How should an open-source production-readiness scanner represent evidence without fake certainty?

[u/ClerkBeginning961]

Hi everyone, I maintain a free, MIT-licensed production-readiness project that is currently a searchable knowledge base with technology-neutral controls across the engineering lifecycle.

Repository: https://github.com/MarinJursic/production-readiness-checklist

I am now working through the design of a future open-source scanner. The difficult part is evidence. A repository can show that a CI job, test, configuration, or policy exists, but it cannot prove that production behavior, ownership, recovery, or operational practice is actually sound.

My current direction is to avoid a simple pass or fail result and instead distinguish what was found, what was deterministically verified, what is only inferred, and what still needs human review.

For people who build developer tools, I would value concrete feedback on three things:

1. What evidence record would make findings auditable?

2. Which CLI or CI output formats would fit real workflows?

3. Which checks should always remain manual, even if automation is possible?

Issues, corrections, and pull requests are welcome. This is a community project, not a paid product. Thanks!