Maturity

Where: Maturity in the sidebar (#/maturity).

Maturity answers are we set up correctly, and what would make us better? It reads your most recent completed gap analysis and turns it into a score, a list of what is pulling the score down, and what closing each gap takes. It is part of the core product, separate from Compliance.

What you see

Header

• An Application picker, shown when more than one Application has been scored. The default, most recent run, shows whichever ran last.
• A scope line: Scored from app’s EnvironmentProfile. If your other Applications declare their own profiles, it adds that they are not included in this score.
• Run a new gap analysis → (goes to Gap analyses).

If no gap analysis has completed, the screen says so and offers Run a gap analysis.

The hero

• The tier badge: bronze below 60%, silver from 60%, gold from 90%.
• A three-part bar:
  • verified: rows TruStacks has confirmed from evidence. The only part it stands behind.
  • credited: the extra credit from claims it could not check (claims count half).
  • potential: where the score would be if every claim were verified.
• ▲ / ▼ N pts since last run (or no change since last run), comparing with the previous run of the same Application only. A drop is shown in amber, not red: a score becoming more honest is not a failure.
• Tooling categories and Behaviors bars, one segment per scored row.
• A list of any practices: keys in your profile that are not part of the vocabulary. They are not scored; check for a typo.

Open gaps (left)

What’s pulling the score down.

• One card per unsatisfied tooling category: the category, the rule that requires it, the recommended tool and why. Draft pipeline PR asks the crew to add that tool’s step to your pipeline and opens a proposal (Watch the crew work →). The card says plainly that your score moves only once you also declare the tool in environment-profile.yaml, because that declaration is yours to make.
• A behaviors card (N behaviors unearned), split three ways:
  • You declared these, and what we found disagrees (disputed);
  • You’ve declared these … and we couldn’t verify them (claimed, counted half; nothing is wrong with them);
  • You have not declared these yet (missing).

If nothing is pulling the score down, the card says everything scored is covered.

• Your rules, when your overlay rules ask for categories or behaviors the constitution does not: each one with its status and the rules that need it. They are enforced on every proposal, but they are not rows in the score: the rows come from constitution rules alone. An overlay rule’s gap can still lower the status of a constitution row it shares.

Path to gold (right)

What is left, in two voices:

• Yours: tooling gaps the crew can open PRs for now, and behaviors that need the practice in place and declared by you.
• Ours: declared rows that count half until TruStacks sees them in your pipeline, rows TruStacks has no way to observe yet (these can only ever count half, and it names them), and the score that closing every gap on the page would actually reach. If that ceiling is below 90%, it says gold is not reachable yet and why.

What it means

The score is built from rows. There are two kinds:

• Tooling categories: do you have the tool? Declared under a category in your profile.
• Behaviors: do you use it correctly? Five keys under practices:: tests_in_ci, linting_in_ci, manual_promotion_to_prod, non_root_containers and supply_chain_pinning.

Only rows that some constitution rule scores appear in the score; rows only your overlay rules ask for are listed under Your rules instead. Each row has a status:

The headline score is the weighted average; the tier comes from it. Evidence comes from what TruStacks can observe: the workflow content in your pipeline (a declared scanner is verified when its step is there) and the constitution’s verdicts on your latest judged proposal (for example whether the workflow has a test step), plus the Code Reviewer’s analysis. Missing evidence never demotes a claim; only contrary evidence does.

The full model, and why it works this way, is in Verified, claimed and disputed and the maturity scoring reference.

What to do here

1. Start with Open gaps. For a tooling gap, Draft pipeline PR, review and merge the PR, then declare the tool in your profile.
2. For a missing behavior, put the practice in place, then add the line to practices:. For a disputed one, read the note: the evidence disagrees with your claim, so fix the pipeline or remove the claim.
3. Run a new gap analysis and compare.

How it connects

• The input comes from Gap analyses, the profile on Stack, and the rules on Rules.
• Draft pipeline PR creates a proposal.
• The headline also appears on Overview.

Beta limits

• Per Application, no roll-up. There is no organization-wide score.
• Not every category is scored. Several of the twelve tooling categories have no scoring rule yet; declaring them guides the agents but does not move the score.
• Gold needs a current runner. The ceiling depends on the rule inventory your runner reports. Reports from runs that predate the ceiling calculation show no ceiling and ask you to run a new analysis.
• Every tooling gap card is labeled missing, even when the underlying status is disputed.
• A “what we did not check” coverage view is planned, not built.