Prove · Accountability leaderboard

Accountability leaderboard

A neutral, opt-in ranking of teams on two rates an enterprise cares about, each recomputed from signed attestations rather than asserted by us. The two rates: verified human-review rate (how many classified merges a human actually reviewed) and agent merge-survival rate (how many agent merges survived without a revert or defect). The SWE-bench loop applied to accountability, not capability.

Where to find it

  • Localhost: /cna-leaderboard.html?repo=<id>
  • API: GET /api/cna/leaderboard (single-org board), GET /api/cna/federated-leaderboard (cross-org), GET /api/cna/public-directory (agent directory)
  • Keyboard: ⌘ K then leaderboard
  • Sidebar: Prove → Accountability leaderboard

What it does for you

Two rates, recomputed from attestations.The verified human-review rate and the agent merge-survival rate are recomputed server-side from each team's signed attestations, never read from a self-asserted number. Anyone can reproduce the ranking from the same evidence.
Anti-gaming guards you can audit.A team appears only if it opted in (the REPOOPS_CNA_LEADERBOARD_OPTIN allowlist). A posted rate the attestations do not support is quarantined (contamination). Cherry-picking survivors is quarantined (selective disclosure). Below the data-sufficiency floor a team renders honest-null, not ranked. Excluded teams are shown with their reason, never silently dropped.
Federated cross-org board.Below the single-org board, rankings compose across opted-in orgs. Each rate is recomputed only from that org's witnessed attestations (the transparency log), so an org cannot inflate its own number. A sybil guard collapses two orgs that claim the same witnessed merge, or share an entity fingerprint, into one accountability domain and quarantines the duplicate.
Public agent directory.The agent registry federated across opted-in orgs, keyed on a vendor-neutral identity so the same agent run by two orgs is one row. Each carries its portable score, marked verified only when the contributing org's attestation log is externally witnessed. Owner, pinned model, and lifecycle read honest-unknown when undeclared.

Published vs preview

The whole published board is an aggregate public claim, so it is gated. It stays an internal preview (no team labels, no rates) until four conditions hold: enough real classified merges, the truth-audit passed, RepoOps dogfooded it on its own repo, and one operator switch (REPOOPS_CNA_PUBLIC_CLAIMS=1). No number is hardcoded to pass the gate. A rate is null when its denominator is zero, so you never see a fabricated 0%.

Read more