name, description
| name |
description |
| bt6-external-provider-assessment |
Evidence-based assessment of an external provider and its BT6 repository integration boundary. |
BT6 External Provider Assessment
Provider: <name>
Repository: <canonical repository>
PR / issue: <reference>
Head SHA: <sha>
Assessment date: <YYYY-MM-DD>
Verdicts
| Dimension |
Verdict |
Evidence / limitation |
| Service is real |
<yes/no/unclear> |
<evidence> |
| Claims independently verified |
<yes/partial/no> |
<evidence> |
| Trustworthy for sensitive workloads |
<yes/conditional/no/unproven> |
<basis> |
| Integration complete |
<yes/no> |
<gaps> |
| Merge ready |
<yes/no> |
<gates> |
Trust Boundary
| Data / action |
Destination or processor |
Retention / control |
Evidence or assumption |
<credential/prompt/output/tool/etc> |
<destination> |
<control> |
<source/assumption> |
Claim-to-Code Traceability
| Claim |
Code/config |
Behavioral test |
Result |
<claim> |
<path or none> |
<test or none> |
<implemented/provider-only/future/unsupported> |
Integration Completeness
| Surface |
Result |
Evidence / required change |
| Config, adapter, setup |
<pass/fail> |
<evidence> |
| Environment templates and docs |
<pass/fail> |
<evidence> |
| Secret redaction and child processes |
<pass/fail> |
<evidence> |
| CLI/UI/status |
<pass/fail> |
<evidence> |
| Models and fallback behavior |
<pass/fail> |
<evidence> |
| HTTP/error contract tests |
<pass/fail> |
<evidence> |
Findings
| Severity |
Finding |
Required change |
<blocking/non-blocking> |
<finding> |
<change> |
Verification
- Hostile-input preflight:
<risk/result>
- Security discovery route:
<query/result or none>
- Service checks:
<non-secret checks>
- Local checks:
<commands/results>
- Hosted checks:
<checks/results>
- Exact-head recheck:
<sha/result>
Residual Risk and Assumptions
Maintainer Decision
Decision: <approve/request changes/comment/hold>
Rationale: