Maturity baseline: operational (56/100) — 2026-07-11

[cervantesh]

Maturity baseline

Stage: operational
Score: 56/100

The core has a coherent product promise, explicit module boundaries, typed ESM exports, basic examples, a benchmark, and passing CI. It remains early operational software because mutation-critical filesystem and file-kind paths are lightly tested, coverage is low and unenforced, CI is Linux-only, the adapter writes non-atomically, repository security and branch gates are weak, release automation only verifies, and the shipped license/metadata are incomplete.

Dimension	Score
product_clarity	4/5
documentation_onboarding	4/5
architecture_modularity	4/5
testing_ci	2/5
security_configuration	2/5
operations_observability	2/5
release_maintenance	2/5
performance_reliability	3/5
backlog_governance	2/5

Evidence reviewed

• README.md and docs/PRODUCT.md state the exact-or-fail editing promise and success metrics; docs/ARCHITECTURE.md lists modules, flow, and invariants.
• src/index.ts provides one export surface, but src/hashline.ts is approximately 1,200 lines and FilesystemPiClient contains separate fallback edit behavior.
• The assessment run passed all seven tests; node experimental coverage reported 67.84% lines, 61.36% branches, and 75.36% functions, including 16.67% lines for file-kind.js and 33.05% for filesystem-client.js.
• .github/workflows/ci.yml runs Node 22 and 24 only on ubuntu-latest and does not declare least-privilege workflow permissions.
• src/filesystem-client.ts uses writeFile directly and does not call loadFileKindAndText before decoding or rewriting a path.
• Live main protection has no pull-request requirement and no required checks; native security scanning, Dependabot updates, and private vulnerability reporting are disabled.
• SECURITY.md and an operations/recovery guide are absent.
• LICENSE contains only the line MIT License; GitHub classifies it as Other, and package.json lacks repository, homepage, bugs, keywords, and engines metadata.
• .github/workflows/release.yml verifies a tag but neither packages an artifact nor creates a GitHub release; one GitHub release exists for v0.1.0.
• There are no open issues; the Roadmap milestone and roadmap label exist, while the initial foundation roadmap issues are closed.

Action issues created

• Replace the truncated MIT license and complete package provenance metadata #18 — Replace the truncated MIT license and complete package provenance metadata
• Make FilesystemPiClient writes atomic and reject unsafe file classifications #19 — Make FilesystemPiClient writes atomic and reject unsafe file classifications
• Raise and enforce coverage for hashline conflicts, file kinds, and filesystem failures #20 — Raise and enforce coverage for hashline conflicts, file kinds, and filesystem failures
• Run filesystem and newline conformance tests on Windows and macOS #21 — Run filesystem and newline conformance tests on Windows and macOS
• Require pull requests and passing CI on the protected main branch #22 — Require pull requests and passing CI on the protected main branch
• Add a core-specific security and operational recovery policy #23 — Add a core-specific security and operational recovery policy
• Create verified GitHub release artifacts from version tags #24 — Create verified GitHub release artifacts from version tags

Existing issue coverage

• No existing open issue was recorded as covering a maturity gap.

Review cadence

Reassess after the high-priority issues are completed or before the next significant release. Scores are directional engineering signals, not production telemetry or compliance certification.

[cervantesh]

Maturity baseline action set completed in PR #26: frozen issues #18-#24 are closed. Main now requires pull requests, administrator enforcement, conversation resolution, and all four supported Node/OS checks; force pushes/deletion are disabled. Private vulnerability reporting, vulnerability alerts, automated security fixes, secret scanning, and push protection were enabled and API-verified. Follow-up proposals #34-#35 are intentionally excluded from this frozen run.