Gyoshu Research Lab

Evidence shows the install script is executed via curl piped to bash, and the README states Gyoshu executes Python code and writes to notebooks/ and reports/ directories, which are local filesystem writes. However, the repository does not provide install.sh source, permission declarations, or sandboxing details, so least_privilege cannot be confirmed and scores 1. For user_confirmation, /gyoshu-auto is described as a hands-off autonomous mode, and the README does not state whether confirmation is required before destructive operations, so user_confirmation scores 1. For data_flow_transparency, the README mentions runtime files (sockets, locks) are stored in the OS temp directory but does not explain whether data is sent externally or how LLM calls transmit data, so data_flow_transparency scores 1. For sensitive_data_handling, the repository contains no mention of credentials, PII, data masking, or key management, so it scores 0. For dependency_security, package.json declares sanitize-html and zod with caret ranges, and pyproject.toml has no runtime dependencies, but no lockfile or vulnerability audit is provided, so dependency_security scores 1. For external_effects, the README states Gyoshu will not modify .venv/, data/, or other existing files, but the install script writes to system paths and no uninstall method is described, so external_effects scores 1. For rollback, atomic-write tests show temp files are cleaned up on failure, but no overall install or research workflow rollback mechanism is provided, so rollback scores 1. For source_attribution, the README references OpenCode and Oh-My-OpenCode with links but does not detail code provenance, third-party reuse, or acknowledgements, so source_attribution scores 1.

For self_consistency, the README's described features (REPL, notebook generation, adversarial verification) align with package.json name/description, but pyproject.toml version is 0.1.0 while package.json is 0.5.1, an inconsistency, so self_consistency scores 1. For dependency_availability, package.json declares peerDependencies @opencode-ai/plugin >=1.0.0 and engines bun >=1.0.0, but no lockfile or install verification is provided, so dependency_availability scores 1. For failure_messages, the README provides a troubleshooting table (No .venv found, Bridge failed to start, Session locked, etc.) but does not show actual error message formats or log examples, so failure_messages scores 1.

For audience_and_scenarios, the README clearly distinguishes interactive, autonomous, and REPL modes and provides use cases for researchers, so audience_and_scenarios scores 2. For capability_boundaries, the README states Gyoshu is standalone and does not require Oh-My-OpenCode, but does not clearly state what it cannot do (e.g., no native Windows, no non-Python languages), so capability_boundaries scores 1. For trigger_precision, the command list (/gyoshu, /gyoshu-auto, /gyoshu plan, etc.) is clear, but command conflicts or mis-trigger handling are not described, so trigger_precision scores 1. For environment_fit, the README lists a Linux/macOS/Windows(WSL2) support matrix and Python 3.10+ requirement, so environment_fit scores 2.

For information_architecture, the README is well-structured with installation, commands, workflow, project structure, and troubleshooting sections, so information_architecture scores 2. For install_notes, three installation methods (curl, clone, npm/bunx) and a verification command are provided, so install_notes scores 2. For naming_stability, the project is named Gyoshu/Jogyo in the README, gyoshu in package.json and pyproject.toml, but the repository is My-Jogyo, an inconsistency, so naming_stability scores 1. For examples_and_faq, the README provides code and command examples but no dedicated FAQ section, so examples_and_faq scores 1. For known_limitations, the README mentions Windows WSL2-only and Python 3.10+ but does not systematically list other limitations, so known_limitations scores 1. For license, the README and package.json both declare MIT, but no LICENSE file content is provided in the repository root, so license scores 2 (consistent declaration but missing file evidence). For versioning_changelog, the README references CHANGELOG.md but its content is not provided, and package.json and pyproject.toml versions are inconsistent, so versioning_changelog scores 1. For maintenance_responsibility, package.json has author and repository fields but no maintainer, support channel, or response time is described, so maintenance_responsibility scores 1.

For output_usability, the README states outputs are reproducible .ipynb files, reports, figures, and models, and provides a project structure, so output_usability scores 2. For marginal_value, the project offers research automation and notebook generation, but similar tools exist and the README provides no comparison or unique value proof, so marginal_value scores 1. For cost_benefit, installation requires OpenCode, Python 3.10+, and bun, and autonomous mode may consume many LLM calls, but the README does not describe resource consumption or cost, so cost_benefit scores 1.

For claim_traceability, README feature claims (e.g., adversarial verification, trust scores) are partially reflected in test files (adversarial-flow.test.ts), but tests only validate data structures rather than end-to-end behavior, so claim_traceability scores 1. For cross_source_corroboration, README, package.json, pyproject.toml, and test files are partially consistent, but version numbers are inconsistent and install.sh source is missing, so cross_source_corroboration scores 1. For fact_inference_separation, some README statements (e.g., 'will not modify .venv/') are assertions without code or test evidence, so fact_inference_separation scores 1.