A repository whose latest inspection places it in one of the top three rating bands holds an inspect.software certification level. The level is nothing more — and nothing less — than the band the published evidence supports, stated in the vocabulary of a certification mark:
| Level | Grade | Band | Health index |
|---|---|---|---|
| Certified AAA | AAA | Exceptional | 93–100 |
| Certified with Excellence | AA | Excellent | 80–92 |
| Certified | A | Good | 65–79 |
Repositories below the Good band hold no certification level; their reports state a diagnosis — Moderate, Weak, At Risk, or Critical — not an award. The calibration of the index gives each level percentile meaning across the public record: Certified AAA marks roughly the top 5% of inspected open source.
What a level asserts
A certification level asserts exactly what the report behind it asserts: measured, publicly visible engineering, maintenance, security, and governance practice under a versioned methodology — nothing more. It is not a code audit, not a security guarantee, and not an endorsement — see signals, not warranties. The full evidence for any level is one click away in the repository's public report.
How a level is earned
Every inspection — free public-interest coverage or on-demand certification — runs the identical methodology, and the level follows mechanically from the resulting band. Payment buys an inspection; it cannot buy a level, and no commercial relationship can move a published result.
How a level changes
Levels track the latest published inspection. A re-inspection that moves the index across a band boundary moves the level with it, in either direction — a certification that could not be lost would assert nothing. Because band thresholds and the calibration curve are part of the versioned methodology, any change that could move levels is dated and documented in methodology versions.
Badges
The embeddable GitHub badge is the certification mark. A certified repository's badge carries an embossed rosette bearing its letter grade — A for Certified, AA for Certified with Excellence, AAA for Certified AAA — beside the band word and the index. Repositories below Good show the same badge without a rosette: the seal marks certification, and nothing else may wear it.
The badge follows the level automatically. A repository that reaches a higher level at its next inspection gets the higher seal without re-embedding anything, and one that falls below Good loses the rosette the same way — which is the point of a mark that is re-derived rather than issued once.
Related: rating bands · the health index · signals, not warranties · methodology versions