Current operating evidence
The dominant project motion is visible in the commit stream: feat: 22fix: 22docs: 9chore: 5test: 3ci: 1
Business intent
Publicus exists because AI makes software generation cheap while security review remains expensive. The open core is the reusable proof layer: package manifests in, public evidence and signed registry posture out. Hosted help, private overlays, and procurement support can live at the edge without closing the trust substrate.
Product intent
The primary journey is not "read our registry." It is: upload the dependency files your AI workflow produced, see what blocks release, inspect primary sources, export a proof pack, and use bounded synthesis only after the evidence is visible.
spec-driven verificationreal behavior testsmocks only for boundaries
Who this is for
AI builderssecurity reviewersCanada release teamstrusted contributors
Builders need speed without hiding risk. Reviewers need citable evidence, not opaque AI answers. Contributors need a governed path where public claims change only through trusted review.
Why this remains useful
Frontier cyber models, open models, package scanners, and SBOM tools all help. Publicus is different because it publishes the model-agnostic verification layer around them: source contracts, freshness lanes, signed component truth, Canada-readiness mappings, review pressure, and proof exports.
Evolution path
Signed YAML registry
Curated component truth, primary-source vulnerability evidence, KEV intersections, ATLAS mappings, and provenance expectations.
CLI and static trust surface
Manifest parsing, registry checks, static API output, dogfood gates, and source discipline.
Live read API and browser flow
FastAPI routes, docs split, freshness lanes, registry and exploited-risk browsing, and Ask as a separate recommendation workspace.
Scan-first product correction
The homepage and primary route now start with dependency upload and direct package lookup because that is how builders actually need help.
Source-depth expansion
Object-specific evidence now separates vulnerability, exploit pressure, package metadata, distro/runtime, provenance, and AI-risk context instead of calling every listed source live.
MOMS test
Every page and component should pass these plain-language checks before it is treated as product-ready:
- Can a non-expert tell what this page is for?
- Is the next action obvious?
- Can the user see what is evidence, what is synthesis, and what is not applicable?
- Can every trust claim be followed to a primary source or signed artifact?
- Does the route work on mobile without overwhelming the user?
Critical product gaps
scan-first claritysource-depth comprehensionunknown explanationsmovement click pathsevidence-pack readabilitytrusted-reviewer onboarding
These are outcome gates, not calendar promises. The public app should never make a user wonder what to upload, why a package is unknown, whether evidence is current, which source was checked, or what action happens when a card looks clickable. The internal appendix carries the deeper route-by-route criticism for maintainers.
What remains
Read pending work as outcome gates, not calendar promises. Each item should become one narrow branch with a proof command, MR, and deployment or audit artifact.
| Gate | Already true | Next pressure |
|---|---|---|
| Freshness | Status exposes separate evidence, source-sync, projection, and movement clocks. | Keep scheduled refreshes autonomous so deploy bootstrap never leaves stale lanes. |
| Data depth | 56 source contracts; active scan lanes include OSV, GHSA, NVD, EPSS, distro/runtime, package metadata, AI incidents. | Convert adapter backlog into real evidence lanes only when licensing and fixtures are clear. |
| Upload trust | Manifest scan supports common dependency files and evidence-pack export. | Improve unknown explanations and prioritize repeated unknowns into review proposals. |
| Business intent | Open trust substrate, source contracts, and proof packs are the product core. | Make every public page reinforce the same business promise: build fast with AI, verify in public before release. |
| Frontend proof | Product-flow script checks routes, layout, mobile stacking, source health, upload scan, direct lookup, and docs. | Use HTML audit reports to make QA findings readable before product fixes start. |
| Open-source readiness | Governance, contribution, source contract, and trusted-review docs exist. | Recruit trusted reviewers before opening broad public contribution paths. |
Agent velocity pattern
Repeated prompts drove velocity but also created scope ratcheting risk. The fix is not less agent use; it is narrower canonical docs, explicit stopping conditions, and HTML report artifacts that people and agents will actually read.
| Repeated prompt pattern | Count |
|---|---|
| Address all and continue | 13 |
| Proceed and continue | 7 |
| What else is pending? | 4 |
| What is pending before we deploy the frontend? | 4 |
| Address them, there is other things we can do other then A1 + A2. We will do that later, let's do more that we can do | 3 |
| See what is pending and decide based on objective truth | 3 |
| What else can we do to improve this from web research and codebase standpoint? | 2 |
| See 1000x speed in software development in April 2026 with tools we are using . Given what we have done, creating good. md files, contirbuti | 2 |
Verification contract
Publicus should prove behavior through contracts and real product flow. Pure mocks are allowed for unavailable services, rate limits, and explicit error branches; they are not a substitute for route, parser, source, scan, and browser evidence.
source-backed API checksbrowser product-flow smokefixture-backed boundariesprimary-source citations
Recent Git motion
feat: 54docs: 25frontend: 20trust: 16chore: 15refresh: 11scan: 10railway: 10public: 8evidence: 7surface: 7registry: 7publicus: 7live: 6
| Date | Commit | Subject |
|---|---|---|
| 2026-05-13 | 269c386 | Merge branch 'feat/scan-explanation-buckets' into 'main' |
| 2026-05-13 | c032984 | feat: explain scan evidence buckets |
| 2026-05-13 | 58ca8f3 | Merge branch 'docs/refresh-html-pending-report' into 'main' |
| 2026-05-13 | c713673 | docs: refresh html pending report |
| 2026-05-13 | 4567a79 | Merge branch 'docs/internal-html-audit-report' into 'main' |
| 2026-05-13 | c58c56e | docs: deepen internal html audit report |
| 2026-05-13 | a871d58 | Merge branch 'fix/aiid-source-snapshot-fallback' into 'main' |
| 2026-05-13 | e24976d | fix: add aiid snapshot fallback |
| 2026-05-13 | 1c6b428 | Merge branch 'fix/freshness-check-api-url' into 'main' |
| 2026-05-13 | 3156a89 | fix: correct freshness check api url usage |
| 2026-05-13 | e8ed52d | Merge branch 'docs/html-project-history-report' into 'main' |
| 2026-05-13 | 19d50ff | docs: add html project history report |
| 2026-05-12 | b40c4c2 | Merge branch 'feat/source-adapter-backlog-wave' into 'main' |
| 2026-05-11 | f820d22 | feat: monitor AI incident source context |
| 2026-05-11 | faa4a86 | Merge branch 'feat/ecosystem-metadata-scan-depth' into 'main' |
| 2026-05-11 | 30ce472 | feat: add ecosystem package metadata scan lanes |
| 2026-05-11 | 8d1f022 | Merge branch 'feat/railway-autonomous-data-plane' into 'main' |
| 2026-05-11 | a4a8d01 | feat: add autonomous postgres deployment bootstrap |
| 2026-05-11 | 0a84179 | Merge branch 'feat/runtime-distro-evidence' into 'main' |
| 2026-05-11 | 56972ff | feat: add runtime distro evidence lane |
| 2026-05-11 | 45ff618 | Merge branch 'feat/cve-ghsa-evidence-depth' into 'main' |
| 2026-05-11 | 651cf88 | feat: add CVE and GHSA malware evidence lanes |
| 2026-05-11 | ac8e1c4 | Merge branch 'feat/freshness-guard' into 'main' |
| 2026-05-11 | fe834c2 | feat: add live freshness guard |
Canonical docs
| Role | Path |
|---|---|
| readme | README.md |
| docs_router | docs/README.md |
| current_state | docs/current-state.md |
| decision_log | docs/decision-log.md |
| lineage | tracking/lineage.yaml |
| workspace_index | None |
Agent guidance coverage
agentsclaudegeminicopilotrepo_claude_dir
AGENTS.md remains the compact cross-agent contract. Claude-specific guidance, tool conventions, and llms.txt support inference-time routing without duplicating full policy.
How to use this report
Use this page for leadership, contributor, and reviewer context. Use the internal appendix for operational archaeology. If either artifact disagrees with docs/current-state.md, the current-state doc wins until a maintainer promotes a durable change.