Closed as out of scope for this goal, by owner decision 2026-07-28.

Assessment recorded at the time:

B-01 · Real-signature trust level with sigstore/gitsign #28 — --trusted-authors is name-matching and forgeable, but the default fails closed (nobody is trusted) and README.md:100 already states cryptographic verification is not implemented. No false assurance is being made, so this is not a correctness gap. It becomes necessary only if someone relies on [directive] in an adversarial setting.
B-05 · commitlore coverage command #32 — the highest-value of the deferred set: nothing today answers "is this working for us?" But that is an adoption metric, not a production-readiness condition.
B-06 · Anchor: symbol-level anchoring #33 — largest and least certain. Path-based records work, and --follow handles renames for a single path (see commitlore-query skill teaches agents an invocation whose documented property is false #69).
The test suite cannot run in a git worktree: hooks.test.ts assumes .git is a directory #77-era finding applies to B-07 · Interactive commitlore commit builder + automatic Expires reminders #34 — the measured problem it addressed (malformed trailer blocks) is already caught by A missing blank line silently discards every record, and the hook says nothing #75's warning, which names the offending line. The builder is ergonomics on top of a solved defect.

Reopen if the assumption behind the closure stops holding.

B-05 · commitlore coverage command #32

Description