LintLang

Evidence shows a local, zero-LLM static linter that scans directories read-only and does not run models or observe runtime tool choices, so the permission surface is small (least_privilege=2). However, the README does not state whether scanned content (which may contain secrets in prompts/configs) is read, cached, or uploaded, and there is no data-flow or privacy note (data_flow_transparency=2 only because 'local, zero-LLM' is explicitly claimed; sensitive_data_handling=1 for the missing handling statement). On confirmation, findings are advisory by default, but --fail-on fail/review makes CI fail directly, an external consequence with no interactive confirmation path (user_confirmation=1). Dependencies are limited to pyyaml>=6.0.3 with bounded dev deps, and CI pins GitHub Actions by commit SHA, which is positive (dependency_security=2); no SBOM, audit, or vulnerability-response detail is provided. External effects are limited to writing SARIF/JSON reports and baseline files, with no destructive defaults (external_effects=2). For rollback, --write-baseline and baseline gating provide a form of change control, but there is no documented way to undo generated reports or config (rollback=1). Source attribution is clear (Hermes Labs, Apache-2.0, SECURITY.md contact), though the publisher is unverified (source_attribution=2).

Self-consistency: README's stated boundaries (no semantic-contradiction detection, SKIPPED is not PASS, tool comparison is within one parsed input) align with the pyproject description and the CI self-scan of samples (self_consistency=2). Dependency availability: requires-python>=3.10, CI covers 3.10-3.13, the only runtime dependency is pyyaml, and install paths (uvx/pip/brew) are explicit (dependency_availability=2). Failure messages: the devcontainer test asserts an 'Input error' on malformed input, and README distinguishes SKIPPED from PASS, so failure/skip semantics are identifiable (failure_messages=2); no concrete message format or exit-code table is shown.

Audience and scenarios: aimed at developers and CI, with GitHub Actions, GitLab, pre-commit, and multiple CLI integrations (audience_and_scenarios=2). Capability boundaries: README explicitly lists what it does not do (no model execution, no runtime observation, no production-safety guarantee, no semantic-contradiction detection) and explains SKIPPED semantics, which is a strong boundary statement (capability_boundaries=3). Trigger precision: --fail-on fail/review plus baselines give tiered gating, but rules like H5/H6 are described as flagging any two recognized formats, which may be noisy, and no threshold tuning is documented (trigger_precision=2). Environment fit: multiple Python versions, Homebrew, and devcontainer are supported, but Windows or non-POSIX environments are not addressed (environment_fit=2).

Information architecture: README is well structured (capabilities, quickstart, CI, integrations, docs, contributing, license), but llms-full.txt and docs/ content are not in evidence and cannot be verified (information_architecture=2). Install notes: uvx, pip, brew, and lintlang init all have concrete commands (install_notes=3). Naming stability: rule IDs (H1.1, H3, H5, H6, H1.9) appear in README and CI, but no versioned rule-ID stability commitment is given (naming_stability=2). Examples and FAQ: quickstart examples and devcontainer test fixtures exist, but there is no FAQ (examples_and_faq=2). Known limitations: explicitly lists no semantic-contradiction detection, SKIPPED semantics, and tool-comparison scope (known_limitations=3). License: full Apache-2.0 text matches the pyproject declaration (license=3). Versioning and changelog: pyproject is 0.8.1 while CI references v0.7.1, and CHANGELOG.md is linked but not provided (versioning_changelog=2). Maintenance responsibility: SECURITY.md gives response timelines and a contact email, but the publisher is unverified so the commitment cannot be independently confirmed (maintenance_responsibility=2).

Output usability: JSON, SARIF, and GitLab Code Quality outputs are supported, and CI validates SARIF structure and rule IDs, so output is machine-consumable (output_usability=2). Marginal value: it offers targeted checks for agent configs and tool descriptions that general linters do not, which is differentiated, but no comparison with existing tools or false-positive data is given (marginal_value=2). Cost-benefit: zero-LLM, deterministic, single dependency, runnable via uvx, so cost is low; scan latency or large-repo behavior is not quantified (cost_benefit=2).

Claim traceability: README cites merged PR #5656 and Zenodo DOIs, but those external artifacts are not in evidence and cannot be checked (claim_traceability=2). Cross-source corroboration: README, pyproject, CI, and devcontainer tests agree on versions, commands, and rule IDs (cross_source_corroboration=2). Fact-inference separation: README clearly separates static findings from production-safety claims and states SKIPPED is not PASS (fact_inference_separation=2); however, the screenshot is labeled 'stylized' and the finding it depicts cannot be verified from the evidence.