Correcting HVTrust: A Calibration Fix and a New Coverage Grade

Trust infrastructure only works if it holds itself to the same standard it asks of everyone else. So here is a correction, in the open: we found and fixed a bug that had been quietly inflating HVTrust scores, and we shipped a new grade that makes the depth of evidence behind every score impossible to hide.

What went wrong

Since methodology v4.0, the production score has been the supply-chain base score plus a small, bounded runtime-trust adjustment — at most a few points up or down for things like MCP support, external dependencies, and package-provenance drift. That adjustment was never meant to move a score by more than about five points.

A defect in the build loop broke that promise. Each build is supposed to compute the adjustment on top of the base score. Instead, it computed the adjustment on top of the previous build's already-adjusted score. The small nudge stacked on itself every build — and with a rebuild every 30 minutes, it compounded relentlessly toward the ceiling.

The fix (methodology v4.2)

The correction is one line of intent: every build now re-derives the score from the base and applies the runtime adjustment exactly once. Builds are idempotent again — run the same inputs twice and you get the same score, not a higher one. A regression test now fails if that property ever breaks.

With the compounding gone, the leaderboard de-inflated to what the evidence actually supports. No wall of hundreds; the top of the board is a spread of distinct, defensible scores:

Because this is a methodology change, rank-trend sparklines restart at v4.2, and we suppressed the one-time notification deltas across the cutover so watchlists were not spammed with a correction they did not cause. The full record lives in the methodology changelog and trust policy log.

A new grade: Evidence Coverage

A score-inflation bug is exactly the kind of thing a trust registry should be most paranoid about — so we also shipped something that makes scores harder to over-read in the first place.

Every agent now carries a second, separate Evidence Coverage grade (A–D). It does not measure how high the score is. It measures how many independent public signal types back that score: GitHub repo data, package downloads, supply-chain evidence (OSSF Scorecard or build provenance), behavioural signals, and public discussion — five possible types.

You will find it on every agent page and in the public API (coverage_grade, signal_types). The HVTrust score answers "how trustworthy does the evidence say this is?" Coverage answers "how much independent evidence is there at all?" Both matter, and now both are visible.

Why we published this

We could have shipped the fix silently — the numbers simply corrected themselves on the next build. We are writing it up because the entire premise of HVTracker is that verification and methodology stay public, including when the methodology was wrong. A trust score you cannot audit is just another opinion.

If you maintain a project we track and think its score or coverage grade is wrong, the evidence is public and every agent page has a "Suggest correction" link. That is the point: the verdict stays open.