Sahir619/fable-method

The Fable Workflow: how Claude Fable 5 worked, distilled into skills any model can run, with the eval that keeps it honest. Think / act / prove.

https://github.com/Sahir619/fable-method · commit 9924067e82bd · scored 2026-11-14 · scoring prov-4+qual-2+sec-2

Dispute this score or request a re-score Full report JSON

Repository: https://github.com/Sahir619/fable-method
Commit: 9924067e82bd48cf3b0426378db93238bfb33e9b
Generated: 2026-11-14T00:13:58+00:00
Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	90	explicit	74%	100%
Code quality	74	adequate	90%	100%
Security	73	adequate	85%	100%

AI provenance

Explicit AI attribution on 90% of first-party code added; an estimated 90% including velocity signals.

Explicitly attributed share (lower bound): 89.8%
Unattributed share in AI-consistent velocity bursts: 0.0%
Estimated AI-generated share: 89.8%

AI tool	Attributed commits	Lines added
Claude Code	15	792

AI tooling configured in repo: generic-agent

Current source lines last changed by AI-attributed commits: 664 of 753.

Too few lines in one group to compare finding densities.

Month	Lines added	Attributed to AI
2026-07	792	100%
2026-10	90	0%

Evidence

Claude Code: trailer 'Co-Authored-By: Claude' (88b5cf36b10e)
Claude Code: trailer 'Co-Authored-By: Claude' (b2a24d5b378a)
Claude Code: trailer 'Co-Authored-By: Claude' (3bc6fc5f2f89)
Claude Code: trailer 'Co-Authored-By: Claude' (51862afe9eb3)
Claude Code: trailer 'Co-Authored-By: Claude' (482cb8ef853e)
Claude Code: trailer 'Co-Authored-By: Claude' (ef001dc6ae6f)
Claude Code: trailer 'Co-Authored-By: Claude' (5a3d186d5eab)
Claude Code: trailer 'Co-Authored-By: Claude' (4cbfb222c991)
Claude Code: trailer 'Co-Authored-By: Claude' (60eef5b90505)
Claude Code: trailer 'Co-Authored-By: Claude' (150d5da92b4a)
Claude Code: trailer 'Co-Authored-By: Claude' (5e2dc2a5b17b)
Claude Code: trailer 'Co-Authored-By: Claude' (433a021d50cf)
Claude Code: trailer 'Co-Authored-By: Claude' (3bcd75c405b3)
Claude Code: trailer 'Co-Authored-By: Claude' (c95e7b1c9191)
Claude Code: trailer 'Co-Authored-By: Claude' (49d042fdc61f)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is adequate: test-to-source ratio 0.11, no CI test run detected; 0% of function code in complex or long functions; 0% duplicated lines. Weakest area: type safety.

Area	Score
Complexity (lizard)	100
Duplication	100
Code smells (Opengrep)	47
Tests and CI	51
Documentation	100
Type safety	40
Process (Scorecard review/maintenance)	n/a

Functions: 54; mean complexity 2.0, 90th percentile 3; 0 complex and 0 long functions
Duplicated lines: 0.0% of 570 compared
Tests: 85 test lines for 753 source lines (ratio 0.11); CI test commands: none detected; 40% of recent source commits also change tests
Docs missing or thin: none

Security

Security posture is adequate: 2 high-severity workflow issues. Weakest area: posture.

Area	Score
Secrets (gitleaks, tree + history)	100
Static analysis (Opengrep)	84
Vulnerable dependencies (OSV)	n/a
CI workflows (zizmor)	63
Posture (policy, updates, signing, lockfiles)	0
OpenSSF Scorecard	n/a

Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits

Top findings

Severity	Finding	Location
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/checks.yml:10
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/checks.yml:11
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`: Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	eval/workflow.js:79
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`: Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	eval/workflow.js:91
medium	`zizmor/artipacked`: credential persistence through GitHub Actions artifacts [confidence low]	.github/workflows/checks.yml:10
medium	`zizmor/excessive-permissions`: overly broad permissions [confidence medium]	.github/workflows/checks.yml:7

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

Source lines: 753; test lines: 85

Language	Lines
Python	618
JavaScript	133
Shell	56
PowerShell	31

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/Sahir619/fable-method/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/Sahir619/fable-method/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/Sahir619/fable-method/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/Sahir619/fable-method/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/Sahir619/fable-method/security.svg)](https://repotrust.synapticcyber.com/r/github.com/Sahir619/fable-method/)