Trust
A level is computed, never assigned. Every one is a predicate over evidence you could recompute yourself, evaluated when a record is served rather than stored — a stored level is one somebody forgets to refresh, and a stale badge is worse than none.
| Level | The claim | Who issues it | Verifiable without a runner |
|---|---|---|---|
| T0 | Indexed: parsed, metadata extracted. | the catalog, automatically | yes |
| T1 | Conformant: schema and profile linter passed. | the catalog | yes |
| T2 | Audited: every gate below passed. | the catalog | yes |
| T3 | Attested: a verified signature over a run, bound to this content hash. | a publisher or an independent verifier | not the run — the signature and hash are |
| T4 | Corroborated: three independent attestations inside the window. | aggregated by the catalog | yes |
What T2 actually requires
T2 is a conjunction of named gates rather than a judgement, so a record that fails it can be told which one and what to do. Each links to the rule it enforces.
licence/missing— No licencelicence/unrecognised— Licence not recognisedlicence/not-indexable— Licence forbids indexingcapabilities/undeclared— Step needs a capability the runbook does not declarecapabilities/redundant— Capability no step usescapabilities/unanalyzable— Command cannot be analysedsecrets/aws-access-key— AWS access key idsecrets/aws-secret-key— AWS secret access keysecrets/github-token— GitHub tokensecrets/slack-token— Slack tokensecrets/private-key— Private keysecrets/jwt— JSON web tokensecrets/connection-string-password— Password in a connection stringsecrets/generic-high-entropy— High-entropy string with no recognised formatsecrets/private-address— Private network addresssecrets/cloud-account-id— Cloud account identifierinjection/instruction-override— Overrides the reader's instructionsinjection/role-assignment— Assigns the reader a roleinjection/system-prompt-mimicry— Imitates a prompt boundaryinjection/output-coercion— Dictates how the reader should answerinjection/tool-coercion— Tells the reader to skip an approvalinjection/exfiltration— Instructs the reader to send credentials somewhereinjection/hidden-content— Content a reviewer does not see
Trust expires
An attestation older than 180 days stops counting and the record falls back to T2. Update drift is cured by an expiry date, not by a promise — which is why a badge without a date is not permitted anywhere in this catalog, and why the date you see is the attestation’s rather than the day the page was built.
Why there is no score
A number like “98/100” cannot be checked without its methodology, and a rating nobody can check is a rating nobody should believe. We publish a level, its date and its issuer instead, and we publish the methodologies too: how injected instructions are detected, how the ladder is computed, and every rule a record can fail.
Check it yourself
The claim “you can verify this without us” is only worth making if it is a command. Clone the repository, build the catalog, and verify a published record against its own content hash:
pnpm build
npx @runbooks/cli verify adapted/a-prompt-the-filter-refuses@1.0.0 --catalog dist/catalogIt prints the hash it computed. If that differs from what the record declares, the document changed after it was published and the command exits non-zero — which is the whole point: the check does not ask you to trust its answer.
What is here now
30 records in std/, the one namespace this catalog owns. It illustrates the specification and claims no completeness. The example above currently sits at T2, attested 2026-10-11 by runbooks.directory.