feat(relevance): what a repository's public history looks like

[isaacismaelx14]

Phase 6A. Not trust, and the distinction is the reason this is its own thing:

Public   Repository relevance                        this PR
Private  Can Official KRED trust this interaction?   the Network

Everything here comes from signals GitHub already shows the world, with weights that are open source and reconstructible by anybody. That is fine precisely because nothing here decides issuance.

Law XXXI, enforced rather than described

GitHub stars may influence repository trust, but no single popularity metric defines economic legitimacy.

The score is capped by the breadth of evidence: a repository showing k of n signals cannot score above k / n of the maximum, whatever those k are worth.

That cap is derived from the law rather than chosen. One signal out of nine caps at a ninth, so a hundred thousand purchased stars with nothing else scores in single digits no matter how the reference points are tuned. There is no single number to buy.

There is a test sweeping all nine signals at four magnitudes each, up to MAX_SAFE_INTEGER, asserting none of them alone can push the score past 15.

Relevance never becomes trust

There is deliberately no function turning relevance into a RepositoryTrustTier, and a test asserts the module exports none. The absence is the safeguard, the same way the points module exports no path to KRED.

A relevance score that could become an eligibility tier would put issuance behind numbers anyone can read off a GitHub page.

Two honesty decisions

Reference points are open and stated as suggestions, not law. A reference that had to be secret would be a threshold, and a threshold on a public signal is what Law XXXI forbids relying on.

External contributors are reported as unfetched, never guessed. Kreds does not ask for the organization members permission, so it cannot tell a member from an outsider. This is one of the strongest signals a repository can have, and inventing it would be inventing legitimacy.

Absence is absence

A repository Kreds has not measured, or one GitHub could not be reached about, is a 404 rather than a score of zero. Not measured and no history are different facts.

Verified on a running API: 404 for an unmeasured repository, 400 for a malformed id.

357 tests. Format, lint, typecheck and build clean.

Not in this PR

Phase 6B is the authoritative global trust decision and lives in kreds-network. Its signals are private and its formulas stay there.