Preview only. The intake pipeline (fetch → walk files → score via Lovable AI Gateway → persist report) isn't wired yet — the sample above shows the shape it will produce.
Each rubric item is tagged as code-verifiable (confirmed or denied from repo contents, with a file quote) or needs-org-artifact (a question a code review honestly can't answer — a signed policy, a research study, an audit report). This keeps the score credible instead of over-claiming what static analysis can prove.