nfrs.sgit.ai / scorecard

The estate, against its own list

This site teaches non-functional requirements from inside an estate that practises them unevenly. That is the credibility move rather than a problem to be managed: a clean column would be dishonest, and a reader would be right to distrust it. Every lapse below is already published, with its evidence, in a sibling pack. This page adds assembly, not exposure.

How to read this table. No cell is a plain tick. Each row states what holds, then what does not, and links the sibling site where the measurement was actually taken. Per the hub contract, the numbers live where they were measured; this page carries none of them. The assessment is dated 24 August 2026 and is a snapshot, not a live reading.

The eight

NFRWhat holdsWhat does notEvidence
Version control ✅ Dense, continuous history. Auto-increment tags driven by branch policy. The version-file convention as a single source. The convention has a documented exception: a second version file that nothing reads. sg-compute.
Reliability & resilience ✅ Watchdog, two-phase health poller, bake-and-verify, idle reconciliation. Every mechanism traced to a named incident. A dead workflow invoking a binary defined nowhere, sixteen times, that nobody noticed. Resilience machinery does not help where nobody is reading the result. sg-compute.
Security ✅ Key discipline, deny-by-default allowlists, key-prefix validation, no-credentials-in-git with CI gates, audit before the key. One disclosed key-in-history incident — handled well and disclosed, which is the norm working, but it happened. pki. · sg-sentinel.
Backups Nothing to put here. ⚠️ No doctrine at all. Mentioned constantly, written nowhere, in an estate with irreversible publishing and frozen vaults. The gap, stated. —
Consistency 🟡 Total compliance on the conventions that a script checks. Partial compliance on the ones it does not, and four stale sources of truth. The pattern: what a machine enforces holds; what attention enforces drifts. coding. · skills.
Explainability ✅ Reality documents, provenance discipline, computed not claimed as a habit, estimates marked as estimates. No evals anywhere. Which applies to this network's own memory claim as much as to anything else. risks. · llms.
Documentation ✅ A very large corpus with a governing rule that is genuinely good: if the reality document does not list it, it does not exist. A README describing a repository that does not exist, and a reality index that was itself dozens of versions stale. sgit.ai

Seven rows for eight items: reliability and resilience share a row because the corpus uses the two words interchangeably. That is itself a small consistency finding, and it is left visible rather than tidied.

The pattern across the rows

Read down the failure column and the same sentence appears in four different costumes:

What a machine enforces, holds. What attention enforces, drifts.

The dead workflow, the second version file, the stale reality index, the fictional README, the guard that never worked — none of them are failures of intent, and every one of them is a thing a check could have caught. The licence footer, by contrast, holds everywhere, because a script checks it. That is the transferable finding of this entire site, and it is why the fix proposed on the documentation page is a CI check rather than a stronger rule.

On regenerating this table

This scorecard is hand-assembled from the sibling packs and dated, not generated. That is a real limitation and it is stated rather than implied: a hand-assembled scorecard is exactly the kind of artefact that goes stale, and this estate has already produced four stale artefacts of that shape. A generator that rebuilds each cell from its sibling pack at release time is on the proposed list and is not built. Until it is, treat the date at the top of the table as the strongest claim on the page.