Personalize module

[bpmct]

A discussion dedicated to the Personalize module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	16 / 20	2 / 2	7 / 10	76 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Module has few options (path, log_path). README documents the default usage (just agent_id) and a custom-paths example with path and log_path overrides. Sensible defaults (~/personalize, ~/personalize.log) are shown. Each major mode is covered.
Visual preview	5	0	No image, GIF, or video embedded in the README. The frontmatter icon field references an SVG but is not a visual preview of the module in action.

Credential Hygiene — 16 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No sensitive inputs exist in the module (agent_id, path, log_path are all non-sensitive). README examples contain no inline secrets or placeholder keys. Trivially satisfied.
Non-hardcoded auth path	4	0	The module performs no authentication and interacts with no external service requiring credentials. No documented auth path (ServiceAccount, IAM, API key helper, etc.) is present.

Restricted-Environment Readiness — 2 / 2 (18 pts N/A)

Criterion	Max	Score	Notes
Mirrorable artifact source	5	N/A	Module downloads nothing. run.sh only checks for and executes a user-provided local script. No download URL exists to override.
Bring-your-own binary	10	N/A	Module installs nothing. There is no tool to bring or skip installing.
Egress transparency	3	N/A	Module contacts no external endpoints. run.sh operates entirely on local filesystem paths.
Runs without sudo	2	2	run.sh never invokes sudo. It uses only printf, base64 -d, file existence/executability checks, and direct script execution. README explicitly states: "The module does not download software or require sudo."

Engineering Quality — 7 / 10

Criterion	Max	Score	Notes
Input quality	6	3	All three variables have clear descriptions and correct types. path and log_path have sensible defaults. However, no validation blocks are present (e.g., agent_id could validate non-empty; path/log_path could validate non-empty). Half credit for missing validation.
Test coverage	4	4	main.tftest.hcl covers Terraform plan logic: default values, run_on_start, start_blocks_login, custom path encoding (base64), and special-character preservation. main.test.ts provides end-to-end container tests: missing script warning, non-executable warning, successful execution, custom path with shell metacharacters, and exit-code propagation. Clear separation of plan-level and behavioral tests.

Overall — 76 / 100

Raw 37 / 49 → round(37 / 49 × 100) = 76

Track: Utility (helper module that runs a developer-managed script on workspace start; not an AI agent or IDE)

---

Scored against SCORECARD.md on 2026-09-28 with solstice-1.