How RepoFacts scores a repository

• Evidence before opinion. Facts come from GitHub and npm APIs; judgments come from named reviewers; nothing is model-written in this version.
• Health and momentum are separate answers. A mature library can be healthy and flat; a viral project can be rising and fragile.
• Stars are attention, not adoption. Adoption comes from registry downloads, shown separately.
• Unknown is a valid answer. Missing evidence lowers coverage and confidence; it never becomes a zero.
• Scores are decision support, not a warranty, certification, legal advice, or a security audit.

Every displayed value carries one of these labels. An AI assessment is never styled like a verified fact.

• VerifiedCollected directly from the source API named in the row.
• DerivedComputed by a published rule from verified evidence.
• ApprovedAn editorial decision a named reviewer approved.
• ProposedAwaiting editorial review. Not applied to any score or status.
• Maintainer claimStated upstream, not independently confirmed.
• AI assessedA model's interpretation of attached evidence.
• UnknownThe source was asked; its answer does not settle the question.
• UnavailableThe source does not expose this, or the request failed.
• ConflictingSources disagree.

Three separate answers, because they legitimately disagree:

• Lifecycle is GitHub's own flag: active, archived, or disabled.
• Status is derived by rule unless a reviewer has approved a decision. The 6-month rule uses the latest commit on the default branch not authored by a bot account — never GitHub's pushed_at or updated_at, which move on pushes to any branch and on metadata edits. The cutoff date applied is stored with every evaluation.
• Derived rules, in order: archived or disabled → Archived; primary package deprecated on npm → Review required; created inside the window → Emerging; latest non-bot commit on or after the cutoff → Active; otherwise → Review required.
• Evergreen and Superseded are never derived. A reviewer approves them with evidence URLs, and a proposer cannot approve their own proposal. Until then a proposal is shown as a proposal and applies to nothing.
• Recommendation is withheld until review, except that an archived repository is marked for existing projects only.

Each dimension averages the sub-signals that have evidence. The overall score is the weighted mean over covered weight, published next to the share of weight that evidence covers. Below 50% no number is shown; below 80% it is labelled provisional. In this version security advisories, dependencies, and operational burden are not yet collected, so every score is provisional.

Critical gates cap the overall score after weighting, so strong documentation cannot average away an archived repository: repository is archived upstream (cap 39); repository is disabled on github (cap 39); primary package is deprecated on npm (cap 54); license could not be machine-identified (cap 69).

Bands: Exemplary ≥ 90, Strong ≥ 80, Sound ≥ 70, Evaluate carefully ≥ 55, Elevated risk ≥ 40, High risk ≥ 0. Confidence follows covered weight (High ≥ 80%, Medium ≥ 65%, Low ≥ 50%, Insufficient ≥ 0%) and drops one level when evidence is older than 14 days.

Evergreen repositories. Once a reviewer approves Evergreen, these activity signals are marked not applicable rather than scored: human-commit-recency, active-weeks, release-recency, active-contributors, concentration. Until then, low activity counts as risk.

Momentum compares a current window with the previous window of the same length, per signal family, using only verified history: GitHub's weekly commit totals, a dated commit scan, npm's daily download series, and star counts from earlier RepoFacts snapshots. History is never backfilled or interpolated.

• Development: commits in the last 13 weeks vs the 13 before. Minimum previous baseline 26.
• Contribution: distinct non-bot authors in the last 90 days vs the 90 before. Minimum baseline 3. Not measured when the commit scan hit its page cap.
• Adoption: primary npm package downloads per day, last 90 days vs the 90 before, excluding registry gap days. Minimum baseline 50/day. A repository without a catalogued package is unmeasured, not zero.
• Attention: stars gained in the last 30 days vs the 30 before, from RepoFacts' own snapshots. Minimum baseline 30.

Direction per family: ≥1.5× rising strongly, ≥1.1× rising, ≤0.9× falling, ≤0.67× falling strongly, otherwise flat. The trend needs at least two measured families: Surging and Contracting need two moving the same way with one strongly; rising and falling families together read Volatile, never an average.

A composite momentum score and the Hidden Gem badge (under 5,000 stars, multi-signal, healthy) require a category cohort of at least 8 repositories. No category meets that yet, so both are withheld.

Stack fit answers a different question from health: does this repository suit a specific runtime, database, framework, and deployment? It will read the technology preferences a user saves in a Cheat Code, report hard blockers before any weighted number, and keep a TokenCheat baseline separate from a personal fit. It is not evaluated in this version, and no page shows a fit score.

• A collector calls only api.github.com, registry.npmjs.org, and api.npmjs.org. It never fetches a URL found in repository content.
• Nothing from a repository is cloned, installed, or executed. Repository text is data and is rendered as plain text.
• Each collection is written as a dated JSON snapshot keyed by GitHub's numeric repository id, so a rename or transfer keeps one history. An unchanged day writes nothing.
• Pages are built from committed snapshots. No provider API is called when a page renders.
• A failed collection keeps the last good snapshot, which ages into a visible stale state after 14 days.

Each repository has exactly one primary category, from 67 categories. Secondary capabilities are tags and never replace it. A category is a reviewed decision like any other.

• No security advisories, OpenSSF Scorecard, dependency graph, or release provenance yet. No advisory data is not evidence of no vulnerabilities.
• Activity is measured on the default branch only; projects that develop on release branches look quieter than they are.
• Contributor counts are commit authors. Co-authors, reviewers, and issue triage are invisible.
• npm download counts include CI installs, mirrors, and bots, and cover only JavaScript packages. Private and enterprise adoption is invisible.
• Star history starts with RepoFacts' first snapshot of a repository.
• The catalog is small and hand-curated, which biases it toward already-visible projects.