Beacon

Data-flow transparency is strong: default local JSONL, explicit destinations, uninstall retention flags, and restricted log access are documented, so data_flow_transparency scores 3. However, install writes configuration into many harnesses, installs hooks and skills, and preselects Beacon Cloud forwarding, which is broad permission and external effect, so least_privilege and external_effects score 1. A confirmation screen and Local opt-out exist but cloud is preselected, so user_confirmation scores 2. Redaction, truncation, and 0600 key files are described, but the browser extension defaults to full prompt/response retention, so sensitive_data_handling scores 2. Dependency security is only checksums and an attestation mention with no dependency manifest or vulnerability governance, so dependency_security scores 1. Uninstall with --keep-logs/--keep-config provides a rollback path, so rollback scores 2. Attribution is only README and LICENSE naming Asymptote Labs with an unverified publisher, so source_attribution scores 1.

Install, uninstall, forwarding, and session-sync descriptions are broadly consistent, so self_consistency scores 2. Dependency availability relies on a Homebrew tap, release archives, and checksums with no lockfile or offline evidence, so dependency_availability scores 1. Failure messaging distinguishes PASS/FAIL/INCONCLUSIVE and WARN in the sandbox docs, so failure_messages scores 2.

README covers 20+ harnesses, browser chat, cloud agents, CI, and SDKs, so audience_and_scenarios scores 3. Capability boundaries are partly stated (macOS cannot be sandbox-tested, hook write failures are warnings) but remain promotional, so capability_boundaries scores 2. Trigger precision is weak: hooks, OTLP, and poll paths coexist without precise trigger conditions or deduplication, so trigger_precision scores 1. Environment fit covers macOS/Linux/Windows and systemd/launchd but lacks ARM and macOS sandbox coverage, so environment_fit scores 2.

Install notes are thorough (Homebrew, deb/rpm, MSI, manual archives, checksums), so install_notes scores 3. Information architecture has docs and README navigation but splits links across docs.beacon.sh and docs.asymptotelabs.ai, so information_architecture scores 2. Naming stability explains beacon-vector vs vector but product and domain names diverge, so naming_stability scores 2. Examples exist but no consolidated FAQ, so examples_and_faq scores 2. Known limitations are listed in the sandbox doc, so known_limitations scores 2. LICENSE is full MIT, so license scores 3. Versioning is only a badge and a version example with no CHANGELOG, so versioning_changelog scores 1. Maintenance responsibility is only a security email and Discord with an unverified publisher, so maintenance_responsibility scores 1.

Output is local JSONL plus a dashboard that can be inspected directly, so output_usability scores 2. Cross-harness memory reuse has a clear value proposition but no quantified evidence, so marginal_value scores 2. Cost includes installing a service, modifying many harness configs, and possibly uploading 30 days of history, with insufficient cost-benefit discussion, so cost_benefit scores 1.

Most README capability claims point to external docs rather than in-repo verifiable files, so claim_traceability scores 1. In-repo files (README, SECURITY, docs) partially corroborate each other but lack tests or code evidence, so cross_source_corroboration scores 1. Facts and inferences (e.g., 'self-improving') are mixed, so fact_inference_separation scores 1.