A fresh review of source, working-tree state, locally executed checks and current GitHub Actions evidence. The score measures production readiness, not the percentage of earlier findings closed.
Joint score 8.5 / 10 · neither repository is currently a promotable release candidate.
The core build, Kotlin tests, lint, ABI check, docs, Android app and reference wallet passed in hosted CI. A wrong evidence path then stopped conformance verification and skipped every later release gate.
Substantial security, durability and operations work exists locally. It spans 156 changed paths and has a failing qualification-harness test, while hosted runners are blocked by billing.
| Category | TrustWeave | SaaS | Assessment |
|---|---|---|---|
| Security and access control | 9.4 | 8.8 | Fail-closed protocol checks and tenant controls are strong; deployed custody and the final authorization matrix lack retained evidence. |
| Correctness and protocols | 9.1 | 8.2 | Core suites are broad. Partial SDK surfaces and the SaaS load-harness defect prevent a clean qualification claim. |
| Architecture and maintainability | 9.0 | 8.4 | Clear modules and provider boundaries; SaaS reviewability is impaired by a very large, mixed, uncommitted change set. |
| Testing and documentation | 9.1 | 7.8 | TrustWeave ran its main suites. SaaS has 125 Kotlin test files, but its local Python gate fails and current hosted execution is absent. |
| Supply chain and CI | 8.0 | 7.0 | Immutable action pins and planned SBOM/attestation gates are good; neither current pipeline supplies complete green evidence. |
| Operations and providers | 8.7 | 8.1 | SoftHSM recovery and a deployed qualification workflow now exist. No successful Accountly staging run or production-equivalent KMS exercise is retained. |
Runs 34712013396 and 34712122792 completed the build and primary tests, then failed with FileNotFoundError for build/credentials/plugins/verifiable-intent/reports/vi-kotlin-immediate.json. The module writes into its own Gradle build directory. Coverage, alert validation, SBOM generation and commit binding were consequently skipped.
Acceptance: derive or copy the output from the module build directory, assert all expected files immediately after their producer task, and obtain one green main-branch run through every downstream gate.
The reviewed checkout has 98 modified and 58 untracked paths. They include tenant administration, rate limiting, migrations V25 and V30–V39, usage delivery, observability, KMS wiring, frontend administration and CI. The committed candidate remains e2d1c474. A reviewer or deployment runner cannot reconstruct the implementation scored here.
Acceptance: split the work into coherent commits, rebase the SDK pin to the accepted TrustWeave commit, run all gates from a clean checkout and preserve the resulting source-pair manifest.
The 20-test Python suite reports one failure: test_load_budget_uses_all_configured_request_types. A short configured exercise reaches its deadline before issuing a first request and raises “load exercise produced no requests.” This makes a required acceptance tool timing-sensitive.
Acceptance: schedule at least one request of every configured type before deadline-based repetition, validate positive duration and concurrency, and pin deterministic tests for minimal and normal budgets.
SaaS main pins TrustWeave 6c62fa0e; its dirty tree pins dbec32c0; current TrustWeave main is 8190a9ab. The SaaS build therefore has no immutable evidence for the SDK version reviewed here.
Acceptance: update both revision and source digest together, verify them in CI, and attest the exact pair used to build the runtime image.
SoftHSM proves PKCS#11 logic and restart persistence, which is valuable. A perfect production score requires an identified Accountly staging KMS/HSM resource and retained create, sign, rotate, revoke, loss, restore and audit evidence.
Multi-pair Verifiable Intent, PAdES, ServiceNow issuance/verification and host-adapter-dependent DIDComm encryption are explicit partial implementations. Complete them or publish a versioned support matrix that excludes them from the stable API promise.
SaaS run 34712022688 executed no steps because GitHub reported failed payments or an exceeded spending limit. After runner access is restored, the staging workflow must demonstrate load, cross-tenant denial, KMS rotation, restart/restore and alert acknowledgement.
Build once, attach SBOM and vulnerability results, deploy the same digest to SIT, qualify it, promote that digest to production, and retain rollback plus database/KMS recovery evidence.
| Check | Result | Meaning |
|---|---|---|
| TrustWeave hosted build/test/lint/ABI/docs | Passed | Primary source and compatibility gates passed on 8190a9ab. |
| TrustWeave local Python contracts | 130 passed | Validation, evidence and documentation helper contracts are green. |
| TrustWeave hosted release tail | Failed/skipped | VI path failure prevented coverage, operations and SBOM gates from running. |
| SaaS local Python contracts | 19 passed, 1 failed | Qualification load scheduling is currently defective. |
| SaaS backend suite | Incomplete | Compiled and many tests passed, but the run stopped producing progress and was terminated without a final result. |
| SaaS frontend | 302 passed + build | All 66 Vitest files passed; the production bundle stayed within its 500 KB initial-JavaScript budget. |
| SaaS GitHub Actions | No steps ran | Account billing/spending limit blocked both jobs; this does not prove a source failure. |
| SaaS candidate cleanliness | 156 changed paths | The assessed working tree is not an immutable release candidate. |
Each repository is the arithmetic mean of six equally weighted categories. A 10 requires a clean, reproducible commit; all claimed capabilities implemented and tested; a green hosted release chain; a production-equivalent deployment exercise; and retained recovery, alert and supply-chain evidence. Scores are engineering judgments, not a certification.
The TrustWeave assessment is based on committed main. The SaaS source assessment includes the current working tree, while release and reproducibility scoring is based on committed main. Hosted status was checked on 12 September 2026. No destructive, production or credential-bearing operation was performed.