Keel

keel route

Independence cannot be manufactured, but it can be routed.

Every ungrounded verification edge in requests, paired — where a pairing exists — with an anchored producer already present in the same measurement. Nothing here invents an anchor, and nothing here has been applied.

targetrequests
revision69f84847045bef7a849cc994a26fe7ba8a169e95
source reportreports/requests.json
generated2026-07-25T05:20:43.978Z
statusproposed (all 1)
0.92

today — measured

·
0.92

projection if applied — 0 re-grounded · 0 constructed

anchored / (anchored + self_referential + unknown)

anchored 11 self_referential 0 unknown 1 not_a_check 13 excluded from the denominator

The second number is a projection: the ratio this target would carry if a human applied every route below and the applied routes measured as anchored on re-measurement. It is arithmetic on a hypothetical. It is not written to any report, it is not fed back into the grounding ratio, and no proposal on this page has been applied. Projected counts, for the same conditional: anchored 11 · self_referential 0 · unknown 1 · not_a_check 13. The delta is two different claims and is reported as two: 0 re-grounded — an existing check whose signal moves outside the write boundary, the proposition it asserts unchanged — and 0 constructed — a not_a_check node that becomes a check, entering the denominator as well as the numerator. Only the first repairs something that was already being claimed.

Scope. Keel measures the shape of verification, not its quality. A repo can be 100% anchored with terrible tests. Anchoring says the signal comes from outside; it does not say the signal is sufficient.

Routes — 0 routable · 1 unroutable

Existing checks whose signal could come from somewhere they cannot write. Cheapest effort on top. no route is a first-class answer: it means the fix needs a policy decision rather than a rewiring, and it is reported here rather than dropped.

what's ungrounded route to why that's anchored effort
.github/CODEOWNERS#codeowners
review_gate · code owners (CODEOWNERS)
today the signal comes from cannot be established from the repository — either a second maintainer's review approval, or nothing at all
unknown
no route

The proposition this file is reaching for is 'a change to .github/workflows/, CODEOWNERS, src/requests/__version__.py, HISTORY.md or pyproject.toml was approved by @nateprewitt or @sigmavirus24, who is not the author'. A producer that asserts that must emit an approval event attributable to a human other than the pushing actor, and it must sit in the merge path. Every anchored node in this report emits something structurally different: build-dists emits the packaging backend's exit code over the checked-out tree; make ci / make test / tox emit CPython's exit status running tests/; pyright, ruff and the pre-commit aggregate emit a static analyser's verdict on the committed bytes; pytest ini-options and the coverage target parameterise or observe those same runs. All of them answer 'does the tree build, type-check, lint and pass its suite' — a claim about the artefact. None of them answers 'did a second, named person consent to this diff' — a claim about who authorised it. Wiring CODEOWNERS to read any of them would attach a human-authorisation edge to a toolchain-correctness signal: the ratio would move and the authorisation claim would remain exactly as ungrounded as it is now, because a green pytest run is fully reachable by the very author CODEOWNERS exists to constrain.

why not: This needs a policy decision, not a rewiring. The signal CODEOWNERS wants already exists at GitHub — a code-owner review approval — but whether it gates anything is decided by 'Require review from Code Owners' in branch-protection/ruleset settings, which live in repository configuration outside the tree and are not readable from a clone. Someone with admin rights must (a) decide the rule is on and (b) make that decision auditable from the repository — e.g. by committing the ruleset as a checked-in .github/rulesets/*.json or otherwise exporting protection state into the tree — before any node in this report can carry the proposition. Until that decision is made, `unknown` is the honest class and no anchored producer here can stand in for it.

Construct — not yet.

A route makes a check read a signal from outside itself. It does not pair that check with a counter-metric, name who arbitrates when the pair disagrees, or set a cadence at which the route is re-audited. Those three fields are declared in schemas/route.ts and are filled by keel construct, which is not built. The columns are empty by construction, not by omission.

route pairedWith arbitratedBy auditEvery
no routes on this run