LS — Exact-Head PR Risk Audit

English · Русский

LS freezes one pull request at one exact commit and produces an evidence-backed, advisory-only risk Scorecard. NOT_RUN, stale evidence, missing credentials, and incomplete collection never become success.

LS фиксирует один pull request на одном точном SHA и формирует доказательный advisory-only Scorecard. Непройденные проверки, устаревшие данные и неполные evidence никогда не превращаются в успех.

Start here

Use this path when you need to audit a high-impact or AI-generated GitHub pull request.

git clone https://github.com/safal207/LS.git
cd LS
python3.11 -m venv .venv
. .venv/bin/activate
python -m pip install ./packages/ls-audit-cli

ls-audit https://github.com/OWNER/REPO/pull/123 \
  --expected-head 0123456789abcdef0123456789abcdef01234567

For a private repository, set GITHUB_TOKEN before running the command. LS v0.1 sends that token only to api.github.com and never writes it to the audit bundle.

The command produces:

manifest.json
scorecard.json
SCORECARD.md
adjudication-template.json
evidence/

Read the generated SCORECARD.md first. The evidence directory is the reproducible support for the verdict, not the customer-facing summary. See the CLI package documentation for the full operator boundary.

Verdict boundary

PR URL + expected 40-character SHA
        ↓
initial exact-head check
        ↓
frozen evidence collection
        ↓
final exact-head check
        ↓
PASS / HOLD / NOT_RUN / INCOMPLETE
        ↓
human adjudication
        ↓
JSON + Markdown Scorecard

• An initial or final head mismatch fails closed.
• A force-push during collection cannot produce PASS.
• CHANGES_REQUESTED produces HOLD.
• Commentary-only, stale, missing, or unavailable review evidence is incomplete.
• Human adjudication cannot waive exact-head identity.
• LS is advisory-only and cannot approve or merge a pull request.

Product proof and operator docs

• LS v0.1 Product Scorecard
• Exact-Head Audit operator runbook
• CLI package documentation
• Issue #904 — installable operator path

Package boundary

The supported customer installation is:

python -m pip install ./packages/ls-audit-cli

The repository root pyproject.toml, Rust/Maturin build, GhostOS modules, vision/audio stack, and ML dependencies are legacy research infrastructure. They are not required for the Exact-Head PR Risk Audit and should not be installed by audit customers.

The previous full architecture, conformance, identity, memory, route-stability, and research README is preserved unchanged at README_LEGACY.md.

---

English

LS reduces the risk of accepting AI-generated changes by binding each conclusion to an exact commit, real execution status, frozen evidence, and human adjudication. It does not claim perfect recall and does not convert unavailable reviewers into approval.

Русский

LS снижает риск принятия AI-generated изменений: каждый вывод привязан к точному commit, реальному статусу выполнения, замороженным evidence и человеческой adjudication. LS не обещает идеальную полноту поиска и не считает недоступного reviewer одобрением.