Paseo

Evidence shows: SECURITY.md details the relay threat model, end-to-end encryption, DNS rebinding protection, HTML preview sandbox, and agent authentication boundaries, indicating a clear understanding of data flow and security boundaries. However, there is no user confirmation mechanism (e.g., confirmation prompts before sensitive actions) and no rollback functionality. Dependency security: CI includes lockfile-lint and npm audit signatures, but no vulnerability scan results are provided. External effects: agents can execute arbitrary commands, but documentation does not explain how to limit or rollback. Source attribution: author identity is clear, but publisher is unverified. Therefore, least privilege, user confirmation, external effects, rollback, and source attribution score low.

Evidence shows: README and SECURITY.md describe architecture and features consistently, and CI configures multi-platform tests, indicating good self-consistency. Dependency availability: uses npm workspaces, but no dependency locking or mirror information is provided. Failure messages: CLI tests check error output, but no user-friendly error handling documentation is provided. Therefore, self-consistency and dependency availability score moderate, failure messages score low.

Evidence shows: README describes multiple usage scenarios (desktop, mobile, CLI, voice control) and supports multiple agent providers, indicating good audience and scenario coverage. Capability boundaries: documentation describes supported agents and features, but no explicit limitations. Trigger precision: CLI commands and skills have clear usage, but no detailed trigger conditions. Environment fit: supports multiple platforms and self-hosting, but no detailed system requirements. Therefore, audience and scenarios, capability boundaries, environment fit score moderate, trigger precision score low.

Evidence shows: README provides clear information architecture, including installation, CLI, skills, development sections. Installation notes are detailed, including desktop app and CLI. Naming stability: project name and CLI commands are consistent, but no naming conventions. Examples and FAQ: README provides CLI examples, but lacks FAQ. Known limitations: SECURITY.md mentions HTML preview limitations, but not comprehensive. License is AGPL-3.0, but metadata is NOASSERTION. Versioning and changelog: version number exists but no changelog. Maintenance responsibility: author is clear, but no contribution guidelines. Therefore, information architecture, installation notes, examples and FAQ, license score moderate, naming stability, known limitations, versioning and changelog, maintenance responsibility score low.

Evidence shows: Output usability: CLI provides clear commands and output, but no output format documentation. Marginal value: tool provides multi-agent orchestration and cross-device access, offering unique value. Cost-benefit: self-hosted and open-source, but no performance or resource consumption data. Therefore, output usability and marginal value score moderate, cost-benefit score low.

Evidence shows: Claims in README (e.g., privacy-first, end-to-end encryption) are detailed in SECURITY.md, but no independent verification. Cross-source corroboration: community links exist, but no third-party audit. Fact-inference separation: documentation distinguishes facts and inferences, but not explicitly labeled. Therefore, all sub-items score low.