PkgLift
Home/Pilot evidence
Published evidence

Ten real repositories. Zero upstream mutations.

PkgLift tests real project shapes at exact commits, records the classification result, and treats a conservative refusal as useful evidence—not a reason to weaken a safety gate.

Evidence boundary: the ten public repositories below receive analysis, plan generation, and a migration dry run only. They are not passed to migrate --apply, their scripts are not executed, and their source is not published as a PkgLift artifact.
Upstream pilots

10

Pinned, read-only project shapes.

External applies

0

No public pilot is mutated.

Controlled fixture

1

Repo-owned apply, resolve, and build proof.

Read-only pilot matrix

Each checkout is isolated and pinned to the commit shown. The observed result is an expectation enforced by the pilot harness, not a claim that the whole upstream project can be migrated automatically.

Project shapePinned sourceObserved result
Positive sampleAmazon IVS grid feedSDWebImage is AUTO; AmazonIVSPlayer remains non-automatic.
Mixed catalogLoodosCaseAlamofire, Kingfisher, and lottie-ios 3.2.2 are AUTO; older Firebase and unsupported identities stay non-automatic.
Dynamic RubyV2ex-Swiftpost_install and dynamic Ruby force a mutation-free refusal; no direct entry becomes AUTO.
Broad compatibilityTinode iOSEleven direct identities remain non-automatic because of dynamic Ruby and post_install.
Large dependency setXcodeBenchmarkForty-two identities are classified; MagicalRecord proves unpinned Git provenance and RxBluetoothKit proves that a tag without a full checkout commit remains incomplete. Neither becomes AUTO. The complete pilot result contains no AUTO entries.
Objective-C/macOSHammerspoonTen direct identities are found; CocoaHTTPServer proves unpinned Git provenance and Sentry proves that a tag without a full checkout commit remains incomplete. Neither becomes AUTO. The complete pilot result contains no AUTO entries.
Nested exampleAcknowList exampleThe local AcknowList pod remains BLOCKED.
Parenthesized syntaxfastlane exampleLiteral target and pod calls are attributed exactly; unmapped HexColors remains UNKNOWN.
Project without workspaceFirebaseUI sampleExplicit project selection works; local pods are blocked and Firebase/Auth remains REVIEW.
Legacy FirebaseLegacy Auth QuickstartMappings are found, but attribution and use_frameworks! prevent AUTO.

The separate end-to-end boundary

Apply is proven only in Fixtures/MixedLanguageSDWebImage, a fixture owned by this repository. It contains one target with both Swift and Objective-C consumers of SDWebImage.

  1. A disposable baseline copy builds with CocoaPods.
  2. A second disposable copy records protected source and resource hashes.
  3. The complete reviewed AUTO set must equal exactly SDWebImage.
  4. The dry run must leave the whole tree unchanged.
  5. Only the repo-owned copy reaches apply, SwiftPM resolution, and simulator build verification.
  6. The protected hashes must still match afterward.

Audit the evidence

The detailed methodology, licensing notes, pins, and expected outcomes live in Documentation/Pilots.md. The executable definitions are the read-only pilot workflow and the separate repo-owned end-to-end workflow.

Have a different project shape?

Turn the unknown into reproducible evidence.

Run analysis on a recoverable copy, remove private identifiers, and share the classification or failure without applying changes.

Report a migrationStar or inspect the source