Roamgate

SECURITY.md gives very specific treatment of the trust model, default 127.0.0.1 binding, mandatory login, token/password/PIN strength and rate limiting, cookie signing-key rotation, and Web Push endpoint restrictions; sensitive_data_handling earns 3 for requiring 15-1024 character passwords, 256-bit random tokens, separate signing secrets, owner-only permissions, and signing-key rotation on credential change. least_privilege scores 2: default loopback binding and mandatory auth are good minimal-exposure practice, but the doc explicitly states UI access grants the user's full authority with no multi-user permission system or sandbox, i.e. privileged administration rather than least privilege. data_flow_transparency scores 2: token file paths, session cookies, push registry, and update origins are described, but the full data path for terminal/file content is not. user_confirmation scores only 1: update and push mutations require auth headers, but no confirmation flow is described for destructive operations such as workspace deletion or modifying real files. dependency_security scores 2: package.json pins highlight.js and undici via overrides and there is a bun audit --audit-level=high script, but the audit is not wired into CI and no lockfile content or vulnerability status is provided. external_effects scores only 1: the README states it controls terminals and modifies real files, but side-effect boundaries, audit logging, and blast-radius controls are not described. rollback scores only 1: update checksums, credential rotation, and session reset are mentioned, but there is no undo/rollback for file modifications or terminal actions. source_attribution scores 2: LICENSE names Arthur, package.json has author/homepage/repository, and THIRD_PARTY_NOTICES covers third-party assets, but publisher identity is unverified and the repo owner powerfooI differs from the author name, which is the deduction.

self_consistency scores 2: README, SECURITY.md, and package.json agree on version 0.8.3, Bun 1.4.3, MIT license, and the Herdr dependency, though README calls it a 'Herdr client' while package.json calls it an 'independent community Web and PWA client', a minor wording divergence. dependency_availability scores 2: engines requires bun>=1.4.3, packageManager pins [email protected], and CI uses --frozen-lockfile, so dependency availability is supported; however no lockfile content is provided to verify all dependencies. failure_messages scores only 1: SECURITY.md mentions 429/413 status codes and Retry-After, but that is security documentation rather than product error-message design; the repository shows no user-facing failure messages, diagnostics, or error taxonomy, so evidence is insufficient.

audience_and_scenarios scores 2: the README clearly targets desktop and mobile users, daily PWA use, and remote access, with screenshots and tutorial links, so the audience is clear. capability_boundaries scores 2: it states 'requires a running Herdr server', 'PWA mode is not offline access', 'Ranger is experimental', and 'automatic upgrades are not supported', so boundaries are documented; but unsupported operations and permission ceilings are not systematically listed. trigger_precision scores only 1: as a client product, trigger conditions (when to connect, when auth is required, when dev mode applies) are scattered across docs with no unified trigger/precondition list. environment_fit scores 2: Linux/macOS/Windows, x64/ARM64, Bun version, and PWA install paths are covered, but no per-environment verification evidence is given.

information_architecture scores 2: the README is well structured (screenshots, quick start, PWA, docs, development, security, license) and links FEATURES/DEPLOYMENT/ARCHITECTURE/SECURITY/CONTRIBUTING, though several linked files are not in the evidence. install_notes scores 2: Linux/macOS install script, Windows archive, PATH setup, and checksum guidance are given, which is fairly complete; but the install script itself is not in evidence and cannot be verified. naming_stability scores only 1: there are HERDR_GUI_* to ROAMGATE_* aliases, a herdr-gui to roamgate rename, and historical install paths, so naming stability carries clear legacy baggage. examples_and_faq scores only 1: screenshots and tutorial links exist, but there is no FAQ, common-error example, or configuration sample code. known_limitations scores 2: it explicitly lists no automatic upgrades, PWA not offline, weaker PIN, dev-mode auth bypass, and untrusted forwarded IPs, which is reasonably thorough. license scores 3: LICENSE is the full MIT text, package.json declares MIT, and the README explains code MIT plus third-party asset terms, so licensing is complete. versioning_changelog scores only 1: package.json has version 0.8.3 but there is no CHANGELOG file, so version history and change records are missing. maintenance_responsibility scores only 1: SECURITY.md has a vulnerability reporting process and CONTRIBUTING is linked, but the publisher is unverified and the responsible maintainer is unclear, which is the deduction.

output_usability scores 2: the product output is a browser/PWA interface, and screenshots show file browsing, diff annotations, terminal, and HTML preview as usable outputs for real scenarios. marginal_value scores 2: as a Web/PWA client for Herdr it adds mobile access and remote review capability over a pure desktop client, but it depends on the Herdr ecosystem, limiting standalone value. cost_benefit scores only 1: it requires a running Herdr server, Bun 1.4.3, a long-running process, and auth/TLS configuration, so deployment and operations cost is non-trivial while the benefit is mainly mobile convenience; the cost-benefit evidence is insufficient.

claim_traceability scores only 1: README and SECURITY.md claims are mostly prose with no references to specific code, tests, or configuration, so they cannot be traced item by item. cross_source_corroboration scores only 1: README, SECURITY.md, package.json, and CI workflows partially corroborate version, license, and Bun version, but there is no cross-evidence between security claims and code implementation. fact_inference_separation scores only 1: the docs mix factual statements with design intent (e.g. 'normal runtime requires login') without clearly separating verified facts from design goals, which is hard to disentangle under static review.