ("not do", "non-goal", "when not to", "will not", "deliberately not", "does not")
+    )
+    if has_why and has_limits:
+        return Result("5.6", "README states what, why now, and non-goals", Status.PASS,
+                      "rationale and boundaries both present")
+    missing = []
+    if not has_why:
+        missing.append("no rationale section")
+    if not has_limits:
+        missing.append("no stated non-goals: a README that lists only capabilities oversells")
+    return Result("5.6", "README states what, why now, and non-goals", Status.FAIL, "; ".join(missing))
+
+
+def _changelog(repo: Repo) -> Result:
+    text = repo.read("CHANGELOG.md")
+    if not text:
+        return Result("5.7", "Changelog maintained", Status.FAIL, "no CHANGELOG.md")
+    if re.search(r"^##\s", text, re.MULTILINE):
+        return Result("5.7", "Changelog maintained", Status.PASS, "has released or unreleased sections")
+    return Result("5.7", "Changelog maintained", Status.FAIL, "no version sections")
+
+
+def run(repo: Repo) -> list[Result]:
+    return [
+        Result("5.1", "Documented commands exist, and commands are documented", Status.UNVERIFIED,
+               "needs the CLI surface; the repository's own surface validator covers this"),
+        Result("5.2", "Every documented example runs in CI", Status.UNVERIFIED,
+               "extracting and executing examples is a per-language job, not a static check"),
+        _adrs(repo),
+        Result("5.4", "Every public symbol documented", Status.UNVERIFIED,
+               "rustdoc and docstring coverage are toolchain jobs; missing_docs in CI covers it"),
+        _links(repo),
+        _readme(repo),
+        _changelog(repo),
+        Result("5.8", "Manpage generated from the same source as --help", Status.UNVERIFIED,
+               "requires running both and diffing; not attempted from a static read"),
+        Result("5.9", "No README claim without an enforcing check", Status.UNVERIFIED,
+               "mapping prose claims to checks needs judgement; it is the review step this "
+               "tool is meant to inform, not replace"),
+        Result("5.10", "Migration guide per breaking change", Status.UNVERIFIED,
+               "needs release history and a definition of breaking that varies by project"),
+    ]

agtmls_scorecard/checks/dx.py

@@ -0,0 +1,224 @@
+# SPDX-FileCopyrightText: 2026 Sebastien Rousseau
+# SPDX-License-Identifier: Apache-2.0 OR MIT
+"""Category 4 — API & Developer Experience.
+
+The previous placeholder said this needed "the CLI surface enumerated and each
+command invoked". Enumerating it does not need invoking it: an argparse
+`add_parser` call and a clap `#[command]` attribute both name a subcommand in
+the source, and a flag either appears beside it or does not.
+
+Invoking every subcommand to read its `--help` would mean executing the
+repository being scored, which is not a thing a scorer should do to an
+arbitrary checkout. So the checks that need execution stay `unverified`, and
+the ones that are a property of the declared surface are decided.
+
+The distinction that matters throughout: a flag existing **somewhere** in the
+repository is not the criterion. `--json` on one subcommand out of thirty-five
+is the state agtmls was actually in, and a check that accepted it would have
+reported developer experience as solved.
+"""
+
+from __future__ import annotations
+
+import re
+
+from ..model import Result, Status
+from ..repo import Repo
+
+TITLE = "API & Developer Experience"
+
+#: How a subcommand is declared, per ecosystem.
+SUBCOMMAND = re.compile(
+    r"""add_parser\(\s*["']([a-z][a-z0-9-]*)["']"""      # argparse
+    r"""|\.subcommand\(\s*Command::new\(\s*["']([a-z][a-z0-9-]*)["']"""  # clap builder
+    r"""|\.command\(\s*["']([a-z][a-z0-9-]*)["']"""      # commander / yargs
+)
+#: Commands that destroy or overwrite something the user did not hand us.
+DESTRUCTIVE = ("install", "uninstall", "remove", "clean", "reset", "sync", "apply",
+               "write", "publish", "delete", "prune", "import")
+EXIT_TAXONOMY = re.compile(r"EXIT_[A-Z_]+\s*=\s*\d|ExitCode::|exit_code|exit-codes")
+#: A remediation names something to do, not only something that is wrong.
+REMEDY = re.compile(r"\brun\b|\buse\b|\bsee\b|\bset\b|\btry\b|\badd\b|\bpass\b|\breinstall\b")
+#: "FAIL: 3 issue(s)" is a tally printed under the errors that already
+#: explained themselves. Asking it to repeat a remedy would make every summary
+#: line worse, so tallies leave the denominator.
+TALLY = re.compile(r"\{[^}]+\}[^\"']{0,40}\(s\)")
+SEMVER_TOOL = re.compile(r"cargo-semver-checks|semver-checks|griffe|api-extractor|apidiff|gorelease")
+COMPLETION_DIRS = ("completions", "completion", "contrib/completions")
+
+
+def _subcommands(repo: Repo) -> dict[str, str]:
+    """Declared subcommand -> the file that declares it."""
+    found: dict[str, str] = {}
+    for path in repo.by_suffix(".py", ".rs", ".js", ".ts"):
+        text = path.read_text(encoding="utf-8", errors="replace")
+        for match in SUBCOMMAND.finditer(text):
+            name = next(g for g in match.groups() if g)
+            found.setdefault(name, str(path.relative_to(repo.root)))
+    return found
+
+
+def _cli_text(repo: Repo) -> str:
+    return "".join(
+        p.read_text(encoding="utf-8", errors="replace")
+        for p in repo.by_suffix(".py", ".rs", ".js", ".ts")
+    )
+
+
+def _no_cli(criterion: str, title: str) -> Result:
+    return Result(criterion, title, Status.NOT_APPLICABLE,
+                  "no subcommand surface was found to hold to this")
+
+
+def _json_coverage(repo: Repo) -> Result:
+    title = "Machine-readable output on the commands that produce data"
+    commands = _subcommands(repo)
+    if not commands:
+        return _no_cli("4.1", title)
+    text = _cli_text(repo)
+    if "--json" not in text and '"json"' not in text:
+        return Result("4.1", title, Status.FAIL,
+                      f"{len(commands)} subcommand(s) and no --json anywhere")
+    # Count the flag against the surface rather than asking whether it exists.
+    flags = len(re.findall(r"--json\b", text))
+    if flags * 2 < len(commands):
+        return Result("4.1", title, Status.FAIL,
+                      f"--json appears {flags} time(s) across {len(commands)} subcommand(s); "
+                      "a flag on a minority of the surface is not a machine interface")
+    return Result("4.1", title, Status.PASS,
+                  f"--json across {flags} of {len(commands)} subcommand(s)")
+
+
+def _dry_run(repo: Repo) -> Result:
+    title = "Destructive commands offer a dry run"
+    commands = _subcommands(repo)
+    if not commands:
+        return _no_cli("4.2", title)
+    destructive = sorted(n for n in commands if any(d in n for d in DESTRUCTIVE))
+    if not destructive:
+        return Result("4.2", title, Status.NOT_APPLICABLE,
+                      "no subcommand named for a destructive action")
+    if "--dry-run" not in _cli_text(repo):
+        return Result("4.2", title, Status.FAIL,
+                      f"destructive subcommand(s) {', '.join(destructive)} with no --dry-run: "
+                      "the only way to find out what happens is for it to happen")
+    return Result("4.2", title, Status.PASS,
+                  f"--dry-run available beside {', '.join(destructive)}")
+
+
+def _refuses_to_clobber(repo: Repo) -> Result:
+    title = "No command overwrites user data without refusing or backing up"
+    commands = _subcommands(repo)
+    if not commands or not any(any(d in n for d in DESTRUCTIVE) for n in commands):
+        return Result("4.3", title, Status.NOT_APPLICABLE, "nothing destructive declared")
+    text = _cli_text(repo)
+    guarded = re.search(r"--force\b", text) and re.search(r"backup|\.bak\b|refus", text, re.IGNORECASE)
+    if not guarded:
+        return Result("4.3", title, Status.FAIL,
+                      "no --force/backup pairing: a destructive command with no refusal "
+                      "path overwrites by default")
+    tested = any(
+        re.search(r"backup|refus|clobber|overwrit", p.read_text(encoding="utf-8", errors="replace"),
+                  re.IGNORECASE)
+        for p in repo.files
+        if "test" in p.name.lower() or "smoke" in p.name.lower()
+    )
+    if not tested:
+        return Result("4.3", title, Status.FAIL,
+                      "a refusal path exists but no test drives it; an untested refusal "
+                      "is the one that stops working quietly")
+    return Result("4.3", title, Status.PASS, "refusal and backup, exercised by a test")
+
+
+def _exit_codes(repo: Repo) -> Result:
+    title = "Exit codes are a documented taxonomy"
+    if repo.kind == "docs" or not repo.has_cli:
+        return Result("4.4", title, Status.NOT_APPLICABLE, "no command to exit")
+    declared = EXIT_TAXONOMY.search(_cli_text(repo))
+    documented = any(
+        re.search(r"exit code", p.read_text(encoding="utf-8", errors="replace"), re.IGNORECASE)
+        for p in repo.by_suffix(".md")
+    )
+    if declared and documented:
+        return Result("4.4", title, Status.PASS, "named exit codes, and documented")
+    if declared:
+        return Result("4.4", title, Status.FAIL,
+                      "exit codes are named in code but documented nowhere, so no caller "
+                      "can branch on them without reading the source")
+    return Result("4.4", title, Status.FAIL,
+                  "0 and 1 by accident: a caller cannot tell 'it failed' from "
+                  "'you typed it wrong'")
+
+
+def _remediation(repo: Repo) -> Result:
+    title = "Error messages name a remediation"
+    messages: list[str] = []
+    for path in repo.by_suffix(".py", ".rs"):
+        text = path.read_text(encoding="utf-8", errors="replace")
+        messages.extend(re.findall(r'["\'](?:FAIL|ERROR|error)[:\s][^"\']{15,}["\']', text))
+    messages = [m for m in messages if not TALLY.search(m)]
+    if len(messages) < 5:
+        return Result("4.5", title, Status.UNVERIFIED,
+                      f"only {len(messages)} error string(s) found; too few to judge a habit")
+    with_remedy = [m for m in messages if REMEDY.search(m)]
+    share = len(with_remedy) / len(messages)
+    if share < 0.4:
+        bare = [m.strip("\"'")[:60] for m in messages if not REMEDY.search(m)][:2]
+        return Result("4.5", title, Status.FAIL,
+                      f"{len(with_remedy)} of {len(messages)} error message(s) suggest an "
+                      f"action; the rest state a problem and stop, e.g. "
+                      + "; ".join(repr(b) for b in bare))
+    return Result("4.5", title, Status.PASS,
+                  f"{len(with_remedy)} of {len(messages)} error message(s) name an action")
+
+
+def _completions(repo: Repo) -> Result:
+    title = "Shell completions are generated, not hand-written"
+    if repo.kind == "docs":
+        return Result("4.6", title, Status.NOT_APPLICABLE, "no executable")
+    present = [d for d in COMPLETION_DIRS if (repo.root / d).is_dir()]
+    if not present:
+        return Result("4.6", title, Status.NOT_APPLICABLE,
+                      "ships no completions; this criterion grades how they are "
+                      "produced, not whether they exist")
+    generator = any(
+        "completion" in p.name.lower() and re.search(r"--check|--write", p.read_text(encoding="utf-8", errors="replace"))
+        for p in repo.by_suffix(".py", ".rs")
+    )
+    if not generator:
+        return Result("4.6", title, Status.FAIL,
+                      f"{present[0]}/ is hand-written: it will drift from the CLI "
+                      "the first time a flag changes")
+    return Result("4.6", title, Status.PASS, f"{present[0]}/ generated with a --check mode")
+
+
+def _semver_gate(repo: Repo) -> Result:
+    title = "Public API changes are gated by a semver-diff tool"
+    if repo.kind == "docs":
+        return Result("4.9", title, Status.NOT_APPLICABLE, "no public API")
+    if SEMVER_TOOL.search(repo.workflow_text):
+        return Result("4.9", title, Status.PASS, "an API-diff tool runs in CI")
+    return Result("4.9", title, Status.FAIL,
+                  "nothing compares the public API between releases, so a breaking "
+                  "change ships as a patch")
+
+
+def run(repo: Repo) -> list[Result]:
+    return [
+        _json_coverage(repo),
+        _dry_run(repo),
+        _refuses_to_clobber(repo),
+        _exit_codes(repo),
+        _remediation(repo),
+        _completions(repo),
+        Result("4.7", "Every subcommand has help with an example", Status.UNVERIFIED,
+               "reading --help means executing the repository under inspection, "
+               "which a scorer should not do to an arbitrary checkout"),
+        Result("4.8", "Config resolution order is documented and tested", Status.UNVERIFIED,
+               "which sources configure a tool, and in what order, is intent this "
+               "tool cannot infer from a source tree"),
+        _semver_gate(repo),
+        Result("4.10", "Install works from a clean machine by every documented path",
+               Status.UNVERIFIED,
+               "needs a container per documented install method"),
+    ]

agtmls_scorecard/checks/governance.py

@@ -0,0 +1,88 @@
+# SPDX-FileCopyrightText: 2026 Sebastien Rousseau
+# SPDX-License-Identifier: Apache-2.0 OR MIT
+"""Category 10 — Governance & Community."""
+
+from __future__ import annotations
+
+import re
+
+from ..model import Result, Status
+from ..repo import Repo
+
+TITLE = "Governance & Community"
+
+REQUIRED = [
+    ("LICENSE", ("LICENSE", "LICENSE.md", "LICENSE-APACHE", "LICENSE-MIT")),
+    ("CODE_OF_CONDUCT", ("CODE_OF_CONDUCT.md",)),
+    ("CONTRIBUTING", ("CONTRIBUTING.md",)),
+    ("SECURITY", ("SECURITY.md",)),
+    ("SUPPORT", ("SUPPORT.md",)),
+]
+
+
+def run(repo: Repo) -> list[Result]:
+    missing = [name for name, candidates in REQUIRED if not repo.exists(*candidates)]
+    files = (
+        Result("10.1", "Community health files present", Status.FAIL, f"missing {', '.join(missing)}")
+        if missing
+        else Result("10.1", "Community health files present", Status.PASS, "all five present")
+    )
+
+    citation = repo.read("CITATION.cff")
+    if citation is None:
+        cff = Result("10.2", "CITATION.cff present and parseable", Status.FAIL, "absent")
+    elif all(key in citation for key in ("cff-version", "title", "authors")):
+        cff = Result("10.2", "CITATION.cff present and parseable", Status.PASS, "required keys present")
+    else:
+        cff = Result("10.2", "CITATION.cff present and parseable", Status.FAIL,
+                     "missing cff-version, title or authors")
+
+    templates = repo.root / ".github"
+    has_issue = (templates / "ISSUE_TEMPLATE").is_dir() or (templates / "issue_template.md").exists()
+    has_pr = any((templates / n).exists() for n in ("PULL_REQUEST_TEMPLATE.md", "pull_request_template.md"))
+    if has_issue and has_pr:
+        tmpl = Result("10.3", "Issue and pull request templates", Status.PASS, "both present")
+    else:
+        absent = [n for n, ok in (("issue", has_issue), ("pull request", has_pr)) if not ok]
+        tmpl = Result("10.3", "Issue and pull request templates", Status.FAIL,
+                      f"no {' or '.join(absent)} template")
+
+    # Dependabot or Renovate: an ecosystem this size cannot be updated by hand.
+    has_bot = repo.exists(".github/dependabot.yml", ".github/dependabot.yaml",
+                          "renovate.json", ".github/renovate.json")
+    updates = (
+        Result("10.7", "Dependency update automation", Status.PASS, "configured")
+        if has_bot
+        else Result("10.7", "Dependency update automation", Status.FAIL,
+                    "no dependabot or renovate config")
+    )
+
+    support = repo.read("SUPPORT.md") or ""
+    window = re.search(r"latest\s+`?\d|supported versions|support window", support, re.IGNORECASE)
+    policy = (
+        Result("10.8", "Stated support window", Status.PASS, "SUPPORT.md states what is supported")
+        if window
+        else Result("10.8", "Stated support window", Status.FAIL,
+                    "SUPPORT.md does not say which versions get fixes")
+    )
+
+    roadmap = repo.exists("ROADMAP.md", "docs/ROADMAP.md", "docs/ECOSYSTEM.md")
+    plan = (
+        Result("10.10", "Public roadmap", Status.PASS, "present")
+        if roadmap
+        else Result("10.10", "Public roadmap", Status.FAIL, "none found")
+    )
+
+    return [
+        files, cff, tmpl,
+        Result("10.4", "Branch protection: signed commits, required checks", Status.UNVERIFIED,
+               "needs the GitHub API and repository admin scope"),
+        Result("10.5", "OpenSSF Scorecard >= 9.0", Status.UNVERIFIED,
+               "needs the Scorecard API; a badge in a README is a claim, not a reading"),
+        Result("10.6", "OpenSSF Baseline level met", Status.UNVERIFIED,
+               "no machine-readable Baseline assertion exists in this repository"),
+        updates, policy,
+        Result("10.9", "Shared reusable CI across the ecosystem", Status.UNVERIFIED,
+               "requires comparing against sibling repositories, which this tool scores one at a time"),
+        plan,
+    ]