Rakazo AI Teammates

Least privilege scores 1: CI uses contents: read and the product claims isolated private computers, but bots also receive browser, terminal, file, desktop, and delegation powers without supplied evidence of runtime privilege minimization. User confirmation scores 0 because no source shows mandatory approval before tool calls, integrations, or consequential actions. Data-flow transparency scores 2: the README identifies model, voice, sandbox, and connector providers and their credentials, but lacks field-level flows and retention rules. Sensitive-data handling scores 2: it requires independent strong secrets and states connector credentials are server-encrypted and never returned by the API, while implementation, rotation, and deletion details are absent. Dependency security scores 2 due to a pinned package manager, frozen-lockfile installs, read-only CI permissions, and private vulnerability reporting, with no shown audit automation, update policy, or SBOM. External effects score 1: external APIs, terminals, computers, and test-machine destruction are disclosed, but approval and containment controls for ordinary agent actions are not shown. Rollback scores 1: backup and upgrade documentation is referenced and desktop server changes preserve the previous selection when cancelled, but the guide is absent and there is no general undo mechanism. Source attribution scores 2 because repository, contributor, maintainer, security, and support identities are stated; the publisher remains unverified and full provenance is therefore not established.

Self-consistency scores 3: README commands, architecture, test layers, package scripts, and CI jobs align without visible contradictions. Dependency availability scores 2: Node, pnpm, Docker, database, and optional-provider requirements are explicit and several providers are supported, but offline guarantees and provider-outage behavior are not documented. Failure messages score 1: health validation, safe skipping of unconfigured canaries, and prerequisite checks are visible, while systematic user-facing diagnostics and recovery guidance are not.

Audience and scenarios score 2: self-hosting, web, desktop, mobile, shared/private computers, and multiple model providers cover ordinary scenarios, but user personas and selection guidance are limited. Capability boundaries score 2: features, test modes, external services, and security-policy exclusions are stated, though detailed bot prohibitions and permission boundaries are missing. Trigger precision scores 1 because routines, calls, delegation, and integrations are named without evidence of exact trigger rules, ambiguity handling, or false-trigger prevention. Environment fit scores 3: versions, full local operation, multiple clients, HTTPS/LAN constraints, and Docker, E2B, Daytona, and local-computer options are documented thoroughly.

Information architecture scores 3: features, setup, clients, development, tests, documentation, contribution paths, and monorepo directories are clearly organized. Install notes score 3 with exact prerequisites, environment setup, required secrets, migration, sandbox build, and launch commands. Naming stability scores 2: product, packages, and scripts are consistent and versioned 0.1.0, but beta status and absent compatibility commitments prevent full marks. Examples and FAQ score 2: runnable setup and provider-test examples plus desktop connection behavior are present, but there is no full FAQ or task-oriented usage catalog. Known limitations score 2: beta status, security exclusions, secret-gated live tests, and lack of a bounty are disclosed, though product limitations are incomplete. License scores 3 because metadata, README, and the complete Apache-2.0 text agree. Versioning and changelog score 1: a package version and latest-beta support concept exist, but no changelog or migration history is supplied. Maintenance responsibility scores 2: maintainer, security and support contacts, and supported branches/releases are stated; registry verification, response targets, and long-term commitments are absent.

Output usability scores 2: persistent conversations, memory, voice, history, and multiple clients suggest reusable results, but output schemas, export paths, and representative quality examples are not shown. Marginal value scores 2: selectable models and sandboxes, persistent bots, multi-client access, and broad integrations form a useful combination, without comparative evidence against alternatives. Cost-benefit scores 2: a fully local stack and optional managed catalogs are offered, and Treg metering is disclosed, but resource benchmarks, cost estimates, and default spending limits are absent.

Claim traceability scores 2: many operational claims map to named documents, commands, scripts, or workflows, but implementation files supporting key runtime-security claims are not included. Cross-source corroboration scores 3: README, license, package metadata, and workflows independently agree on licensing, versions, dependencies, scripts, and test structure. Fact-inference separation scores 2: required versus optional components, beta status, and third-party exclusions are generally explicit, but assertions such as isolation and credentials never being returned lack supplied implementation evidence and cannot receive full marks.