feat: add YYLO Benchmark to Audit Trails & Observability

[InsightFactoryAPP]

Project

• Repository or specification: https://github.com/yylo-dev/yylo-benchmark
• Proposed category: Audit Trails & Observability

Why it belongs

YYLO Benchmark is the evaluation half of the YYLO coding-agent family (the CLI half was added to Agent Governance & Policy Enforcement in #7). Its relevant function for this category is retained, verifiable evidence about what a coding agent actually did: every attempt runs in a dedicated fresh repository with private home/temp/cache/config roots; durable objects retain the initial workspace receipt, a post-execution repository manifest (Git HEAD/tree/refs/index/status plus every worktree file), evaluator profile/prompt/rubric/output/provenance hashes, and evidence/evaluation IDs behind every aggregate; and retained state is rejected unless plan, attempt, receipt, manifest, terminal, evidence, and evaluation IDs form one exact linkage. Recovery, doctor, and report verify that chain and fail closed when any attempt's chain is incomplete — the same hash-chained-record concern as trailing, trishula-agent-telemetry, and vaara in this section, applied to benchmark runs.

Quality evidence

• Open source, MIT license, public repository, actively developed (created 2026-08-17, pushed 2026-09-12).
• Documented adoption (the <5★ stronger-evidence route): distributed on npm as @yylo/benchmark, 326 downloads in the last month — independently checkable at https://api.npmjs.org/downloads/point/last-month/@yylo%2Fbenchmark (the number was 181 a month earlier; adoption is growing, not stale).
• Advisory signal explained: validate-repos.py reports one new flag from this PR — LOW_STARS: yylo-dev/yylo-benchmark (1 star, the repo is four weeks old). This is exactly the low-star-stronger-evidence case from contributing.md; the npm adoption above and the active-push record are the stronger evidence. The two NEW_INACTIVE flags (go-a2a/a2a-go, themanojdesai/python-a2a) reproduce on pristine main and are not introduced by this PR; the maintainer-owned baseline files were not touched.
• Prior acceptance in this list of the sibling project: YYLO CLI (feat: add YYLO to Agent Governance & Policy Enforcement #7, merged 2026-09-14, Agent Governance & Policy Enforcement).
• Every phrase in the entry description is quotable from the live README: "Every candidate receives a dedicated fresh repository", "Retained state is rejected unless its state, plan, attempt, initial workspace receipt, post-execution manifest … terminal, evidence, evaluator configuration, and evaluation IDs form one exact linkage", "Recovery reuses hash-verified terminals", "Doctor and report fail closed unless every attempt in the immutable plan has the complete retained chain".

Checklist

• This pull request adds or changes one project.
• I read CRITERIA.md and contributing.md.
• I checked the list for duplicates.
• The description uses - [Name](URL) - Description. format.
• The entry is alphabetized by displayed name within its category.
• The description states factual utility rather than copying marketing.
• The project is not a tutorial, sample, hackathon demo, workshop, or
  closed commercial product.
• I explained any new advisory signal or requested exception above.
• I did not edit the maintainer-owned advisory baseline or exception
  registry unless a maintainer requested it.
• npm ci, npm run lint, npm test, and
  python3 .github/scripts/validate-repos.py pass locally.

Local verification run for this exact tree: npm ci clean; npm run lint reports only the same single environmental awesome-github git-repository notice that pristine main reports in this sandbox (verified by re-running on unmodified main; no new findings); npm test = 17/17 OK; check-markdown-links.py = PASS; validate-repos.py = 137 repositories, 0 hard failures, 3 new advisory flags of which 2 pre-exist on pristine main and the third (LOW_STARS for yylo-dev/yylo-benchmark) is explained above.

Disclosure

I am on the team that builds YYLO (yylo-dev); this is a disclosed self-submission of our own open-source project, and the PR was prepared with AI assistance and then checked line-by-line against the live repository README — every factual claim in the entry description and this body maps to a quotable README sentence. Happy to adjust the category or description, or to withdraw if the evidence-chain framing reads as a stretch for this list.

[CodeSigils]

Review — Approved

Project verified: yylo-dev/yylo-benchmark — MIT, not archived, pushed 2026-09-12, 326 npm downloads/month (confirmed via npmjs.org API).

Category fit: Audit Trails & Observability — the hash-chained evidence chain (plan → attempt → receipt → manifest → terminal → evaluation IDs) with closed-on-failure verification fits the section scope well.

Entry format: correct, alphabetized after vaara.

Advisory: LOW_STARS (1★) is expected for a 4-week-old project with real npm adoption — recorded in the advisory baseline rather than blocking inclusion.

Action taken: merged into main (commit 796701f, author preserved); LOW_STARS baselined (commit 1eb1737).

[CodeSigils]

Closing this PR — content already merged to main (796701f + 1eb1737) since the maintainer token could not run the standard merge. Thanks for contributing YYLO Benchmark!

[InsightFactoryAPP]

Thanks for importing it directly and for the clean close — glad the Audit Trails & Observability entry made it in. Appreciate the LOW_STARS baseline note as well; happy to supply adoption evidence any time it comes up for review (npm @yylo/benchmark is growing, 326 dl/mo). — YYLO team