{
  "ai_sessions": {
    "measured": false,
    "needs": "Either a read-only token for the care-record issue, or the flow-start notes copied into latest-state.json by the job that writes it.",
    "reason": "The record of each AI session lives in the care-record issue, and this service has no credentials to read it. It reads only the care plan and latest-state.json.",
    "shown": "AI sessions: not measured on this page"
  },
  "app": "bakery-demo",
  "checked_at": "2026-10-27 21:05 UTC",
  "drills": [
    {
      "drill": "advisories",
      "duration": "2.0 s",
      "duration_s": 2.011,
      "findings": 0,
      "last_run": "2026-10-27 09:05 UTC",
      "note": null,
      "numbers": [
        {
          "label": "known advisories across them",
          "name": "advisories",
          "text": "known advisories across them: 14",
          "value": 14
        },
        {
          "label": "days since the exploited-flaw list was released",
          "name": "kev_catalog_age_days",
          "text": "days since the exploited-flaw list was released: 0",
          "value": 0
        },
        {
          "label": "packages with a flaw known to be exploited",
          "name": "known_exploited",
          "text": "packages with a flaw known to be exploited: 0",
          "value": 0
        },
        {
          "label": "packages checked for known advisories",
          "name": "packages_checked",
          "text": "packages checked for known advisories: 232",
          "value": 232
        },
        {
          "label": "build-tool packages with a known advisory",
          "name": "vulnerable_dev_packages",
          "text": "build-tool packages with a known advisory: 5",
          "value": 5
        },
        {
          "label": "shipped packages with a known advisory",
          "name": "vulnerable_runtime_packages",
          "text": "shipped packages with a known advisory: 0",
          "value": 0
        }
      ],
      "state": "green"
    },
    {
      "drill": "anonymous-access",
      "duration": "2.9 s",
      "duration_s": 2.866,
      "findings": 0,
      "last_run": "2026-10-27 09:05 UTC",
      "note": null,
      "numbers": [
        {
          "label": "private rows a stranger can read",
          "name": "readable_rows",
          "text": "private rows a stranger can read: restricted",
          "value": "restricted"
        },
        {
          "label": "tables a stranger can read",
          "name": "readable_tables",
          "text": "tables a stranger can read: 1",
          "value": 1
        },
        {
          "label": "tables a stranger can write to",
          "name": "writable_tables",
          "text": "tables a stranger can write to: 0",
          "value": 0
        }
      ],
      "state": "green"
    },
    {
      "drill": "armour",
      "duration": "0.1 s",
      "duration_s": 0.082,
      "findings": 0,
      "last_run": "2026-10-27 09:05 UTC",
      "note": null,
      "numbers": [
        {
          "label": "container images checked",
          "name": "images_checked",
          "text": "container images checked: 11",
          "value": 11
        },
        {
          "label": "installs checked",
          "name": "installs_checked",
          "text": "installs checked: 43",
          "value": 43
        },
        {
          "label": "files shaped like a cloud key",
          "name": "key_files",
          "text": "files shaped like a cloud key: 0",
          "value": 0
        },
        {
          "label": "places where npm install scripts run",
          "name": "scripts_enabled",
          "text": "places where npm install scripts run: 0",
          "value": 0
        },
        {
          "label": "installs that do not use the lockfile",
          "name": "unlocked_installs",
          "text": "installs that do not use the lockfile: 0",
          "value": 0
        },
        {
          "label": "container images not pinned to a digest",
          "name": "unpinned_images",
          "text": "container images not pinned to a digest: 0",
          "value": 0
        }
      ],
      "state": "green"
    },
    {
      "drill": "clock",
      "duration": "6.0 s",
      "duration_s": 6.006,
      "findings": 0,
      "last_run": "2026-10-27 09:05 UTC",
      "note": null,
      "numbers": [
        {
          "label": "domains checked",
          "name": "domains_checked",
          "text": "domains checked: 0",
          "value": 0
        },
        {
          "label": "days to the nearest end of life",
          "name": "nearest_eol_days",
          "text": "days to the nearest end of life: 185",
          "value": 185
        },
        {
          "label": "runtimes checked",
          "name": "runtimes_checked",
          "text": "runtimes checked: 7",
          "value": 7
        },
        {
          "label": "runtimes past active support",
          "name": "runtimes_eoas",
          "text": "runtimes past active support: 3",
          "value": 3
        },
        {
          "label": "runtimes reaching end of life within 90 days",
          "name": "runtimes_eol_soon",
          "text": "runtimes reaching end of life within 90 days: 0",
          "value": 0
        },
        {
          "label": "runtimes with no end-of-life date yet",
          "name": "runtimes_no_date",
          "text": "runtimes with no end-of-life date yet: 3",
          "value": 3
        },
        {
          "label": "runtimes past end of life",
          "name": "runtimes_past_eol",
          "text": "runtimes past end of life: 0",
          "value": 0
        },
        {
          "label": "website certificates (TLS) checked",
          "name": "tls_checked",
          "text": "website certificates (TLS) checked: 1",
          "value": 1
        },
        {
          "label": "website certificates (TLS) expiring within 14 days",
          "name": "tls_expiring",
          "text": "website certificates (TLS) expiring within 14 days: 0",
          "value": 0
        }
      ],
      "state": "green"
    },
    {
      "drill": "exposed-settings",
      "duration": "0.7 s",
      "duration_s": 0.73,
      "findings": 0,
      "last_run": "2026-10-27 09:05 UTC",
      "note": null,
      "numbers": [
        {
          "label": "plain-text secrets on the live service",
          "name": "plain_secret_env",
          "text": "plain-text secrets on the live service: 0",
          "value": 0
        },
        {
          "label": "plain-text secrets in older revisions",
          "name": "plain_secret_in_old_revisions",
          "text": "plain-text secrets in older revisions: 0",
          "value": 0
        },
        {
          "label": "settings checked",
          "name": "settings_checked",
          "text": "settings checked: 6",
          "value": 6
        }
      ],
      "state": "green"
    },
    {
      "drill": "postmortem",
      "duration": "1.2 s",
      "duration_s": 1.206,
      "findings": 0,
      "last_run": "2026-10-27 09:05 UTC",
      "note": null,
      "numbers": [
        {
          "label": "deploy jobs checked",
          "name": "deploy_jobs_checked",
          "text": "deploy jobs checked: 5",
          "value": 5
        },
        {
          "label": "deploy jobs a schedule would run",
          "name": "deploy_jobs_in_schedule",
          "text": "deploy jobs a schedule would run: 0",
          "value": 0
        },
        {
          "label": "deploy jobs seen in a live schedule pipeline",
          "name": "deploy_jobs_seen_live",
          "text": "deploy jobs seen in a live schedule pipeline: 0",
          "value": 0
        },
        {
          "label": "rules the check could not work out",
          "name": "unknown_rules",
          "text": "rules the check could not work out: 0",
          "value": 0
        }
      ],
      "state": "green"
    },
    {
      "drill": "restore",
      "duration": "1.0 s",
      "duration_s": 0.972,
      "findings": 0,
      "last_run": "2026-10-26 15:20 UTC",
      "note": null,
      "numbers": [
        {
          "label": "age of the newest backup",
          "name": "backup_age_s",
          "text": "age of the newest backup: 6 min",
          "value": 408
        },
        {
          "label": "time to restore it",
          "name": "restore_s",
          "text": "time to restore it: 0.2 s",
          "value": 0.218
        },
        {
          "label": "tables compared",
          "name": "tables_checked",
          "text": "tables compared: 6",
          "value": 6
        },
        {
          "label": "tables that did not match",
          "name": "tables_mismatched",
          "text": "tables that did not match: 0",
          "value": 0
        }
      ],
      "state": "green"
    },
    {
      "drill": "supply-chain",
      "duration": "0.0 s",
      "duration_s": 0.006,
      "findings": 0,
      "last_run": "2026-10-27 09:05 UTC",
      "note": null,
      "numbers": [
        {
          "label": "packages that carry an install script",
          "name": "install_script_packages",
          "text": "packages that carry an install script: 2",
          "value": 2
        },
        {
          "label": "installs checked",
          "name": "installs_checked",
          "text": "installs checked: 1",
          "value": 1
        },
        {
          "label": "packages in the lockfile",
          "name": "lock_entries",
          "text": "packages in the lockfile: 232",
          "value": 232
        },
        {
          "label": "lockfile packages with no checkable download",
          "name": "lock_entries_unverified",
          "text": "lockfile packages with no checkable download: 0",
          "value": 0
        },
        {
          "label": "places where npm install scripts run",
          "name": "scripts_enabled",
          "text": "places where npm install scripts run: 0",
          "value": 0
        },
        {
          "label": "installs that do not use the lockfile",
          "name": "unlocked_installs",
          "text": "installs that do not use the lockfile: 0",
          "value": 0
        }
      ],
      "state": "green"
    },
    {
      "drill": "supply-chain-probe",
      "duration": "1.6 s",
      "duration_s": 1.629,
      "findings": 0,
      "last_run": "2026-10-27 09:05 UTC",
      "note": null,
      "numbers": [
        {
          "label": "checks performed",
          "name": "checks_performed",
          "text": "checks performed: 2",
          "value": 2
        },
        {
          "label": "public-by-design keys visible (not counted)",
          "name": "declared_public_visible",
          "text": "public-by-design keys visible (not counted): 1",
          "value": 1
        },
        {
          "label": "GitLab job credentials visible (not counted)",
          "name": "platform_credentials_visible",
          "text": "GitLab job credentials visible (not counted): 4",
          "value": 4
        },
        {
          "label": "an install could push to the repo (1 means yes)",
          "name": "repo_push_possible",
          "text": "an install could push to the repo (1 means yes): 0",
          "value": 0
        },
        {
          "label": "credential-looking names an install could see",
          "name": "secrets_visible",
          "text": "credential-looking names an install could see: restricted",
          "value": "restricted"
        }
      ],
      "state": "green"
    }
  ],
  "misses": [
    {
      "check": "No drill in noxkeep.yml reads cost.",
      "id": "cloud-cost",
      "reason": "It needs a billing export, and we do not have one.",
      "status": "not measured",
      "what": "Cloud cost in money"
    },
    {
      "check": "No code in noxkeep/ reads credits.",
      "id": "ai-credits",
      "reason": "There is no confirmed API that reports them.",
      "status": "not measured",
      "what": "AI credits used per session"
    },
    {
      "check": "demo-app/Dockerfile builds on a Node 22 image; demo-app/.npmrc sets no cooldown; noxkeep/supply_chain.py says a cooldown is not measured.",
      "id": "npm-cooldown",
      "reason": "The demo app builds on Node 22, which ships npm 10, and the cooldown setting exists only in npm 11.",
      "status": "not enforced",
      "what": "A release cooldown for new npm package versions"
    },
    {
      "check": "noxkeep/settings_check.py marks the variables listing as unverified.",
      "id": "exposed-ci-variables",
      "reason": "It stays unmeasured until a read-only token exists to list the project's variables.",
      "status": "not measured",
      "what": "The exposed-settings check of CI variables"
    },
    {
      "check": "certificate.row gives a drill with no entry in the state file the grey state.",
      "id": "never-ran",
      "reason": "No result means no proof, so the drill shows grey, never green.",
      "status": "shown grey",
      "what": "Any drill in the care plan that has never produced a result"
    }
  ],
  "overall": "green"
}