Claims that fire on ordinary repositories (v0.5.0)

[Shakargy]

Why

I ran the v0.4 first-run flow against three realistic open-source repos. Two of three produced nothing:

Repo	v0.4 dtc verify	v0.5 dtc verify
FastAPI full-stack template	UNKNOWN, SUPPORTED	SUPPORTED (JWT) + WEAK: 6 of 15 routes have a referencing test
expressjs/express	UNKNOWN, UNKNOWN	WEAK: 59 of 133 routes have a referencing test
gin-gonic/gin (Go)	UNKNOWN, UNKNOWN	Explains that no claim applies, what was scanned, and what would unlock one

The verification layer was honest and useless at the same time. This fixes the coverage, not the honesty.

What ships

route-test-coverage - "HTTP routes are exercised by tests." Routes and tests are the two most abundant signal kinds in almost every server repo, so this claim fires nearly everywhere. Reports the ratio and names the uncovered routes. Attribution by test imports and route names; e2e specs excluded (they match by accident); absence of tests is missing evidence, never a contradiction.

admin-authorization - "Administrative routes require an authorization check." Missing authorization is WEAK, never CONTRADICTED - global middleware and framework decorators aren't detected, and calling an endpoint unprotected when it isn't would destroy the trust the project is built on. The limitation is stated in the output itself.

NOT_APPLICABLE status - a repo with no billing code isn't "unknown" for a billing claim. UNKNOWN now means only "surface exists, evidence cannot decide".

Report card output - findings first (contradictions before everything), then which claims don't apply and why. When nothing applies, it reports what was scanned, what evidence exists, what would unlock a claim, and that this is a coverage limit rather than a verdict - ending with a link to open an issue. The users most likely to have a complaint now land on a screen that invites it.

Design notes

• verify_all loads scan evidence once; verify is sub-second on express (133 routes, 1683 tests)
• NOT_APPLICABLE results are not stored - they'd pollute freshness and diff impact with claims that have no evidence
• Evidence is capped at 25 routes with the truncation disclosed in limitations, so bounded output never silently misrepresents freshness coverage
• JSON is schema_version: 2 - all v1 fields unchanged, only the new status value added

Investigated and deliberately not built

A secret-handling claim ("no secrets committed") looked like the highest-value broad claim. The audit killed it: DevTime hard-denies .env, *.pem, *.key from scanning, so evidence for that claim cannot exist without breaking the trust model. Canon wins over a good feature.

Verification

• 142 tests passing (20 new): all statuses per claim, the WEAK-not-CONTRADICTED honesty rule, e2e exclusion, contradiction-first ordering, NOT_APPLICABLE not persisted, report-card and dead-end output, schema v2, --list applicability
• build + twine clean

Version 0.5.0. No tag, no publish - awaiting approval.