standards · 能力水平
Capability level: the automated scorecard
Every vertciti repository is graded daily by the company's own assessor, which lives outside the repositories it grades, against checks mapped one by one to public industry frameworks. The bar is A++. Below the bar is an incident: filed automatically, repaired automatically, and published together with the score. Red grades included.
Today
17 repositories, 5 at the bar, 12 incidents (P0 7 · P1 5 · P2 0). These are measured numbers, not copy. Repositories at the bar are re-measured every day; an incident closes itself when the repository is repaired and re-measured at the bar.
Scorecard
| Repository | Kind | Score | Grade | At bar | Incident | Failing checks (MUST in bold) |
|---|---|---|---|---|---|---|
| miao-ai Miao engine | app · active | 90.4 | A++ | no | P1 | SEC-7, DOC-2, UI-2, OPS-3, CONT-1, CONT-2 |
| vertciti-translator Translator 王牌翻译器 | app · active | 83.3 | B | no | P1 | DOC-9, DOC-10, DOC-11, UI-2, OPS-5, REL-2, PERF-1, PUB-2, CONT-1, PRIV-1, AI-1 |
| vertciti-chat vertciti Assistant | app · active | 70.0 | B | no | P1 | SEC-7, SEC-9, QA-4, DOC-2, DOC-3, DOC-4, DOC-5, DOC-11, UI-1, UI-2, OPS-3, REL-1, REL-2, PERF-1, PUB-2, CONT-1, CONT-2, AI-1, AI-2 |
| echowatch EchoWatch | app · active | 58.9 | C | no | P0 | SEC-1, SEC-4, SEC-5, SEC-6, SEC-8, SEC-9, SEC-10, QA-3, QA-4, DOC-2, DOC-8, DOC-9, DOC-10, UI-1, UI-2, PERF-1, PUB-2, CONT-1, CONT-2, AI-1, AI-2 |
| vertciti-dealdesk DealDesk 核保台 | app · active | 83.3 | B | no | P1 | SEC-7, SEC-8, SEC-10, DOC-2, UI-1, UI-2, PRIV-1, AI-1, AI-2 |
| phonehands PhoneHands | library · active | 54.7 | C | no | P0 | GOV-2, GOV-3, GOV-6, SEC-1, SEC-2, SEC-3, SEC-4, SEC-5, SEC-6, SEC-7, SEC-10, QA-2, QA-3, DOC-2, DOC-5 |
| founder-visual-director founder-visual-director | skill · active | 98.1 | S | yes | — | DOC-5 |
| think-tank think-tank | skill · active | 98.1 | S | yes | — | DOC-5 |
| website-qa-gates website-qa-gates | skill · active | 98.1 | S | yes | — | DOC-5 |
| vertciti-security-watch security-watch | tool · active | 96.9 | S | yes | — | SEC-7, DOC-5 |
| vertciti-website vertciti.com source (merge to main deploys production) | site · active | 75.5 | B | no | P0 | GOV-1, GOV-4, GOV-6, SEC-2, DOC-1 |
| Miao Miao public lab | docs · active | 71.1 | B | no | P0 | GOV-2, GOV-3, SEC-1, SEC-2, SEC-5 |
| HUIIIM | profile · active | 23.1 | C | no | P0 | GOV-2, GOV-3, SEC-1, SEC-8 |
| .github | meta · active | 100.0 | S | yes | — | — |
| vertciti-sp07-builder | tool · archive | 75.0 | B | no | P1 | GOV-2, GOV-3, SEC-8 |
| vertciti-prototype | app · archive | 53.6 | C | no | P0 | GOV-2, GOV-3, SEC-8, DOC-9, DOC-10 |
| vertciti-ts-spaces | docs · placeholder | 48.0 | C | no | P0 | GOV-2, GOV-3, SEC-8, DOC-9, DOC-10 |
How incidents are handled
- P0: score <70, or a measured failure of a safety MUST (secret scanning, least privilege, licence, deployment unreachable). Handled within 24 hours.
- P1: score <85, or any failing MUST. 72 hours.
- P2: score <90. 7 days.
Each incident is one issue in the repository concerned (label standards-incident) plus one automatic repair: mechanical items (CODEOWNERS, workflow permissions and timeouts, Dependabot, secret scanning) become a pull request from a script; items that need real content (product one-pager, runbook, eval records) are drafted by Miao as a pull request. Pull requests only, never auto-merged: merging is a human decision.
What is measured
Checks are grouped by dimension; each maps to a public framework (OpenSSF Scorecard, OWASP ASVS, SLSA, WCAG 2.2, Core Web Vitals, Twelve-Factor, OpenTelemetry). Full text: STANDARDS.md (Chinese).
- Governance GOV-1, GOV-2, GOV-3, GOV-4, GOV-5, GOV-6
- Security & supply chain SEC-1, SEC-2, SEC-3, SEC-4, SEC-5, SEC-6, SEC-7, SEC-8, SEC-9, SEC-10
- Quality QA-1, QA-2, QA-3, QA-4, QA-5
- Product kit & docs DOC-1, DOC-2, DOC-3, DOC-4, DOC-5, DOC-6, DOC-7, DOC-8, DOC-9, DOC-10, DOC-11
- Design DNA UI-1, UI-2
- Operations OPS-1, OPS-2, OPS-3, OPS-4, OPS-5
- Reliability (live) REL-1, REL-2
- Performance (live) PERF-1
- Public discoverability PUB-1, PUB-2
- Continuity CONT-1, CONT-2
- Privacy PRIV-1
- AI quality AI-1, AI-2
- Legal LEGAL-1
Why publish the failures
vertciti's brand is "built in public, open to verification". An all-green scorecard carries no information. What lets an outsider judge our level is how the score is measured, where the bar is, and what happens when we miss it. So this page publishes the assessor's source, the raw data and the incidents. The bar only moves up: every quarter each product is compared item by item with public products in its class, and the gaps become new checks.