| name | patch-trust-score |
| description | Assign a confidence and risk rating to every AI-generated change. Returns safe, review-required, or high-risk verdict with specific signals. |
| origin | FlowDeck |
Patch Trust Score
Every AI-generated patch gets a trust score before it is applied. The score gates how the change is handled: auto-apply, flag for review, or block and escalate.
Score Bands
| Score | Verdict | Action |
|---|
| 80–100 | safe | Auto-apply in guarded mode |
| 40–79 | review-required | Inline warning + human ACK |
| 0–39 | high-risk | Block auto-apply, route to reviewer |
Risk Signals (each reduces the score)
| Signal | Deduction |
|---|
| File has prior failure history | −20 |
| Edit contains auth/crypto/payment keywords | −8 per keyword (max −30) |
| File in arch-constrained zone | −20 |
| No test coverage for file | −10 |
Workflow
- For every proposed write or edit:
a. Check
.codebase/FAILURES.json for prior failures on this file
b. Scan the patch content for high-risk keywords
c. Check .codebase/CONSTRAINTS.md for boundary violations
- Compute score (0–100, start at 100)
- Emit verdict with signals
- Route accordingly (auto / warn / block)
Integration
The patch-trust hook runs automatically on every write and edit tool call. The score is logged to stdout and appended to .codebase/DECISIONS.jsonl.
For manual scoring, use the patch-trust-score skill with a file path and change description.
