Michael Lieberman mlieberman85

darnit architecture: where it is and where it is going (September 2026)

darnit is a framework for harnesses that evaluate software projects against practices and standards (OpenSSF Baseline, reproducibility, gittuf, license compliance), collect the project data those evaluations need, and remediate gaps. Its core principle: do as much as possible deterministically, and hand work to an LLM only where that is more accurate or cheaper than the alternative -- never letting a model alone declare that something is compliant.

This page summarizes the current architecture, what an evaluation of it found, and the direction proposed in two RFCs:

RFC-0001 September 2026 revision: darnitdevorg/darnit#499
RFC-0002, darnit as an enablement layer: darnitdevorg/darnit#500
Findings tracker: darnitdevorg/darnit#491

Cross-tool conformance summary — 2026-05-05T18-49-30Z

Framework version: 0.1.0 Schema version: 2.0.0 Total evaluations: 280 Distinct tools: 9 Distinct fixtures: 36

Per-tool roll-up

slsa-framework/slsa — Open Issue Audit

Date: April 14, 2026 Total open issues: 226 Audited by: Mike Lieberman SLSA versions: v1.0 (Apr 2023), v1.1 (Apr 2025), v1.2 (Nov 2025)

Every issue was individually reviewed: body, comments, and related PRs checked.

	# OpenSSF Baseline Framework Definition
	# Declarative configuration for OSPS v2025.10.10 compliance controls
	#
	# This file defines all 62 controls across 3 maturity levels.
	# Users can override settings via .baseline.toml in their repository.

	[metadata]
	name = "openssf-baseline"
	display_name = "OpenSSF Baseline"
	version = "0.1.0"

	{
	"project_name": "Test OpenSSF Baseline",
	"repository": "https://github.com/mlieberman85/test-baseline",
	"steps": [
	{
	"id": "create-security-branch",
	"action_name": "create-branch",
	"params": {
	"branch_name": "add-security-baseline-docs"
	},

	# SPDX-License-Identifier: Apache-2.0

	mappings:
	- id: "openssf-baseline-remediation"
	reason: "Apply OpenSSF Baseline security best practices based on Privateer findings"
	condition: "true" # Base condition always true, but individual steps have specific conditions
	steps:
	- id: "create-security-branch"
	action: "create-branch"
	parameters:

	Querying domain: whiskey.foundation
	Querying TXT record for: _chainsights.whiskey.foundation
	Traversing from root URI: https://raw.githubusercontent.com/whiskeytastingfoundation/chainsights/refs/heads/main/chainsights.jsonl with expected identity: mlieberman85@gmail.com
	Parsed essential bundle data.
	Decoded payload (839 bytes).
	Constructed PAE data (882 bytes).
	Prepared PEM certificate string.
	Calling Client::verify_blob with PAE data...
	Cryptographic signature verified successfully!
	Inspecting certificate identity...

	let language = "javascript" in
	let JavascriptContract = std.contract.from_predicate (fun x => std.string.contains "npm" x) in
	let RustContract = std.contract.from_predicate(fun x => std.string.contains "cargo" x) in
	let CommonContract = std.contract.from_predicate(fun x => std.string.contains "artifact" x) in
	let contract_array = if language == "javascript" then [CommonContract, JavascriptContract] else [CommonContract, RustContract] in
	let ContractSequence = std.contract.Sequence contract_array in
	let data = "npm run artifact" in
	data \| ContractSequence

	{
	"title": "InTotoStatementV1_for_SLSAProvenanceV1Predicate",
	"description": "Represents an In-Toto v1 statement.",
	"type": "object",
	"required": [
	"_type",
	"predicate",
	"predicateType",
	"subject"
	],

	TypeSpace {
	next_id: 23,
	definitions: {
	"BuildDefinition": Object(
	SchemaObject {
	metadata: Some(
	Metadata {
	id: None,
	title: None,
	description: Some(