Generated 2026-04-19 by HUMMBL Arbiter v0.6.0
We scored and certified 201 open-source repositories across 20 industry categories using Arbiter’s deterministic quality scoring engine. The data reveals a consistent pattern:
Code quality is NOT the bottleneck. Governance is.
Popular repos consistently score 85+ on code quality. What separates CERTIFIED from PROVISIONAL is governance maturity: CONTRIBUTING.md, SECURITY.md, Code of Conduct, DCO, and CI/CD. This is exactly the gap HUMMBL fills.
| Repo | Code | Gov | Deps | Overall | Decision |
|---|---|---|---|---|---|
| NVIDIA/NeMo-Guardrails | 94.1 | 75 | 100 | 89.5 | CERTIFIED |
| Microsoft/responsible-ai-toolbox | 90.8 | 80 | 100 | 89.4 | CERTIFIED |
| Guardrails AI/guardrails | 93.6 | 55 | 69.5 | 77.2 | PROVISIONAL |
| Credo AI/credoai_lens | 75.0 | 40 | 91 | 67.7 | PROVISIONAL |
Insight: Even AI governance companies have governance gaps. Guardrails AI scores 93.6 on code but 55 on governance.
| Repo | Code | Gov | Deps | Overall | Decision |
|---|---|---|---|---|---|
| LlamaIndex | 96.4 | 90 | 96 | 94.4 | CERTIFIED |
| Instructor | 93.4 | 65 | 100 | 86.2 | CERTIFIED |
| LangChain | 95.4 | 45 | 100 | 81.2 | PROVISIONAL |
| Guidance | 90.7 | 55 | 100 | 81.8 | PROVISIONAL |
| Outlines | 89.9 | 45 | 96 | 77.7 | PROVISIONAL |
Insight: LangChain — the most popular LLM framework — scores 95.4 on code but only 45 on governance. PROVISIONAL. This is HUMMBL’s pitch in one data point.
| Repo | Code | Gov | Deps | Overall | Decision |
|---|---|---|---|---|---|
| Dagster | 97.1 | 75 | 100 | 91.0 | CERTIFIED |
| dbt-core | 93.0 | 80 | 100 | 90.5 | CERTIFIED |
| Apache Spark | 94.5 | 65 | 100 | 86.8 | CERTIFIED |
| Prefect | 97.8 | 85 | 31 | 80.6 | FAILED |
| Great Expectations | 96.8 | 45 | 86 | 79.1 | PROVISIONAL |
Insight: Prefect has 97.8 code quality but FAILS on 109 unpinned dependencies. Dependency governance matters.
| Repo | Code | Gov | Deps | Overall | Decision |
|---|---|---|---|---|---|
| Project-MONAI/MONAI | 96.5 | 100 | 100 | 98.2 | CERTIFIED |
| Orange3 | 92.5 | 75 | 100 | 88.8 | CERTIFIED |
| OpenMRS | 0 (Java) | 80 | 100 | 88.0 | CERTIFIED |
| Hail | 92.0 | 45 | 100 | 79.5 | PROVISIONAL |
Insight: MONAI scores 98.2 — the highest of ANY repo we tested. Perfect governance (100/100). This is what CERTIFIED looks like.
| Repo | Code | Gov | Deps | Overall | Decision |
|---|---|---|---|---|---|
| tox | 92.6 | 95 | 87 | 92.2 | CERTIFIED |
| cookiecutter | 98.0 | 80 | 96 | 92.2 | CERTIFIED |
| pip | 95.6 | 75 | 100 | 90.3 | CERTIFIED |
| Poetry | 90.9 | 60 | 100 | 83.5 | CERTIFIED |
| ruff | 80.8 | 65 | 100 | 79.9 | PROVISIONAL |
Insight: ruff — the linter Arbiter uses — scores PROVISIONAL. Even tool authors have governance gaps.
| Repo | Code | Gov | Deps | Overall | Decision |
|---|---|---|---|---|---|
| Stripe Python SDK | 98.9 | 75 | 99 | 91.8 | CERTIFIED |
| ccxt | 95.3 | 60 | 100 | 85.7 | CERTIFIED |
| Freqtrade | 92.3 | 60 | 100 | 84.2 | CERTIFIED |
Insight: Stripe leads fintech — enterprise-grade governance matches enterprise-grade code.
| Repo | Code | Gov | Deps | Overall | Decision |
|---|---|---|---|---|---|
| Sanic | 93.7 | 85 | 100 | 92.3 | CERTIFIED |
| Django REST Framework | 92.8 | 70 | 97 | 86.8 | CERTIFIED |
| Litestar | 93.9 | 70 | 93 | 86.6 | CERTIFIED |
| Flask | 83.1 | 45 | 97 | 74.5 | PROVISIONAL |
| Click | 89.3 | 45 | 100 | 78.2 | PROVISIONAL |
Insight: Flask and Click — foundational Python libraries — score PROVISIONAL due to 45/100 governance.
| Repo | Code | Gov | Deps | Overall | Decision |
|---|---|---|---|---|---|
| OpenTelemetry Python | 97.1 | 65 | 84 | 84.8 | CERTIFIED |
| Sentry | 98.5 | 60 | 0 | 67.2 | FAILED |
Insight: Sentry has the best code quality we tested (98.5) but FAILS due to 109 unpinned dependencies.
Across 201 repos, code quality is consistently high (85+). The factor that separates CERTIFIED from PROVISIONAL is governance maturity — the exact dimension enterprises care about and the exact gap HUMMBL fills.
Even AI governance companies (Guardrails AI, Credo AI) have governance gaps in their own repos. The shoemaker’s children have no shoes.
Sentry (98.5 code, 0 deps) and Prefect (97.8 code, 31 deps) both fail due to dependency governance. Organizations that don’t pin versions or manage dependency sprawl carry invisible risk.
Healthcare repos (MONAI: 98.2) have the best certification scores. Gaming repos (Pygame: FAILED, 20 governance) have the worst. Regulated industries invest in governance infrastructure.
The 80-point CERTIFIED threshold correctly identifies repos that enterprises would trust. The 60-point PROVISIONAL threshold correctly flags repos that need governance improvement before enterprise adoption.
Powered by HUMMBL Arbiter — deterministic code quality scoring with governance integration.