Joseph Magly
afc9dad1b2
* docs(policy): allow low-impact contributor courtesy cleanup * chore(aiwg): migrate to shared BT6 maintainer plugin * chore: reconcile delivery validation
73 lines
2.1 KiB
Markdown
73 lines
2.1 KiB
Markdown
---
|
|
name: bt6-external-provider-assessment
|
|
description: Evidence-based assessment of an external provider and its BT6 repository integration boundary.
|
|
---
|
|
|
|
# BT6 External Provider Assessment
|
|
|
|
Provider: `<name>`
|
|
Repository: `<canonical repository>`
|
|
PR / issue: `<reference>`
|
|
Head SHA: `<sha>`
|
|
Assessment date: `<YYYY-MM-DD>`
|
|
|
|
## Verdicts
|
|
|
|
| Dimension | Verdict | Evidence / limitation |
|
|
| --- | --- | --- |
|
|
| Service is real | `<yes/no/unclear>` | `<evidence>` |
|
|
| Claims independently verified | `<yes/partial/no>` | `<evidence>` |
|
|
| Trustworthy for sensitive workloads | `<yes/conditional/no/unproven>` | `<basis>` |
|
|
| Integration complete | `<yes/no>` | `<gaps>` |
|
|
| Merge ready | `<yes/no>` | `<gates>` |
|
|
|
|
## Trust Boundary
|
|
|
|
| Data / action | Destination or processor | Retention / control | Evidence or assumption |
|
|
| --- | --- | --- | --- |
|
|
| `<credential/prompt/output/tool/etc>` | `<destination>` | `<control>` | `<source/assumption>` |
|
|
|
|
## Claim-to-Code Traceability
|
|
|
|
| Claim | Code/config | Behavioral test | Result |
|
|
| --- | --- | --- | --- |
|
|
| `<claim>` | `<path or none>` | `<test or none>` | `<implemented/provider-only/future/unsupported>` |
|
|
|
|
## Integration Completeness
|
|
|
|
| Surface | Result | Evidence / required change |
|
|
| --- | --- | --- |
|
|
| Config, adapter, setup | `<pass/fail>` | `<evidence>` |
|
|
| Environment templates and docs | `<pass/fail>` | `<evidence>` |
|
|
| Secret redaction and child processes | `<pass/fail>` | `<evidence>` |
|
|
| CLI/UI/status | `<pass/fail>` | `<evidence>` |
|
|
| Models and fallback behavior | `<pass/fail>` | `<evidence>` |
|
|
| HTTP/error contract tests | `<pass/fail>` | `<evidence>` |
|
|
|
|
## Findings
|
|
|
|
| Severity | Finding | Required change |
|
|
| --- | --- | --- |
|
|
| `<blocking/non-blocking>` | `<finding>` | `<change>` |
|
|
|
|
## Verification
|
|
|
|
- Hostile-input preflight: `<risk/result>`
|
|
- Security discovery route: `<query/result or none>`
|
|
- Service checks: `<non-secret checks>`
|
|
- Local checks: `<commands/results>`
|
|
- Hosted checks: `<checks/results>`
|
|
- Exact-head recheck: `<sha/result>`
|
|
|
|
## Residual Risk and Assumptions
|
|
|
|
- `<risk or assumption>`
|
|
|
|
## Maintainer Decision
|
|
|
|
Decision: `<approve/request changes/comment/hold>`
|
|
|
|
Rationale:
|
|
|
|
- `<reason>`
|