Field validation · public GitHub outcomes
CrossCheck field validation: what happened when 10 real repositories were reviewed
Two targeted follow-up waves turned static repository findings into ten public, repository-specific decisions: one owner-confirmed policy and self-implemented fix, four open pull requests, three open questions about maintainer intent, and two contributions deliberately avoided.
Published and last checked 21 September 2026
1
owner-confirmed, self-fixed
4
open value PRs
3
open intent questions
2
contributions avoided
Strongest public outcome
One ambiguous dual-lockfile state became an explicit pnpm-only policy
The owner of ageerle/ruoyi-web confirmed that pnpm is the only supported install path. The owner then authored and merged PR #38, removing package-lock.json, declaring the pnpm version, and aligning repository guidance and automation with that policy.
Exact interpretation: one repository owner answered the intent question and implemented their own cleanup. The public record resolves ambiguity into explicit repository policy. It does not show that the owner installed or ran CrossCheck, and it is not an adoption claim.
Method
Review the repository, then choose PR, question, or skip
Step 1
Re-check current repository state
Inspect the default branch, package manifests, lockfiles, CI, documentation, contribution rules, and relevant recent history.
Step 2
Separate evidence from intent
Treat coexisting configuration as a review prompt. Do not call it an error until repository-specific policy makes the intended state clear.
Step 3
Choose the least presumptive action
Open a narrow PR only when intent is explicit, ask a concise question when intent is ambiguous, and skip when the state is documented or already covered.
Step 4
Record public outcomes without upgrading them
An open PR is a proposed change, an open question is unresolved, and a merged maintainer-authored fix proves only the repository decision shown in its public thread.
The ten repositories were purposefully selected across two small distribution waves after the September benchmark correction. They were chosen for repository-specific follow-up value, not sampled to estimate a population rate. No third wave is included.
Public record
All 10 outcomes, with status frozen at the last check
| Repository | Evidence state | Action taken | Current public status | Public link | Last checked |
|---|---|---|---|---|---|
| ageerle/ruoyi-webMaintainer-confirmed / self-fixed | pnpm documentation and Docker usage coexisted with package-lock.json. | Asked the owner which install path was supported. | Owner confirmed pnpm-only support, authored PR #38, and merged the cleanup. | 21 September 2026 | |
| HoangNguyen0403/agent-skills-standardOpen value PR | The pnpm workspace had stale root and CLI npm lockfiles. | Opened a deletion-only PR for the stale npm lockfiles. | PR #201 is open; review is required and no maintainer review is recorded. | 21 September 2026 | |
| zcaceres/builtwith-apiOpen value PR | The Bun workspace retained an npm lockfile from before its migration. | Opened a deletion-only PR for package-lock.json. | PR #24 is open; no maintainer comment or review is recorded. | 21 September 2026 | |
| gambiarraclub/gambiarra-arenaOpen value PR | The pnpm workspace retained an older npm lockfile. | Opened a deletion-only PR for package-lock.json. | PR #14 is open; review is required and no maintainer review is recorded. | 21 September 2026 | |
| lernza/lernzaOpen value PR | The pnpm-managed frontend retained a stale frontend npm lockfile. | Opened a deletion-only PR limited to frontend/package-lock.json. | PR #1611 is open; no maintainer review is recorded. A contributor commented and the change was clarified. | 21 September 2026 | |
| codee-sh/payload-training-appOpen intent question | Yarn 4 guidance and CI coexisted with an older npm lockfile. | Asked whether npm remained a supported install path before changing files. | Issue #29 is open with no maintainer reply recorded. | 21 September 2026 | |
| dvcrn/mcp-server-devonthinkOpen intent question | npm CI, an npm lockfile, a Bun lockfile, and a Yarn declaration pointed in different directions. | Asked which install paths are intended to remain supported. | Issue #36 is open with no maintainer reply recorded. | 21 September 2026 | |
| LCNINE/almondyoung-serverOpen intent question | Root npm automation conflicted with Yarn-oriented contributor guidance. | Asked for the intended root policy without assuming it applied to nested applications. | Issue #925 is open with no maintainer reply recorded. | 21 September 2026 | |
| workos/caseSkipped / already covered | An existing issue already asked maintainers to decide between Bun and pnpm state. | Closed duplicate PR #25 immediately after finding issue #24. | Issue #24 remains open; the duplicate PR is closed and unmerged. | 21 September 2026 | |
| walleliu1016/lynel-desktopSkipped / documented state | Repository guidance explicitly records both lockfiles while CI uses npm ci. | Took no external action because the state was already documented. | No issue or PR was opened. | 21 September 2026 |
Inspect or try it
Go from public evidence to your own repository
Start with the corrected benchmark and raw evidence, inspect the public source, or run CrossCheck against one repository. The GitHub Action is advisory by default; strict failure modes are explicit opt-ins and repository intent requires an explicit CrossCheck contract.
Limits and update policy
- • The set is small, purposefully selected, and unsuitable for estimating prevalence, acceptance rate, or CrossCheck adoption.
- • Four PRs and three questions remain open. Their descriptions are proposals or unresolved policy questions, not confirmed repository defects.
- • Public GitHub state can change after the stated last-checked date. The linked threads are authoritative for later reviews, merges, closures, or replies.
- • No revenue, install, scan, referral, or conversion outcome is attributed to these threads without direct observable evidence.
- • The raw September benchmark outputs remain frozen. This page reports later public follow-up outcomes; it does not rewrite the benchmark data.