deja-vu

Evidence shows: local index, no network listener, network only for update/sync/version check; SECURITY.md and a referenced security model document data flows and trust assumptions; go.mod declares no third-party dependencies, and CI runs govulncheck, go mod verify, and CodeQL. Deductions: the core Go source is not in the provided evidence, so 'no listener' is a documented assertion not statically verified; sensitive_data_handling stays at 2 because redaction is only visible as documentation, and the docs themselves state 'pattern matching is not secret detection'. user_confirmation gets 1: `deja install --auto` writes guidance into 22+ harness config files by default and the embed probe silently picks up localhost:11434/1234 — opt-outs exist (--no-guidance, DEJA_EMBED_OFF) but the default lacks per-target confirmation. external_effects 2: writes to many agent config files and injects PreToolUse/PostToolUse hooks — documented but broad. rollback 2: tombstones/--unforget/promote state changes provide memory rollback and cosign signing exists, but the client does not verify signatures by default (stated in SECURITY.md) and no automatic undo of config writes is shown. source_attribution 2: author named in LICENSE, per-harness source labels in search output; unverified publisher per rules is neither credited nor penalized.

Evidence shows: README is internally consistent (matrix, FAQ, benchmark numbers agree); CI enforces a recall regression floor and per-package coverage floors with a weekly canary; tests systematically pin edge cases (argv terminator, guarded registration, empty-answer retry bounds). Deductions: everything is static reading — no test or benchmark was executed; dependency_availability at 2 because external deps (sqlite3, zstd) are itemized per harness but failure paths are unverified; failure_messages at 2 since doctor/not-wired reporting is well designed but the binary's actual error output is not in evidence.

Evidence shows: a 25-harness support matrix with per-capability marks, including ⚠ 'blocked by an upstream bug' — honest capability boundaries; many install paths (brew/go install/npx/scoop/mcpb/plugin marketplaces); Windows, XDG_CONFIG_HOME, DEJA_*_ROOT and each agent's relocation variable handled. Full marks for audience_and_scenarios, capability_boundaries, environment_fit. trigger_precision 2: auto-recall trigger points (session start, pre/post tool) are precisely described, but actual precision is runtime behavior unverifiable statically.

Evidence shows: excellent information architecture (README → docs site → SECURITY-MODEL → JSON output docs); thorough install notes including the Windows exit message and alternatives; a direct FAQ on privacy, performance and differentiation; honest known-limitations coverage (redaction limits, ⚠ blocked items, CI comments documenting past incidents #1229/#838). license 3 (full MIT text). Deductions: naming_stability 2 — the six legacy tool names still answer (good backward compat) but a tool-consolidation migration is in flight; versioning_changelog 2 — package. 0.20.5 and a release badge exist but no CHANGELOG file appears in evidence; maintenance_responsibility 2 — 72-hour vulnerability response and clearly maintained CI are good, but only the latest release receives fixes and the maintainer is a single unverified individual.

Evidence shows: output is agent-usable by design (4KB cap, --, ctx Markdown digest, tier/total fields documented in SKILL.md); marginal_value rests on a clear differentiation claim (retroactive memory, no LLM required); cost_benefit cites concrete figures (~0.4 ms lookups, index ≈3% of corpus, ~200x token reduction vs grep). Deductions: all performance/recall numbers are author-reported; the bench harnesses ship in-repo but a static review cannot run them; output_usability 2 — the output contract is well documented but actual usability is unverified.

Evidence shows: claim_traceability 2 — benchmark harnesses ship in the repo, CI pins recall and coverage floors, and the README invites auditing ('Audit what relevant means before trusting any figure, ours included'); fact_inference_separation 2 — docs distinguish measurements from design intent (CI comments say 'measured, not assumed') and redaction incompleteness is stated plainly. Deductions: cross_source_corroboration 1 — the 85.3%/69.6% external benchmark figures and the 1,551-session store measurements are single-source self-reports with no independent corroboration in the evidence; core code is absent, so many claims remain at the documentation level.