Quality baseline

Build an evidence ledger, not a generic score. A missing checked-in control is a gap in visible repository evidence, not proof that no organization-level control exists.

1. Freeze repository identity

Record repository path, remote identity, HEAD, branch, working-tree state, stack, package manager, instruction files, CI workflows, and exact verification commands. Preserve unrelated changes.

Complete when: another reader can reproduce the inspected state and commands.

2. Map critical paths and controls

Trace the user-visible and operational paths whose failure would matter. For each path, map: