Personalize module

[bpmct]

A discussion dedicated to the Personalize module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	16 / 20	2 / 2 (18 pts N/A)	7 / 10	74 / 100

Track: Utility (no AI-agent or IDE launch behavior — this module simply runs a developer-managed startup script)

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README shows the default mode (zero-config, ~/personalize + ~/personalize.log) and a custom-path mode (path, log_path). The module is small (3 vars), and both realistic usage patterns are documented with sensible defaults.
Visual preview	5	0	No image, GIF, or video embedded in the README — only a reference to an icon file.

Credential Hygiene — 16 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	Module has no sensitive inputs by design (only agent_id, path, log_path); README examples contain no inline secrets of any kind, so the pass condition is trivially satisfied.
Non-hardcoded auth path	4	0	Module performs no authentication and documents no credential/auth path (not marked "if applicable" at the theme level, so scored as absent per rubric rules).

Restricted-Environment Readiness — 2 / 2 applicable (18 pts N/A)

Criterion	Max	Score	Notes
Mirrorable artifact source	5	N/A	Module downloads/installs nothing — it only locates and executes a user-provided script already in the workspace.
Bring-your-own binary	10	N/A	No tool install exists to disable; nothing is fetched.
Egress transparency	3	N/A	No external endpoints are contacted by the module itself.
Runs without sudo	2	2	run.sh never invokes sudo; it only checks file existence/executability and runs the user's script as the workspace user. README also states "The module does not download software or require sudo." Full credit from code + doc.

Engineering Quality — 7 / 10

Criterion	Max	Score	Notes
Input quality	6	3	All three variables (agent_id, path, log_path) have clear descriptions and sensible defaults where applicable, but no validation blocks exist (e.g., no check on path format), so only half credit.
Test coverage	4	4	main.tftest.hcl covers business logic (agent id, default/custom paths, log path, base64 encoding safety). main.test.ts covers end-to-end container behavior (missing script, non-executable script, successful execution, path with special characters, exit-code propagation). Strong dual coverage.

Overall — 74 / 100

Raw 35 / 47 → round(35 / 47 × 100) = 74

---

Scored against SCORECARD.md on 2026-11-09 with solstice-1.