---
schema_version: "newruntime-agent-readable-v0.2"
type: "project_acceptance_checklist"
stable_id: "project_acceptance_checklist:github-projects-for-ai-engineers"
project_slug: "github-projects-for-ai-engineers"
project_title: "GitHub Projects for AI Engineers"
buildability_class: "B2"
verification_status: "locally-reproduced"
proof_artifact_count: 6
buildability_axis_count: 7
replay_evidence_count: 2
project_status: "candidate"
last_verified: "2026-08-15"
record_date: "2026-08-15"
date_kind: "last_verified"
routes: {"build_brief":"https://newruntime.com/projects/github-projects-for-ai-engineers/build-brief.md","project_json":"https://newruntime.com/projects/github-projects-for-ai-engineers.json","html":"https://newruntime.com/projects/github-projects-for-ai-engineers/"}
---

# Acceptance checklist: GitHub Projects for AI Engineers

## Required checks

- Every retained repository has a public GitHub URL, canonical full name, stars, forks, theme, engineering area, and reason.
- The ranking is deterministic: stars descending, forks as the secondary signal.
- Private Telegram provenance is not exposed; public citations point to GitHub repository URLs only.
- The HTML radar and JSON dataset agree on project count, theme counts, and top-ranked repositories.
- The ecosystem section and JSON dataset agree on tool count, capability lanes, production-depth levels, link kinds, and source attribution.
- Astro build and agent index contract tests pass after the refresh.

## Permission and cleanup contract

| Access | Purpose | Minimum scope | Confirmation | Cleanup |
| --- | --- | --- | --- | --- |
| read | Read public repository metadata from GitHub. | Public repository pages or unauthenticated GitHub API reads where possible. | Human approves a current metric refresh before network calls. | Delete temporary metric caches after committing the normalized public dataset, unless retained as a dated local artifact. |
| publish | Update public site content after review. | Astro content/data files for this project and only after owner-approved deploy. | Human approves publication/deploy separately from the local refresh. | Rollback the focused site release if the public radar exposes private provenance or incorrect repository facts. |

## Reproducibility notes

- Record the metric refresh date and the exact sorting rule in the public method section.
- Keep dropped-repository reasons in a private local audit artifact, not in public source lists.

## Fixture outputs

- Structured radar dataset: dist/projects/github-projects-for-ai-engineers.json (https://newruntime.com/projects/github-projects-for-ai-engineers.json). Check: The JSON route exposes the ranked repository dataset, proof contract, handoff routes, and public GitHub source URLs.
- Human radar page: dist/projects/github-projects-for-ai-engineers/index.html (https://newruntime.com/projects/github-projects-for-ai-engineers/). Check: The HTML radar renders the same project count, theme lanes, and machine-readable handoff links as the dataset.
- Agent build brief: dist/projects/github-projects-for-ai-engineers/build-brief.md (https://newruntime.com/projects/github-projects-for-ai-engineers/build-brief.md). Check: The build brief names the data source, GitHub metric refresh boundary, privacy constraints, and acceptance checks.
- Clean-room replay fixture: scripts/project-proof-depth-v2-fixture-test.mjs. Check: The fixture replays the bounded deterministic-ranking task in a temporary directory, proves the initial failure of the wrong sort order, proves the final pass of the stars-then-forks rule, and verifies that an unrelated file is unchanged.
- Independent replay kit: scripts/project-proof-independent-replay-kit.mjs. Check: The kit starts with a ranking function that violates the published sort rule, exposes no ready solution, protects every out-of-scope file by checksum, and refuses to emit a receipt without a non-author attestation and a passing final check.
- Independent agent replay receipt: src/data/project-proof-receipts/github-projects-for-ai-engineers-independent-agent-v1.json (https://newruntime.com/projects/github-projects-for-ai-engineers.json). Check: A separately spawned agent received only the isolated kit, observed the failing deterministic-ranking check, changed only src/rank.mjs, passed the final check, and produced an attestation that the primary verifier accepted.

## Reproduction commands

1. npm run project-proof:replay:test
2. npm run project-proof:replay:prepare -- --project=github-projects-for-ai-engineers
3. npm run validate:content
4. npm run build
5. npm run validate:agent-indexes

## Expected artifacts

- A normalized repository dataset with canonical repo name, URL, stars, forks, theme, area, export hits, and reason.
- A deterministic ranking pass sorted by stars descending, then forks as the secondary signal.
- A normalized ecosystem dataset with official links, capability categories, production-depth levels, and explicit source notes.
- A private dropped-repository audit when refreshing from a local export snapshot.

## Buildability breakdown

| Axis | Level | Evidence | Bottleneck |
| --- | --- | --- | --- |
| time | high | The clean-room ranking task reaches a checked result in one bounded local run, while the public blueprint targets one local content pass plus a GitHub metric refresh. | A full radar refresh still depends on fetching current GitHub metrics for all 140 repositories. |
| code burden | medium | The replay needs one focused comparator edit plus the existing test, and the public blueprint needs normalization scripts and content validation rather than a bespoke application. | Curating theme lanes and relevance still needs an editor who knows the AI-engineering landscape. |
| integration burden | medium | The replay uses only repository files, Node, and a test runner, while the wider blueprint touches public GitHub reads and Astro content routes that already exist in this repository. | GitHub metric drift forces every refresh through an approved external read before the ledger is current. |
| operational burden | high | The first proof is local and temporary, requires no server, and touches no shared or production state. | Keeping the published radar current requires a recurring refresh protocol rather than one-off runs. |
| permission clarity | high | GitHub read, local Telegram-export read, and public-site publish scopes are named separately with explicit approval gates in the build brief and acceptance contract. | A live metric refresh and a public deploy still need two separate owner approvals. |
| reproducibility | high | A separately spawned agent received only the isolated public kit, reproduced the failing deterministic-ranking check, changed the one allowed comparator file, and passed the same acceptance check without inspecting the author solution. | The bounded fixture proves the published sort rule, not a full 140-repository refresh against live GitHub data. |
| failure recovery | high | The replay records the initial failing check, preserves an unrelated file byte-for-byte, performs no remote action, and leaves explicit residual-risk and approval sections. | Rolling back a bad public radar release is outside this local proof. |

## Replay evidence

### clean-room-bounded-edit-v1

- Date: 2026-08-15.
- Kind: automated-clean-room.
- Outcome: passed.
- Command: npm run project-proof:replay:test.

- This replay proves the deterministic ranking contract on a bounded fixture dataset, not a real external repository integration or a live GitHub metric refresh.
- No human or separately operated agent independently interpreted the brief in this clean-room replay.

### independent-claude-replay-v1

- Date: 2026-08-15.
- Kind: independent-agent.
- Outcome: passed.
- Command: node --test test/rank.test.mjs.

- This proves a bounded non-author replay of the public workflow contract, not integration into a production repository.
- Reviewer identity is a local agent attestation and is not cryptographically verified.

## Provider scopes

| Provider | Access | Minimum scope | Why needed | Approval gate |
| --- | --- | --- | --- | --- |
| GitHub | read | Public repository metadata and repository pages only. | Stars, forks, archived state, redirects, and canonical full names drift over time. | Human approves a live GitHub refresh before network calls. |
| Local Telegram export | read | Repository-link roots and duplicate counts from an approved local export snapshot. | The radar starts from private discovery provenance but publishes only public GitHub repository URLs. | Human names the export snapshot or existing dataset before extraction. |
| Public site | publish | Project content, project dataset, and generated static routes for this radar only. | The public radar must expose the refreshed structured dataset and human visualization together. | Owner approves commit, push, and deploy separately from the metric refresh. |

## Known limits

- GitHub stars and forks are time-sensitive; the public method must keep the refresh date visible.
- The first pass does not clone, run, or security-audit the listed repositories.
- Export-hit counts are discovery signals, not public provenance; raw Telegram data remains private.
- The ecosystem map is a navigation and architecture aid, not a compatibility matrix or recommendation to adopt every tool.
- The bounded replay proves the deterministic ranking rule on a small fixture dataset, not a full 140-repository refresh against live GitHub metrics.
- The independent replay proves the bounded public workflow contract, not integration into a real external or production repository.
- The independent reviewer identity is a local agent attestation and is not cryptographically verified.

## Failure conditions

- The claimed output cannot be reproduced from the build brief and public/project-local inputs.
- The implementation needs broader permissions than the minimum scopes listed above.
- Private discovery provenance, secrets, raw exports, or unapproved write actions appear in a public artifact.
- The current bottleneck remains unresolved: GitHub metrics drift quickly; every refresh needs a current GitHub read and a relevance pass against the corpus.

## Evidence to collect

- Commands or deterministic checks that were run.
- Changed files or generated artifacts.
- Screenshots or rendered QA only when a visual surface changed.
- Known residual risks and skipped checks.

## Related routes

- build_brief: https://newruntime.com/projects/github-projects-for-ai-engineers/build-brief.md
- project_json: https://newruntime.com/projects/github-projects-for-ai-engineers.json
- html: https://newruntime.com/projects/github-projects-for-ai-engineers/