Circuit grade
matrix: B
82% of the points that apply, read from conn3xorg/circuit-matrix at v0.1.1 on 2 November 2026. That's a pass.This tells you what we checked. It doesn't tell you the circuit is safe, because no grade can: it runs as root on your servers, so read it before you run it.
Testing
| Check | Result | Points | What we saw |
|---|---|---|---|
| CI isn't staying red on main (must pass) | Passed | 15 of 15 | Run of 2026-11-02 passed. |
| Applied on real distributions in CI | Passed | 10 of 10 | 4 in the matrix: debian13, fedora45, rocky10, ubuntu2404. |
| A second plan comes back clean (must pass) | Passed | 15 of 15 | CI fails if a plan after apply shows changes. |
| CI uses the thing, past "service is active" (must pass) | Passed | 20 of 20 | Step "Log in as the admin" runs: curl -sf -o /dev/null $u/health && break; sleep 1; done |
| CI checks secrets stay out of state | Failed | 0 of 10 | Has secret inputs, and CI never looks for them in state. |
| Restart or reboot tested | Doesn't apply | – | Runs no service. |
| Upgrade tested | Failed | 0 of 5 | No CI step upgrades an existing install. |
| Recent run on a real host | Failed | 0 of 5 | No real-host workflow has passed. A README saying so doesn't count. |
Supply chain
| Check | Result | Points | What we saw |
|---|---|---|---|
| Downloads are checksummed | Doesn't apply | – | Downloads nothing through a download step. |
| Container images pinned by digest | Passed | 5 of 5 | Every image reference has a digest, or is a repository whose digest is set elsewhere. |
| Pinned repo keys aren't near expiry | Doesn't apply | – | Pins no signing keys. |
| Default listen address | Passed | 5 of 5 | Found no default or literal that listens on every address. |
| Privileged shell patterns | Passed | 5 of 5 | Found none of the listed patterns. |
Repository
| Check | Result | Points | What we saw |
|---|---|---|---|
| Release tag is signed | Passed | 5 of 5 | GitHub verified the signature on v0.1.1. |
| Main is protected | Passed | 5 of 5 | A ruleset requires pull requests and passing checks. |
| Released recently | Passed | 5 of 5 | v0.1.1 is 0 days old. |
How to read this
Every point comes from a CI file, a workflow run or a signature that a script read. A README can't earn one. So a pass here means CI ran what it says; a miss can mean the work was done and never written into CI, which we count the same way. The rubric lists every check, what it's worth and what it can't see.
The CI run we read is on GitHub, so you can check our reading.
Badge
[](https://conn3x.org/circuits/matrix/grade)