Practical AI Radar · Radar Scout, editorial pen name
Evidence for the Scorecard and model-call logging guides. These are dated synthetic fixtures, with useful counterexamples and explicit limits.
Seven synthetic directories, three selected checks. Scores below are transcribed from each linked raw stdout JSON. The fabricated zero pin still scored 10. No GitHub Actions job was executed, and no real repository was assessed.
| Fixture / raw result | Dangerous-Workflow | Pinned-Dependencies | Token-Permissions |
|---|---|---|---|
| 01-baseline | 0 | 0 | 0 |
| 02-permissions-only | 0 | 0 | 10 |
| 03-pin-only | 0 | 10 | 0 |
| 04-quoted-input-only | 10 | 0 | 0 |
| 05-combined | 10 | 10 | 10 |
| 06-fabricated-pin | 10 | 10 | 10 |
| 07-no-workflow | -1 | -1 | -1 |
All seven scans exited 0; the no-workflow scores of −1 are inconclusive. A separate eighth request for local Branch-Protection exited 1 with no JSON output. Run summary · Predictions · Fabricated-pin input.
The recorded tool was Scorecard v5.5.0, Linux amd64 through WSL. Upstream executable/checksum and checkout-reference authentication remain independently unverified. These records are not a security certification.
Eight operational records from one mock client run, plus a separate faulty-timeout control. The mock service observed nine requests. No real model or user traffic was involved.
| Case | HTTP status | Outcome | Failure stage |
|---|---|---|---|
| snapshot-success | 200 | success | none |
| alias-without-usage | 200 | success | none |
| rate-limit | 429 | rate_limited | http_status |
| upstream-error | 500 | upstream_error | http_status |
| body-stall | 200 | timeout | response_body |
| malformed-json | 200 | invalid_json | decode |
| wrong-schema | 200 | invalid_schema | validate |
| hostile-metadata | 200 | success | none |
Eight operational records · Nine mock-service observations · Faulty timeout control.
The correct deadline recorded 304.246 ms and a body timeout after headers. The faulty control took 913.246 ms overall: approximately 2.510 ms to headers and 910.736 ms for the body. These individual observations are not a latency benchmark.
This separate run uses a revised schema. A format-valid request ID stays unchanged and is labelled as not anonymized. The HTTP 500 case is second; connection closure before headers is third.
| Case | HTTP status | Outcome | Failure stage |
|---|---|---|---|
| semantic-request-id | 200 | success | none |
| opaque-server-error | 500 | upstream_error | http_status |
| close-before-headers | null | transport_error | request |
Three operational records · Three mock-service observations.
Client and service logs are different views of author-controlled fixtures, not independent third-party corroboration. Synthetic canaries remain in raw fixtures by design. No retry implementation, exporter, retention/access controls or restricted diagnostic channel was tested.
Read the reader guide. With Node installed, run node check-files.mjs from this directory. It checks this export's file list, sizes, hashes and copy map.
The complete historical validation package is retained separately. This export omits editorial drafts, internal guides and full-set manifests/validators. The unchanged source scripts describe the fixtures; the command above never runs them. Do not reuse the raw capture harness on real traffic without appropriate controls.
Prepared with AI assistance. This local page uses no remote scripts, styles, analytics or images. No guarantee of approval by an advertising platform is implied.