Öffentliches RegisterMittel
Software-GesundheitsberichtSchema 0.27.0 · Metriken 1.13.0 · 2026-07-25 07:12 UTC
Clickin / stax-xml
First StAX style XML parser/writer for javascript/typescript
Clickin/stax-xml erreicht einen Gesundheitsindex von 56 von 100 und liegt damit im Bereich Mittel. Am stärksten schneidet es bei Vitality (83/100) ab, am schwächsten bei Security (37/100). Zuletzt vor 5 Tagen aktualisiert. Ein einzelner Mitwirkender trägt den Großteil der jüngsten Arbeit.
56
gesamt / 100Software-Gesundheitsindex
Metriken werden auf einer Skala von 1–100 in gewichtete Kategorien gruppiert. Der Gesamtwert beginnt als ihr Mittel; sobald öffentliche Evidenz die Richtlinie für Hochrisikojurisdiktionen auslöst, wird die Bewertung angepasst und erhält die Obergrenze 49 (Gefährdet). AI Readiness liegt außerhalb.
56
Exzellent85-100Vorbildlich; erfüllt im Wesentlichen alle geprüften Kriterien
Gut70-84Gesund; geringfügige Lücken
Mittel50-69Akzeptabel mit deutlichen Lücken; Überprüfung empfohlen
Gefährdet30-49Erhebliche Schwächen; eine Übernahme erfordert Vorsicht
Kritisch1-29Schwerwiegende Probleme (aufgegeben, nur ein Maintainer, keine Hygiene)
Bewertungsprofil
Jede Achse ist eine Kategorie. Die Form zählt mehr als der Durchschnitt — ein gesundes Projekt füllt die gesamte Fläche, während ein Profil aus Spitzen und Kratern bedeutet, dass Stärke in einer Dimension Risiken in einer anderen verdeckt.
Eigentümerschaft
ClickinPersönliches Konto
3 Follower35 öffentliche Reposseit Dez. 2014
Dieses Repository gehört einem persönlichen Konto. Ein Projekt mit nur einem Eigentümer trägt ein höheres Kontinuitätsrisiko als ein organisationsgetragenes.
Paket-Ökosysteme
| Registry | Paket | Version | Downloads / Monat | Versionen | Zuletzt veröffentlicht | Tags |
|---|---|---|---|---|---|---|
| npm | stax-xml | 1.1.0 | 2.344 | 19 | vor 5 Tagen | xmlstaxparserwriter |
Metriken nach Kategorie
Vitalität
Lebt das Projekt — wird Code geschrieben und werden Releases ausgeliefert?
83
Wie die Bewertung erfolgt
| 36/36 | Push-Aktualität — letzter Push vor 5 Tagen |
| 6.9/36 | Commit-Rhythmus — 10/52 Wochen mit Commits |
| 18/18 | Commit-Volumen — 252 Commits im letzten Jahr |
| 10/10 | OpenSSF Scorecard: Maintained — 30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10 |
Verwendete Eingangsdaten
| commits_last_year | 252 |
| human_commit_share | 1 |
| days_since_last_push | 5 |
| active_weeks_last_year | 10 |
Release-Disziplin
100Exzellent
Wie die Bewertung erfolgt
| 27/27 | Liefert Releases aus — 10 Releases veröffentlicht |
| 36/36 | Release-Aktualität — letztes Release vor 5 Tagen |
| 27/27 | Release-Rhythmus — ein Release etwa alle 33,5 Tage |
| 0/10 | OpenSSF Scorecard: Signed-Releases — keine Daten |
Verwendete Eingangsdaten
| releases_count | 10 |
| latest_release_tag | v1.1.0 |
| releases_from_tags | nein |
| days_since_latest_release | 5 |
| mean_days_between_releases | 33,5 |
Von der Bewertung ausgeschlossen (keine Daten oder nicht anwendbar): OpenSSF Scorecard: Signed-Releases. Die verbleibenden Gewichte wurden renormalisiert.
Community & Verbreitung
Hat das Projekt Nutzer, Downloads, Aufmerksamkeit und ein einladendes Umfeld für Beitragende?
40
Popularität & Verbreitung
20Kritisch
Wie die Bewertung erfolgt
| 20.4/60 | Stars — 19 Stars |
| 0/25 | Forks — 0 Forks |
| 0/15 | Watcher — 0 Watcher |
Verwendete Eingangsdaten
| forks | 0 |
| stars | 19 |
| watchers | 0 |
| growth_state | unverified |
| growth_factor_pct | 100 |
| growth_unverified_reason | no_history |
Community-Gesundheit
50Mittel
Wie die Bewertung erfolgt
| 22.5/22.5 | README |
| 22.5/22.5 | Lizenz — anerkannte Lizenz (MIT) |
| 0/18 | CONTRIBUTING-Leitfaden |
| 0/13.5 | Verhaltenskodex |
| 0/7.2 | Issue-Vorlage |
| 0/6.3 | PR-Vorlage |
Verwendete Eingangsdaten
| has_readme | ja |
| has_license | ja |
| has_contributing | nein |
| has_issue_template | nein |
| has_code_of_conduct | nein |
| has_pull_request_template | nein |
Wie die Bewertung erfolgt
| 44.9/80 | Downloads pro Monat — 2.344 Downloads/Monat über npm |
| 0/20 | Abhängige in der Registry — von diesem Ökosystem nicht ausgewiesen |
Verwendete Eingangsdaten
| packages | stax-xml |
| dependents | — |
| ecosystems | npm |
| total_downloads | — |
| monthly_downloads | 2.344 |
Von der Bewertung ausgeschlossen (keine Daten oder nicht anwendbar): Abhängige in der Registry. Die verbleibenden Gewichte wurden renormalisiert.
Nachhaltigkeit & Governance
Überdauert das Projekt die Menschen, die es tragen — Bus-Faktor, Reaktionsfähigkeit, Trägerschaft und Paketpflege?
48
Maintainer-Resilienz (Bus-Faktor)
10Kritisch
Wie die Bewertung erfolgt
| 9/54 | Bus-Faktor — 1 Beitragende decken die Hälfte aller Commits ab |
| 0/22.5 | Commit-Verteilung — wichtigste beitragende Person verfasste 100 % der Commits |
| 1.4/13.5 | Breite der Beitragenden — 1 Beitragende |
| 0/10 | OpenSSF Scorecard: Contributors — project has 0 contributing companies or organizations -- score normalized to 0 |
Verwendete Eingangsdaten
| bus_factor | 1 |
| contributors_sampled | 1 |
| top_contributor_share | 1 |
Wie die Bewertung erfolgt
| 46.8/46.8 | Issue-Lösungsquote — 100 % der Issues geschlossen |
| 7.7/38.3 | PR-Annahme — 1/5 entschiedene PRs gemergt |
| 0/15 | OpenSSF Scorecard: Code-Review — Found 0/30 approved changesets -- score normalized to 0 |
Verwendete Eingangsdaten
| merged_prs | 1 |
| open_issues | 0 |
| closed_issues | 2 |
| issue_closed_ratio | 1 |
| closed_unmerged_prs | 4 |
Eigentümerschaft & Trägerschaft
47Gefährdet
Wie die Bewertung erfolgt
| 10/30 | Organisatorische Trägerschaft — persönliches (Nutzer-)Konto |
| 0/20 | Verifizierte Domain — für Nutzerkonten nicht anwendbar |
| 4.3/25 | Reichweite des Inhabers — 3 Follower von Clickin |
| 23.3/25 | Kontohistorie — 35 öffentliche Repos, Kontoalter ca. 11 Jahre |
Verwendete Eingangsdaten
| followers | 3 |
| owner_type | User |
| is_verified | — |
| owner_login | Clickin |
| public_repos | 35 |
| account_age_days | 4.251 |
Von der Bewertung ausgeschlossen (keine Daten oder nicht anwendbar): Verifizierte Domain. Die verbleibenden Gewichte wurden renormalisiert.
Paketpflege
100Exzellent
Wie die Bewertung erfolgt
| 25/25 | Veröffentlicht & auflösbar — 1 Paket(e) auf npm |
| 35/35 | Veröffentlichungsaktualität — letzte Veröffentlichung vor 5 Tagen |
| 20/20 | Versionshistorie — 19 veröffentlichte Versionen |
| 20/20 | Nicht veraltet — aktiv, nicht veraltet oder zurückgezogen |
Verwendete Eingangsdaten
| packages | stax-xml |
| ecosystems | npm |
| any_deprecated | nein |
| min_days_since_publish | 5 |
Engineering-Qualität
Sind grundlegende Engineering- und Dokumentationspraktiken vorhanden?
66
Engineering-Praktiken
60Mittel
Wie die Bewertung erfolgt
| 24/24 | CI-Workflows — 4 Workflow(s) |
| 24/24 | Tests vorhanden |
| 0/16 | Linter-Konfiguration |
| 0/9.6 | Pre-Commit-Hooks |
| 0/6.4 | .editorconfig |
| 0/20 | OpenSSF Scorecard: CI-Tests — keine Daten |
Verwendete Eingangsdaten
| has_ci | ja |
| has_tests | ja |
| has_editorconfig | nein |
| has_linter_config | nein |
| has_precommit_config | nein |
Von der Bewertung ausgeschlossen (keine Daten oder nicht anwendbar): OpenSSF Scorecard: CI-Tests. Die verbleibenden Gewichte wurden renormalisiert.
Dokumentation
75Gut
Wie die Bewertung erfolgt
| 30/30 | README |
| 0/25 | Dokumentationsverzeichnis |
| 15/15 | Dokumentations-/Homepage-Site — https://clickin.github.io/stax-xml/ |
| 10/10 | Repository-Beschreibung |
| 10/10 | Topics — 6 Topics |
| 10/10 | Wiki |
Verwendete Eingangsdaten
| topics | library, stream, typescript, typescript-library, xml-builder, xml-parser |
| has_wiki | ja |
| homepage | https://clickin.github.io/stax-xml/ |
| has_readme | ja |
| has_docs_dir | nein |
| has_description | ja |
Sicherheit
Sind die sichtbaren Sicherheits- und Lieferkettenpraktiken belastbar, ohne ungeklärte Exposition gegenüber Hochrisikojurisdiktionen?
37
Sicherheitslage
37Gefährdet
Wie die Bewertung erfolgt
| 7.5/7.5 | Binary-Artifacts — no binaries found in the repo |
| 2.2/7.5 | Branch-Protection — branch protection is not maximal on development and all release branches |
| 0/2.5 | CI-Tests — keine Daten |
| 0/2.5 | CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected |
| 0/7.5 | Code-Review — Found 0/30 approved changesets -- score normalized to 0 |
| 0/2.5 | Contributors — project has 0 contributing companies or organizations -- score normalized to 0 |
| 10/10 | Dangerous-Workflow — no dangerous workflow patterns detected |
| 0/7.5 | Dependency-Update-Tool — no update tool detected |
| 0/5 | Fuzzing — project is not fuzzed |
| 2.5/2.5 | Lizenz — license file detected |
| 7.5/7.5 | Maintained — 30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10 |
| 5/5 | Packaging — packaging workflow detected |
| 0/5 | Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0 |
| 0/5 | SAST — no SAST tool detected |
| 0/5 | Security-Policy — security policy file not detected |
| 0/7.5 | Signed-Releases — keine Daten |
| 0/7.5 | Token-Permissions — detected GitHub workflow tokens with excessive permissions |
| 0/7.5 | Vulnerabilities — 29 existing vulnerabilities detected |
Verwendete Eingangsdaten
| source | openssf_scorecard |
| checks_evaluated | 16 |
| scorecard_version | v5.5.0 |
| checks_inconclusive | 2 |
| scorecard_aggregate | 3,7 |
Von der Bewertung ausgeschlossen (keine Daten oder nicht anwendbar): ci_tests, signed_releases. Die verbleibenden Gewichte wurden renormalisiert.
AI Readiness
Wie gut ist das Repository dafür ausgestattet, mit KI-Coding-Agenten entwickelt und gepflegt zu werden? Ein unabhängiges, experimentelles Badge — Gewicht 0,0, es wird eigenständig ausgewiesen und verändert den Gesamt-Gesundheitswert nicht.
69
AI-Agentenkontext & Leitlinien
85Exzellent
Wie die Bewertung erfolgt
| 45/45 | Agentenanweisungen — AGENTS.md |
| 0/15 | Maschinenlesbare Doku (llms.txt) |
| 40/40 | Lesbare Commit-Historie — 99 von 100 menschlichen Commits benennen ihre Absicht (strukturierter Betreff oder erläuternder Text) |
Verwendete Eingangsdaten
| has_llms_txt | nein |
| legible_history_share | 0,99 |
| agent_instruction_files | AGENTS.md |
| agent_instruction_max_bytes | 1.191 |
Wie die Bewertung erfolgt
| 12.6/18 | Bootstrap mit einem Befehl — packages/benchmark/cross-runtime/reader-quickxml/Cargo.toml, packages/benchmark/cross-runtime/writer-quickxml/Cargo.toml (Toolchain-Konvention, kein Task-Runner) |
| 22/22 | Automatisierte Tests |
| 0/11 | Lint-/Format-Konfiguration |
| 11/11 | Statische Typprüfung — packages/docs/tsconfig.json, packages/stax-xml/tsconfig.json, tsconfig.json |
| 10/10 | Reproduzierbare Umgebung — lockfile |
| 0/10 | Belegte Agentenpraxis — keine von Agenten verfassten Commits unter den letzten 100 |
| 0/8 | Automatisierte Wartung — keine automatisierten Abhängigkeits-Updates beobachtet |
| 0/10 | OpenSSF Scorecard: Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0 |
Verwendete Eingangsdaten
| has_nix | nein |
| has_tests | ja |
| lockfiles | Cargo.lock, package-lock.json, pnpm-lock.yaml |
| has_dockerfile | nein |
| typed_language | ja |
| bootstrap_files | — |
| has_devcontainer | nein |
| has_linter_config | nein |
| typecheck_configs | packages/docs/tsconfig.json, packages/stax-xml/tsconfig.json, tsconfig.json |
| agent_commit_share | 0 |
| toolchain_manifests | packages/benchmark/cross-runtime/reader-quickxml/Cargo.toml, packages/benchmark/cross-runtime/writer-quickxml/Cargo.toml |
| dependency_bot_commit_share | 0 |
AI-Code-Lesbarkeit für Modelle
100Exzellent
Wie die Bewertung erfolgt
| 45/45 | Typprüfbarer Code — TypeScript (statisch typisiert) |
| 54.6/55 | Handhabbare Dateigrößen — 1/149 Quelldateien über 60 KB |
Verwendete Eingangsdaten
| primary_language | TypeScript |
| largest_source_bytes | 63.517 |
| source_files_sampled | 149 |
| oversized_source_files | 1 |
Maschinenlesbare AI-Schnittstellen
40Gefährdet
Wie die Bewertung erfolgt
| 0/40 | API-Schema (OpenAPI/GraphQL/proto) |
| 0/20 | MCP-Server |
| 40/40 | Lauffähige Beispiele — demos, samples |
Verwendete Eingangsdaten
| example_dirs | demos, samples |
| has_mcp_signal | nein |
| api_schema_files | — |
Eckdaten
19GitHub-Sterne
1Mitwirkende
252Commits, letzte 12 Monate
5Tage seit letztem Push
10Releases
1Bus-Faktor
0offene Issues
npmPaket-Ökosysteme
Warnungen zur Datenerhebung
- Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
- GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
Weitere Details
OpenSSF Scorecard 3.7 / 10
3.7Gesamtwert
Unabhängige, werkzeugneutrale Sicherheitsbewertung durch das quelloffene OpenSSF Scorecard. Jede Prüfung honoriert eine Sicherheits-Praxis, nicht das Werkzeug eines bestimmten Anbieters. Prüfungen, die Scorecard nicht ermitteln konnte, sind mit k. A. markiert und vom Sicherheitswert ausgeschlossen (nie als null gezählt).
| 10 | Binary-Artifacts | no binaries found in the repo |
| 3 | Branch-Protection | branch protection is not maximal on development and all release branches |
| k. A. | CI-Tests | no pull request found |
| 0 | CII-Best-Practices | no effort to earn an OpenSSF best practices badge detected |
| 0 | Code-Review | Found 0/30 approved changesets -- score normalized to 0 |
| 0 | Contributors | project has 0 contributing companies or organizations -- score normalized to 0 |
| 10 | Dangerous-Workflow | no dangerous workflow patterns detected |
| 0 | Dependency-Update-Tool | no update tool detected |
| 0 | Fuzzing | project is not fuzzed |
| 10 | License | license file detected |
| 10 | Maintained | 30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10 |
| 10 | Packaging | packaging workflow detected |
| 0 | Pinned-Dependencies | dependency not pinned by hash detected -- score normalized to 0 |
| 0 | SAST | no SAST tool detected |
| 0 | Security-Policy | security policy file not detected |
| k. A. | Signed-Releases | no releases found |
| 0 | Token-Permissions | detected GitHub workflow tokens with excessive permissions |
| 0 | Vulnerabilities | 29 existing vulnerabilities detected |
Alle Abhängigkeiten nicht erhoben
Der aufgelöste Abhängigkeitssatz konnte für diesen Bericht nicht erhoben werden: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
JSON-Rohbericht maschinenlesbar
{
"data": {
"repo": {
"topics": [
"library",
"stream",
"typescript",
"typescript-library",
"xml-builder",
"xml-parser"
],
"is_fork": false,
"size_kb": 43075,
"has_wiki": true,
"homepage": "https://clickin.github.io/stax-xml/",
"languages": {
"MDX": 33488,
"HTML": 1959,
"Java": 5637,
"Rust": 6208,
"Astro": 35159,
"Shell": 2822,
"JavaScript": 582120,
"TypeScript": 777743
},
"pushed_at": "2026-07-19T23:49:00Z",
"created_at": "2025-06-16T15:57:35Z",
"owner_type": "User",
"updated_at": "2026-07-19T23:49:03Z",
"description": "First StAX style XML parser/writer for javascript/typescript",
"is_archived": false,
"is_disabled": false,
"license_spdx": "MIT",
"default_branch": "master",
"license_spdx_raw": "MIT",
"primary_language": "TypeScript",
"significant_languages": [
"TypeScript",
"JavaScript"
]
},
"owner": {
"blog": null,
"name": null,
"type": "User",
"login": "Clickin",
"company": null,
"location": null,
"followers": 3,
"avatar_url": "https://avatars.githubusercontent.com/u/10061082?v=4",
"created_at": "2014-12-03T12:44:24Z",
"is_verified": null,
"public_repos": 35,
"account_age_days": 4251
},
"license": {
"state": "standard",
"spdx_id": "MIT",
"raw_spdx": "MIT",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v1.1.0",
"kind": "minor",
"published_at": "2026-07-19T10:04:07Z"
},
{
"tag": "v1.0.0",
"kind": "major",
"published_at": "2026-07-18T17:52:06Z"
},
{
"tag": "v1.0.0-rc3",
"kind": "prerelease",
"published_at": "2026-04-27T14:43:07Z"
},
{
"tag": "v1.0.0-rc2",
"kind": "prerelease",
"published_at": "2026-04-27T04:26:58Z"
},
{
"tag": "v1.0.0-rc1",
"kind": "prerelease",
"published_at": "2026-04-27T02:27:47Z"
},
{
"tag": "v0.7.0",
"kind": "minor",
"published_at": "2026-04-19T07:18:55Z"
},
{
"tag": "v0.6.1",
"kind": "patch",
"published_at": "2026-04-18T16:20:49Z"
},
{
"tag": "v0.6.0",
"kind": "minor",
"published_at": "2026-04-18T09:01:57Z"
},
{
"tag": "v0.5.2",
"kind": "patch",
"published_at": "2025-10-18T16:27:09Z"
},
{
"tag": "v0.4.0",
"kind": "minor",
"published_at": "2025-09-21T08:13:36Z"
}
],
"recent_commits": [
{
"oid": "9a839ffb6824a25c4cc2fa6698e860daea5b5816",
"body": "Updated the release date for version 1.1.0 in CHANGELOG.",
"is_bot": false,
"headline": "Set release date for version 1.1.0",
"author_name": "Clickin",
"author_login": "Clickin",
"committed_at": "2026-07-19T23:48:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5990c034a97f6dc6cc651d40b57cfe15d5dd0a2e",
"body": "- unify async and sync serialization in WriterCore and add writeEvent support for reader-to-writer pipelines, including DTD output\n\n- stabilize event object shapes with nullish optional fields and preserve explicit trusted custom entity handling\n\n- restore writer throughput with direct sync emission\n[…]\n, and I/O regression coverage to 100%\n\n- publish v1.1/latest pipeline docs, API snapshots, release benchmarks, changelog, and release workflow metadata\n\n- apply oxfmt formatting across touched sources",
"is_bot": false,
"headline": "feat: prepare v1.1.0 event pipelines",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-19T10:00:55Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "67e0177daadb0ed75d613f4574d47aa9abc26d3d",
"body": null,
"is_bot": false,
"headline": "feat: add event writer pipeline",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-19T04:11:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2fa83c0e8e25425b25611f66f8a80324c0d1a516",
"body": null,
"is_bot": false,
"headline": "docs: expose historical snapshots in header",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-19T01:32:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ba4db9a6efaadc7e881fab46d0f6817f7b52f5ff",
"body": null,
"is_bot": false,
"headline": "chore: ignore local AI internal docs",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-19T00:58:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5895ba279b32dce5ed7553c4a54cf9de035113f9",
"body": null,
"is_bot": false,
"headline": "test(reader): expand numeric character reference coverage",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-19T00:46:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5ecc0ae40742c4d7d579fcdd7e7e3f728f41bcf8",
"body": null,
"is_bot": false,
"headline": "fix(release): tolerate npm registry propagation",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-18T17:49:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "25f4bbf64322199511ea1f11d879e4e77f05dbf7",
"body": null,
"is_bot": false,
"headline": "chore(release): pin changelog generator",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-18T17:44:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8f08919d5c55c04d01a4045a69e4c768a1878ac3",
"body": null,
"is_bot": false,
"headline": "fix(release): use supported pnpm 11",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-18T17:37:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "40fa4969e3b0d9ed3e0d7c270e91ce43b8566009",
"body": null,
"is_bot": false,
"headline": "docs: refresh v1.0.0 release snapshot",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-18T17:31:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2534b40a6b76332ba264857b12c49a7f02893f48",
"body": null,
"is_bot": false,
"headline": "refactor(writer): remove implementation metrics API",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-18T17:30:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3f115e7439d08799a61b4aa1aa0d0a9caa9caca1",
"body": null,
"is_bot": false,
"headline": "chore(release): refresh v1 validation artifacts",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-18T17:27:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7d4bdc15b7b891e58ef5dc7b07e55e012fdb1dbe",
"body": null,
"is_bot": false,
"headline": "Merge issue #7 entity and attribute contract fixes",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-18T16:55:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8bc75ba5df960be4f7203b14988897925cc28b36",
"body": null,
"is_bot": false,
"headline": "test: enforce reader branch coverage baseline",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-18T16:55:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5573f30061e423ed7c841b43af93f7b08407d5d4",
"body": null,
"is_bot": false,
"headline": "feat(reader): index materialized attributes by name",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-18T16:50:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "dffb0777291fd5e5e624aa414c609031d3de8dfc",
"body": null,
"is_bot": false,
"headline": "feat(reader): restore configurable entity decoding",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-18T16:41:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "63666ebd7a215ebcfd453a57a7ad8c40f2b50cbf",
"body": null,
"is_bot": false,
"headline": "fix(ci): keep Node 20 release gates on pnpm 10",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-18T16:14:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e6596e98f1608bea8d616ff6c51f164d67407b8e",
"body": null,
"is_bot": false,
"headline": "docs: snapshot final v1 benchmarks",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-18T15:58:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8e566f7fa8e89ba61de6bbbe615351a15ce1c444",
"body": null,
"is_bot": false,
"headline": "bench: refresh final v1 release results",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-18T15:57:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a4698eb3b88a55ceed22a2d95bb76200b55e9ed5",
"body": null,
"is_bot": false,
"headline": "docs: refresh v1 release snapshot",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-18T15:13:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6c23a3232ceafa2040c51cbfbe6f18f73d60724d",
"body": null,
"is_bot": false,
"headline": "bench: align cross-runtime reader conditions",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-18T15:12:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8ab2ea4d2ff83304432af8db9064ba1a29f80948",
"body": null,
"is_bot": false,
"headline": "docs: refresh v1 release snapshot",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-18T14:51:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8ec49d2d7a98b9311fd5cf5b5a97a122f760bad1",
"body": null,
"is_bot": false,
"headline": "bench: refresh v1 release results",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-18T14:50:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6937730267f6210308ab63f41b1b531635b21daa",
"body": null,
"is_bot": false,
"headline": "bench: add cross-language reader comparison",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-18T13:40:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4b7e1d4445222737c087e26443c87889b730f800",
"body": null,
"is_bot": false,
"headline": "fix(bench): allow converter-only interim summary",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-18T13:23:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b59ade492654b43945b66b6fa764c4272d639730",
"body": null,
"is_bot": false,
"headline": "bench: expand release memory and runtime coverage",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-18T13:12:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fc312a06378423d245abd0ede57e4cb54c63f6be",
"body": null,
"is_bot": false,
"headline": "bench: isolate RSS delta baselines",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-18T12:54:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cacdbee42060830e7c7f45b396a374190a6f1fcf",
"body": null,
"is_bot": false,
"headline": "bench: align v1 release benchmark contracts",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-18T12:48:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0235442d986d8732f5f1f827bbe59e88f8827915",
"body": null,
"is_bot": false,
"headline": "chore: upgrade workspace to pnpm 11",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-18T11:58:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5834b4cf831b6704278bb17133e3891df5ff8be8",
"body": null,
"is_bot": false,
"headline": "fix: keep token cursor scans linear",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-18T11:58:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fe169f534c22d3e38cf18f310f5632e8d7876ab6",
"body": null,
"is_bot": false,
"headline": "feat: finalize v1 XML contracts",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-18T08:37:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "400b0d1475d82f6eddf5082c89a602a415e99faf",
"body": null,
"is_bot": false,
"headline": "perf: add converter fusion and cross-runtime benchmarks",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-18T05:10:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9ec592923f9ce005aa6dc8a11e08905d40da1f4e",
"body": null,
"is_bot": false,
"headline": "ci: enforce complete v1 release gates",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-16T06:10:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7e34f0097e7f26531bbaa1a6cd66ac54c3fe4121",
"body": null,
"is_bot": false,
"headline": "docs: define v1 release readiness",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-16T06:10:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "80a2c9e60816476422f4e71c0047fbeeb2ff6a6c",
"body": null,
"is_bot": false,
"headline": "bench: add v1 runtime retention evidence",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-16T06:09:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1a72496570665e0a09f134a6ad564af888b7f91d",
"body": null,
"is_bot": false,
"headline": "test: retire stale v0 suites",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-16T06:09:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0b3bdc7b61c72ce705a0d9019f6849ff5cd66466",
"body": null,
"is_bot": false,
"headline": "chore: finalize v1 runtime and API docs",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-13T13:37:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bbda1da5e427c486e39d0eaf4eca6b14b7c13241",
"body": null,
"is_bot": false,
"headline": "perf(converter): compact active frame indexes",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-13T10:18:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a8eb5521852b1003217269090b13c214fb7440df",
"body": null,
"is_bot": false,
"headline": "docs: describe 1.0 package migration",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-13T09:44:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "daa3e61bea928df847044f71032eb3adc635c49d",
"body": null,
"is_bot": false,
"headline": "docs: align current guides with 1.0 surfaces",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-13T09:42:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a259e32f73b7a769bc7cbff0f09d93c4975fda60",
"body": null,
"is_bot": false,
"headline": "fix(writer): retain sink failure state",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-13T09:25:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "df9f4ee91cfb12c3ccf0708fdad3bbb1dc3ac6e7",
"body": null,
"is_bot": false,
"headline": "bench: add converter schema-shape probe",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-13T09:24:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ff2411a156423f0f806d9c1f6ab69d889f1265b2",
"body": null,
"is_bot": false,
"headline": "fix(writer): validate structured XML output",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-13T09:23:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ad479c25f5084b6285f81f7183ad10e2a06073e2",
"body": null,
"is_bot": false,
"headline": "fix(parser): enforce XML 1.0 name ranges",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-13T09:20:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "faad5f6f3718f9994c168d9d5448567dfdc58958",
"body": null,
"is_bot": false,
"headline": "perf(writer): restore namespaces with undo logs",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-13T09:19:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "81d0bdfbf56915528f4287e0d05b4a0a6f5684d2",
"body": null,
"is_bot": false,
"headline": "docs(converter): document fragment parse default",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-13T09:17:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ac49f4d41ba3ca5719c7c450aea7983b0eabaa6b",
"body": null,
"is_bot": false,
"headline": "ci(release): gate converter and live regressions",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-13T09:16:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "838fe1b158b87f2fcb3b6d81475b8094f44475c1",
"body": null,
"is_bot": false,
"headline": "fix(benchmark): enforce runtime checksum parity",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-13T09:14:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "015f15b7a93707fa42aa0dadf518cd3ae879e0e9",
"body": null,
"is_bot": false,
"headline": "fix(parser): validate start tags and linearize attribute entities",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-13T09:13:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "98555e0a956e35e9acd3b18bcb865e5f84effeab",
"body": null,
"is_bot": false,
"headline": "test(converter): retain nested descendant captures",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-13T09:11:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6359936a180f9b80cd3a7604b1317536ef381114",
"body": null,
"is_bot": false,
"headline": "test(converter): cover projection finalization invariants",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-13T09:10:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "aa19b8e5b0c884faf204d1b32270534e65bcfbca",
"body": null,
"is_bot": false,
"headline": "feat(converter): unify projection on dispatch IR runtime",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-13T09:09:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f878c87ab818f186c00a2a86fa2da01e1bafb493",
"body": null,
"is_bot": false,
"headline": "wip(converter): checkpoint IR projection baseline",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-13T09:00:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "28bf74075a58954b983629c74465e3852e12c1f9",
"body": null,
"is_bot": false,
"headline": "perf: optimize reader tokenization",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-12T12:34:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "eb6f92544ad8268034040ece0bf9d69c0de33dfa",
"body": null,
"is_bot": false,
"headline": "docs: remove retired converter table",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-12T07:58:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3e31aaf912db3cbf50dc586c0975e4ec10e470f6",
"body": null,
"is_bot": false,
"headline": "docs: snapshot current benchmark evidence",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-12T07:58:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "194fcca282bc6b595c7092e97dde0a3c0c678ba1",
"body": null,
"is_bot": false,
"headline": "fix: refresh public benchmark workflow",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-12T07:58:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a6234f4fccdf83932d530d8fcc1acbcfddadc6ae",
"body": null,
"is_bot": false,
"headline": "docs: remove rc3 snapshot",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-12T07:08:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c265c199e6d514dea6bb0c96a0dda9af7004fa58",
"body": null,
"is_bot": false,
"headline": "chore: preserve release validation safeguards",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-12T07:04:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cdd39e744859c154b48ee3ddfca17a4cb90c1dec",
"body": null,
"is_bot": false,
"headline": "docs: refresh generated api docs",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-12T07:00:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e35c4b88d109811f66dc1ae3d534fd866aaa2a24",
"body": null,
"is_bot": false,
"headline": "refactor: consolidate parser packages",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-12T07:00:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b99524f45b089cba3eea04114f9d1eb203f47bf0",
"body": null,
"is_bot": false,
"headline": "perf: unify event reader runtime shapes",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-12T05:57:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1e935cea75dca413b1147dd4d4197e08d40464db",
"body": null,
"is_bot": false,
"headline": "fix: align benchmark docs with stream reader labels",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-12T02:49:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "dffbfa5c6f731fb960cb06e8585c4b5533847bfd",
"body": null,
"is_bot": false,
"headline": "chore: refresh v1 benchmark set for stream readers",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-12T02:39:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c5b5ec1d48dc1c6fe957b073a6c1d928850a8c47",
"body": null,
"is_bot": false,
"headline": "docs: add stream reader API guides",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-12T02:15:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "dc35b115b611af6b5476cc4cf759367ce7957529",
"body": null,
"is_bot": false,
"headline": "fix: make v1 workflows reproducible",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-12T02:02:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "652e283ba460ac06b443585a9db323a58b33d12b",
"body": null,
"is_bot": false,
"headline": "feat: publish v1 pure-javascript public surface",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-07-11T19:46:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fb79acc29ba430fea6c6af5662f9403c049994fc",
"body": "The public docs should describe the released package model directly instead of narrating internal native or wasm experiments in the benchmark page. The benchmark pages now stay focused on measurement results, while a separate Runtime Model resource explains the current pure JavaScript boundary and i\n[…]\nive: Keep detailed native addon and wasm history in knowledge or blog material unless it directly affects current public API usage.\n\nTested: git diff --check\n\nTested: pnpm --filter=stax-xml-docs build",
"is_bot": false,
"headline": "Clarify docs around the pure JS runtime model",
"author_name": "Clickin",
"author_login": "Clickin",
"committed_at": "2026-05-05T03:20:51Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f87ef8943dfae256a73bc8981397e232b742426a",
"body": "The benchmark docs had been narrowed too far while removing native addon rows. This restores the unrelated writer/builder/converter benchmark surfaces and adds a converter comparison that uses the current pure JavaScript StreamReader batch path instead of the discarded native projection path.\n\nThe c\n[…]\nease:converter:compiled-batch\n\nTested: pnpm --filter benchmark run release:writer:1gb\n\nTested: pnpm --filter=stax-xml test\n\nTested: pnpm --filter=stax-xml-docs build\n\nTested: git diff --cached --check",
"is_bot": false,
"headline": "Restore pure JS benchmark coverage",
"author_name": "Clickin",
"author_login": "Clickin",
"committed_at": "2026-05-05T02:28:29Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "38a27fa73665cb13aa5fc8cf95e63b9ea7ffffb9",
"body": "GitHub Pages failed during Astro OG image rendering because astro-og-canvas expects canvaskit-wasm to be directly available under PNPM. The package was already present in the lockfile transitively, so this records it as an explicit docs dependency for the workflow environment.\n\nConstraint: docs.yml \n[…]\ne-risk: narrow\n\nDirective: Keep canvaskit-wasm pinned with astro-og-canvas unless the OG renderer dependency model changes\n\nTested: pnpm --filter=stax-xml-docs build\n\nTested: git diff --cached --check",
"is_bot": false,
"headline": "Make docs OG rendering reproducible in CI",
"author_name": "Clickin",
"author_login": "Clickin",
"committed_at": "2026-05-05T01:47:44Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "da4f4fcf9d345194704d7c43df87a688d8c28438",
"body": "The rc3 documentation archive now points at the pure JavaScript benchmark contract from the preceding release-benchmark commit. The snapshot includes both the runtime matrix and the 4 GiB StreamReaderSync index-first JSON artifacts so versioned docs and latest docs do not depend on the removed nativ\n[…]\nax-xml-docs snapshot:release v1.0.0-rc3 --dry-run\n\nTested: pnpm --filter=stax-xml-docs snapshot:release v1.0.0-rc3 --force\n\nTested: pnpm --filter=stax-xml-docs build\n\nTested: git diff --cached --check",
"is_bot": false,
"headline": "Archive the rc3 docs snapshot",
"author_name": "Clickin",
"author_login": "Clickin",
"committed_at": "2026-05-05T01:44:06Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4cae948c87b51ca14d11a34ed41979712da44ad8",
"body": "The public docs now use the rc3 pure JavaScript benchmark contract instead of the previous native aggregation-era wording. Runtime release artifacts were regenerated with Node/Bun/Deno rows plus the 4 GiB StreamReaderSync index-first workload, and the API guides now use the current EventReader, Stre\n[…]\ned\n\nTested: pnpm --filter=stax-xml-docs typedoc\n\nTested: pnpm --filter=stax-xml test\n\nTested: pnpm --filter=stax-xml build\n\nTested: pnpm --filter=stax-xml-docs build\n\nTested: git diff --cached --check",
"is_bot": false,
"headline": "Document the pure JS release benchmark contract",
"author_name": "Clickin",
"author_login": "Clickin",
"committed_at": "2026-05-05T01:41:56Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "254866d6a25bfcbc2b5defca5c78afbdc83f489e",
"body": "The failed cursor-reader work should remain available as benchmark knowledge, but the package README and official docs should describe only the supported public parser surfaces. This removes the public decision-history pages and replaces cursor-facing guidance with event, stream, and converter wordi\n[…]\nnce\n\nTested: rg CursorReader/cursor API/pure-js-parser-history over README, packages/stax-xml/README.md, and packages/docs\n\nTested: pnpm --filter stax-xml-docs build\n\nTested: git diff --cached --check",
"is_bot": false,
"headline": "Keep cursor history out of public docs",
"author_name": "Clickin",
"author_login": "Clickin",
"committed_at": "2026-05-04T23:34:31Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "0ee5447af43e5814e5d308c4c70a61037abe31ce",
"body": "CursorReader looked attractive in type-only scans, but normal qname, text, and attribute workloads have to materialize JavaScript strings. The facade then adds state-copy, namespace, entity, and accessor overhead, so it is easy to misread as a performance API while StreamReaderSync remains the faste\n[…]\n string workloads\n\nTested: pnpm --filter=stax-xml test\n\nTested: pnpm --filter=stax-xml build\n\nTested: git diff --cached --check\n\nNot-tested: full runtime performance matrix after public cursor removal",
"is_bot": false,
"headline": "Remove the public cursor reader facade",
"author_name": "Clickin",
"author_login": "Clickin",
"committed_at": "2026-05-04T23:30:51Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "be8e4f2d54adfde9ed5e606e8f3b8fbdf695549b",
"body": "The cursor-backed StreamReader experiment regressed the simple 16MiB fixture because the adapter eagerly copied name, text, and attribute strings into batch arrays. The stream surfaces stay on the existing IterableReader table path while the cursor core remains simplified around Uint8Array/TextDecod\n[…]\nadapter, not eager string arrays\n\nTested: pnpm --filter=stax-xml test\n\nTested: pnpm --filter=stax-xml build\n\nTested: git diff --cached --check\n\nNot-tested: full runtime performance matrix after revert",
"is_bot": false,
"headline": "Keep stream readers on the table-backed parser",
"author_name": "Clickin",
"author_login": "Clickin",
"committed_at": "2026-05-04T23:21:33Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a993affce71597da5da06cc751c0ab20870225ea",
"body": "The default stream and public cursor paths now run on a Uint8Array/TextDecoder cursor instead of Node Buffer-backed cursor files or the iterable batch parser. Document-mode validation remains delegated to the existing IterableReader core until the cursor implements the stricter XML checks.\n\nConstrai\n[…]\nr\n\nTested: pnpm --filter=stax-xml test\n\nTested: pnpm --filter=stax-xml build\n\nTested: git diff --cached --check\n\nNot-tested: runtime performance matrix after replacing Buffer.toString with TextDecoder",
"is_bot": false,
"headline": "Move stream parsing toward a browser-compatible cursor core",
"author_name": "Clickin",
"author_login": "Clickin",
"committed_at": "2026-05-04T23:09:40Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "670419c1dbc2e600f14f829834fe596fcb3fbda8",
"body": "The native and Wasm parser work is now preserved outside this package and summarized only through curated docs. Raw evidence bundles, old native smoke automation, Woodstox comparator shims, and stale benchmark reports now only reintroduce backend-mode confusion into the pure-JS repo.\n\nConstraint: st\n[…]\nr on evidence branches; only curated public docs belong in packages/docs\n\nTested: git diff --cached --check\n\nTested: pnpm --filter=stax-xml build\n\nNot-tested: GitHub Actions release workflow execution",
"is_bot": false,
"headline": "Remove research-only native evidence from the pure JS package",
"author_name": "Clickin",
"author_login": "Clickin",
"committed_at": "2026-05-04T17:45:20Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2f0385c5e80a8b3f8cc67b624eb5ac3796f4c66b",
"body": "The pure-JS decision record belongs with the official documentation rather than a root-level docs folder. Move it into the Starlight resources section, add the Korean page, expose it in the sidebar, and update README links to point at the official docs source and published URL.\n\nConstraint: Decision\n[…]\nuture parser architecture decisions under packages/docs/src/content/docs/resources when they are part of the public package story\n\nTested: pnpm --filter=stax-xml-docs build\n\nNot-tested: deploy preview",
"is_bot": false,
"headline": "Publish parser decision history in the docs site",
"author_name": "Clickin",
"author_login": "Clickin",
"committed_at": "2026-05-04T17:38:36Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a897c49df0748adeba1565334b04197a5d2a4e73",
"body": "The native and Wasm parser experiments produced useful evidence, but the README now keeps only the current package story and points readers to a focused decision history. The detailed document records the tokenizer speed, JavaScript materialization boundary, memory, and async-ingress tradeoffs that \n[…]\nnted product boundary unless full public JS workload evidence changes\n\nTested: pnpm --filter=stax-xml build\n\nNot-tested: docs site build; this change only edits markdown outside the Astro content tree",
"is_bot": false,
"headline": "Explain why stax-xml stays pure JavaScript",
"author_name": "Clickin",
"author_login": "Clickin",
"committed_at": "2026-05-04T17:34:24Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "df6a1b5eaeff1b39c19386011fa89a8658add846",
"body": "The native addon work has been copied into the external stax-xml-native repository, and this package now keeps only the JavaScript reader, cursor, converter, writer, docs, and runtime-matrix benchmark paths. Removing the backend mode also removes stale release snapshots and native diagnostic scripts\n[…]\ns 0 --json-out packages\\benchmark\\results\\tmp\\runtime-matrix-smoke.json --md-out packages\\benchmark\\results\\tmp\\runtime-matrix-smoke.md\n\nNot-tested: Bun/Deno runtime-matrix rows in this cleanup commit",
"is_bot": false,
"headline": "Keep stax-xml focused on its pure JavaScript parser contract",
"author_name": "Clickin",
"author_login": "Clickin",
"committed_at": "2026-05-04T15:54:54Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "edb6c5d28b1b771f73133cd9048ddd500fad5f21",
"body": "The public cursor facade still paid for String.trim on every CHARACTERS event even when byte boundaries made trimming impossible. The byte cursor now exposes a narrow internal boundary predicate so the facade can keep public semantics while avoiding that call on ordinary text spans.\n\nThe same slice \n[…]\nsor-public-sync,cursor-public-sync-lean,cursor-public-async-lean\n\nTested: node/bun/deno cursor-runtime-matrix.ts on 128MiB byte-batch fixture\n\nNot-tested: Full all-case 4GiB matrix across Bun and Deno",
"is_bot": false,
"headline": "Reduce cursor facade text materialization overhead",
"author_name": "Clickin",
"author_login": "Clickin",
"committed_at": "2026-05-04T14:44:06Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b14241a9ca2016716809d7ddc40d88b3d6ac923c",
"body": "…ation pass\n\nThis snapshot records the branch state after restoring the string parser baseline,\nintroducing byte-stream cursor cores, and promoting the sync/async cursor\nfacades onto the new JS path. It preserves the benchmark/doc updates together\nwith the cursor experiments so the next pass can com\n[…]\nc.test.ts; pnpm exec tsx packages/benchmark/stream-reader-4gb-compare.ts --size-mib 16\nNot-tested: full repository test matrix; 128MiB/4GiB reruns after the final namespaceAware=false fast lane wiring",
"is_bot": false,
"headline": "Preserve the current pure-JS cursor milestone before the next optimiz…",
"author_name": "Clickin",
"author_login": "Clickin",
"committed_at": "2026-05-03T14:22:22Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "456fd37fb9f42cac4dab2b67e8b3e2bae87d1a80",
"body": "Implement native streaming batchLayout=soa-string-arena for StreamReaderSync. The native parser now direct-fills SoA event and attribute columns plus a batch-local JS string arena with UTF-16 code-unit offsets, preserving the existing span-table layout as the fallback for wasm and older native backe\n[…]\njs.\n\nArtifact policy: raw benchmark JSON was written under /tmp only and is not committed. Excluded 260502-gemini-*.md, generated release result files, m4 reports, and unrelated dirty workspace files.",
"is_bot": false,
"headline": "perf(stax-xml): add streaming SoA string arena batches",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-05-03T01:56:58Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2e0f5c5395686a9b715f4bd4a0017ff84b72f691",
"body": null,
"is_bot": false,
"headline": "bench(stax-xml): compare full string arena transfer",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-05-03T01:12:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ecebcf5152df6d472d9064ad740d6b98b42a513f",
"body": null,
"is_bot": false,
"headline": "perf(stax-xml): split stream reader wrapper overhead",
"author_name": "clickin",
"author_login": "Clickin",
"committed_at": "2026-05-03T00:56:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "af60d874c8ca8ba3b0fb427291ba3acc72594bd9",
"body": "These final report artifacts belong with the intermediate reader-family snapshot so the zero-base redesign rationale and verification notes are recoverable without re-running the investigation.\n\nConstraint: The .sisyphus evidence tree is gitignored by default, so these files had to be force-added in\n[…]\ntions selective; do not bulk-add the ignored tree without an explicit review\nTested: Verified staged paths and branch targeting before commit\nNot-tested: No build or test rerun; markdown evidence only",
"is_bot": false,
"headline": "Preserve the reader-family V8 evidence reports with the snapshot",
"author_name": "Clickin",
"author_login": "Clickin",
"committed_at": "2026-05-02T04:13:56Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7a9dcbefe32398990301b9552fb9c30a78d6f2d8",
"body": "This snapshots the new batch-first StreamReader and EventReader sync/async family on its own branch so the core-plus-adapter redesign can be reviewed and resumed without mixing it with the preexisting benchmark and release-doc churn in the worktree.\n\nConstraint: Existing benchmark, release-summary, \n[…]\nt; pnpm --dir packages/stax-xml build; pnpm --filter stax-xml-docs typedoc; pnpm --filter stax-xml-docs build\nNot-tested: Reader benchmark subset regeneration; release benchmark aggregate regeneration",
"is_bot": false,
"headline": "Preserve the zero-base reader-family rebuild before broader follow-up",
"author_name": "Clickin",
"author_login": "Clickin",
"committed_at": "2026-05-02T02:13:56Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b64ded269f352566c2f7befc88d01abfd30f1b8c",
"body": "The benchmark/docs layer was still presenting JS reference and JS fallback parser rows after the bytes-mainline policy had removed them from the intended public performance story. This commit removes those rows from the benchmark generators, table renderers, and benchmark narrative, then records the\n[…]\nnchmark rows, remove them from generator, renderer, and narrative together before refreshing release artifacts\nTested: release:update on master; astro check/build\nNot-tested: external site deploy/push",
"is_bot": false,
"headline": "Remove retired JS fallback rows from benchmark outputs and docs",
"author_name": "Clickin",
"author_login": "Clickin",
"committed_at": "2026-05-01T15:18:56Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8834dcfef2612224be211e8ec8c6bd900cb11538",
"body": "The benchmark suite still assumed retired JS-backend labels and converter runtime wiring, so a full release refresh required small runner fixes before the new results could be trusted. This commit captures both the runner corrections and the regenerated release benchmark artifacts from the main mast\n[…]\nagain, fix the runner labels/runtime assumptions first instead of patching markdown outputs by hand\nTested: release:update on master; converter parity script; docs build\nNot-tested: push/publish flows",
"is_bot": false,
"headline": "Refresh the release benchmark set after the bytes-mainline policy shift",
"author_name": "Clickin",
"author_login": "Clickin",
"committed_at": "2026-05-01T15:00:14Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8af59f1142d1cebf1a1847c44fd8480875edeb8f",
"body": "…d mainline\n\nThe recent runtime work showed that keeping separate UTF-16 acceleration stories in the public facade invited wrong decisions and did not survive large-input feasibility checks. This commit makes the public contract explicit: string input remains a convenience surface, but accelerated p\n[…]\narge-input feasibility evidence\nTested: stax-xml targeted build and tests; docs build; native aggregate workspace tests; native and wasm rebuilds\nNot-tested: full release benchmark publication refresh",
"is_bot": false,
"headline": "Prevent public string paths from drifting away from the byte-optimize…",
"author_name": "Clickin",
"author_login": "Clickin",
"committed_at": "2026-05-01T14:06:13Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "86c92b670b9be850d77a115052dab8e8405c7f72",
"body": "The converter fast path needed a narrower but more useful native lane that could cover multi-segment child paths and positive positions without reopening full XPath execution in Rust.\n\nThis keeps the public converter surface intact while letting the native projection path absorb more schema-known wo\n[…]\neration gated to bounded descriptor shapes until broader fixture evidence justifies expansion\nTested: native projection fast-path tests\nNot-tested: release benchmark publication and broad docs updates",
"is_bot": false,
"headline": "Broaden bounded native converter lowering for nested selector families",
"author_name": "Clickin",
"author_login": "Clickin",
"committed_at": "2026-05-01T14:02:55Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4927fd6e873d9f943bb7da0dd62eb90c6719ee3a",
"body": "This checkpoint widens the bounded native descriptor path to nested relative\nchild selectors and positive positions without introducing a second free-form\nXPath runtime in Rust. The public compiled converter surface now has a measured\nnested-path lane, which keeps the next phase focused on real plan\n[…]\npnpm --dir packages/benchmark run dev:converter:plain-output\nNot-tested: Large-fixture release matrix for the nested-path benchmark; full XPath 1.0 semantic parity beyond the bounded descriptor subset",
"is_bot": false,
"headline": "Preserve bounded native lowering before reopening full XPath scope",
"author_name": "Clickin",
"author_login": "Clickin",
"committed_at": "2026-05-01T06:47:18Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4988a55ffd2cd02f6e3e2a44b6427ecbe589bcde",
"body": "This snapshots the full current stax-xml worktree, including the phase3\nUTF-8 value-id experiments, runtime/docs updates, and generated benchmark\nevidence, onto a dedicated remote branch before deeper hot-path analysis.\nThe goal is to give follow-on agents an exact reproducible state instead of\nforc\n[…]\nreader-overhead.mjs --output-dir knowledge/reports/iterable/stream-reader-overhead-memory-phase3\nNot-tested: No attempt was made to split unrelated user-authored workspace changes out of this snapshot",
"is_bot": false,
"headline": "Preserve the current phase3 investigation state for cross-agent analysis",
"author_name": "Clickin",
"author_login": "Clickin",
"committed_at": "2026-05-01T03:25:46Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "9489291ef764648a56cf6d542c2cf92b4106fcd8",
"body": "The package import path already supplies the stax-xml namespace, so the public reader and writer implementations now use canonical role names: EventReader, IterableReader, CursorReader, and Writer. The old StaxXml-prefixed aliases are removed from the current public surface, while runtime-prefixed b\n[…]\nx-xml test\n\nTested: pnpm --filter stax-xml typedoc:main\n\nTested: pnpm --filter stax-xml typedoc:converter\n\nTested: pnpm --filter stax-xml-docs build\n\nNot-tested: npm publish/install smoke after commit",
"is_bot": false,
"headline": "Align public surface names with package namespace",
"author_name": "Clickin",
"author_login": "Clickin",
"committed_at": "2026-04-28T10:19:13Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "3b073c131bd1d6b5d6888b24d82d2c0c7eb6a0ca",
"body": "Reader APIs now route initialized runtime capabilities through shared table adapters so parser, cursor, converter, and object helpers can use native tables without exposing addon details. Benchmarks retain native rows only as diagnostics and compare public iterable paths alongside them.\n\nConstraint:\n[…]\n-filter stax-xml test:w3c; cargo check --manifest-path packages/native-aggregate/Cargo.toml; benchmark syntax checks and smoke runs\nNot-tested: Full benchmark matrix; runs in original benchmark runner",
"is_bot": false,
"headline": "Prioritize public reader paths over native internals",
"author_name": "Clickin",
"author_login": "Clickin",
"committed_at": "2026-04-28T04:01:18Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "cf494535f4acce8e52fd098800225e931bd6531f",
"body": "The v1.0.0 runtime contract needs one shared initialization path for native, wasm, and JavaScript behavior. This adds the runtime cache and capability registry, routes parser, cursor, iterable, and converter APIs through it, and adds a native streaming event-batch ABI so ReadableStream inputs stay c\n[…]\nst:w3c\nTested: cargo check --manifest-path packages/native-aggregate/Cargo.toml\nNot-tested: cargo test --manifest-path packages/native-aggregate/Cargo.toml | existing N-API test binary link limitation",
"is_bot": false,
"headline": "Make runtime initialization own acceleration routing",
"author_name": "Clickin",
"author_login": "Clickin",
"committed_at": "2026-04-28T02:33:01Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "24421fbaa4dbc5fbd01816c53026ac1efd2aba98",
"body": "Native-backed Node iterable parsing now reads the structural-index table through a compact typed-table backend instead of delegating every event accessor through StaxXmlStructuralIndexParser and DataView calls. The public StaxXmlNodeIterableParser API stays unchanged while the native path spends les\n[…]\n packages/benchmark exec node --expose-gc ./native-iterable-file-traversal.mjs --sizes-mib=128 --warmups=1 --runs=1\n\nNot-tested: Cross-platform native package staging on macOS, Windows, and musl Linux",
"is_bot": false,
"headline": "Reduce native iterable table traversal overhead",
"author_name": "Clickin",
"author_login": "Clickin",
"committed_at": "2026-04-27T23:59:48Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4c7313151f626364f7a34539aedb8ceb73d5846a",
"body": "Node iterable parsing now resolves the matching optional native package synchronously and uses its structural-index table behind the public StaxXmlNodeIterableParser API when available. The existing JavaScript parser remains the automatic fallback, and experimental simple attribute scanning stays on\n[…]\ntaxXmlNodeIterableParser reports backend native\n\nTested: pnpm --dir packages/benchmark run dev:native:iterable-file\n\nNot-tested: Cross-platform native package staging on macOS, Windows, and musl Linux",
"is_bot": false,
"headline": "Make iterable file traversal use native acceleration",
"author_name": "Clickin",
"author_login": "Clickin",
"committed_at": "2026-04-27T23:54:34Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e55920d2da08c50487f2b9e66469f6635fe07fb2",
"body": "The rc3 publish job failed before publishing because npm provenance validates package repository metadata against the GitHub Actions source repository. Native variant package.json files had no repository field, and the facade/root metadata used a git+ URL form that is less direct than the provenance\n[…]\nripts/validate-prerelease.mjs v1.0.0-rc3; published package repository metadata check; pnpm --dir packages/stax-xml pack --dry-run; git diff --check\n\nNot-tested: npm publish retry before retagging rc3",
"is_bot": false,
"headline": "Align rc3 packages with npm provenance requirements",
"author_name": "Clickin",
"author_login": "Clickin",
"committed_at": "2026-04-27T14:51:21Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ee9d3571ac7fbb99c8dfb62536585c4632ed9a73",
"body": "This bundles the rc3 version bump, generated benchmark and docs snapshots, README/API docs refresh, unknown XML object helpers, branch-coverage cleanup, and the post-publish native resolution smoke path. The release workflow now validates published optional native resolution from an inline sample pr\n[…]\nstax-xml build; pnpm --filter=stax-xml-docs typedoc; pnpm docs:build; pnpm --dir packages/stax-xml pack --dry-run; git diff --check\n\nNot-tested: GitHub Actions prerelease/release workflows before push",
"is_bot": false,
"headline": "Prepare rc3 as the native resolution release candidate",
"author_name": "Clickin",
"author_login": "Clickin",
"committed_at": "2026-04-27T14:40:15Z",
"body_truncated": true,
"is_coding_agent": false
}
],
"releases_count": 10,
"commits_last_year": 252,
"latest_release_at": "2026-07-19T10:04:07Z",
"latest_release_tag": "v1.1.0",
"releases_from_tags": false,
"days_since_last_push": 5,
"active_weeks_last_year": 10,
"days_since_latest_release": 5,
"mean_days_between_releases": 33.5
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": false,
"health_percentage": 42,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "stax-xml",
"exists": true,
"license": "MIT",
"keywords": [
"xml",
"stax",
"parser",
"writer"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/stax-xml",
"is_deprecated": false,
"latest_version": "1.1.0",
"repository_url": "https://github.com/Clickin/stax-xml",
"versions_count": 19,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 2344,
"first_published_at": "2025-06-28T13:58:03.414000Z",
"latest_published_at": "2026-07-19T10:03:47.894000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 5
}
]
},
"popularity": {
"forks": 0,
"stars": 19,
"watchers": 0,
"fork_history": {
"days": [],
"complete": true,
"collected": 0,
"total_forks": 0
},
"star_history": null,
"open_issues_and_prs": 0
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [
"demos",
"samples"
],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [
"packages/docs/tsconfig.json",
"packages/stax-xml/tsconfig.json",
"tsconfig.json"
],
"toolchain_manifests": [
"packages/benchmark/cross-runtime/reader-quickxml/Cargo.toml",
"packages/benchmark/cross-runtime/writer-quickxml/Cargo.toml"
],
"largest_source_bytes": 63517,
"source_files_sampled": 149,
"oversized_source_files": 1,
"agent_instruction_files": [
"AGENTS.md"
],
"agent_instruction_max_bytes": 1191
},
"dependencies": {
"manifests": [
"package.json"
],
"advisories": {
"error": null,
"scope": null,
"source": null,
"findings": [],
"collected": false,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 0,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"npm"
],
"dependencies": [],
"all_dependencies": {
"error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"source": null,
"packages": [],
"collected": false,
"truncated": false,
"total_count": null,
"direct_count": null,
"indirect_count": null
}
},
"maintainership": {
"issues": {
"open_prs": 0,
"merged_prs": 1,
"open_issues": 0,
"closed_ratio": 1,
"closed_issues": 2,
"closed_unmerged_prs": 4
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "Clickin",
"commits": 275,
"avatar_url": "https://avatars.githubusercontent.com/u/10061082?v=4"
}
],
"contributors_sampled": 1,
"top_contributor_share": 1
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"ci.yml",
"docs.yml",
"prerelease.yml",
"release.yml"
],
"has_docs_dir": false,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"Cargo.lock",
"package-lock.json",
"pnpm-lock.yaml"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 3,
"reason": "branch protection is not maximal on development and all release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": null,
"reason": "no pull request found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/30 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 0,
"reason": "project has 0 contributing companies or organizations -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 10,
"reason": "30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": 10,
"reason": "packaging workflow detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 0,
"reason": "dependency not pinned by hash detected -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "no SAST tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 0,
"reason": "29 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "9a839ffb6824a25c4cc2fa6698e860daea5b5816",
"ran_at": "2026-07-25T07:12:33Z",
"aggregate_score": 3.7,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-19T23:50:37Z",
"oldest_open_prs": [],
"last_merged_pr_at": "2026-04-26T15:40:24Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": []
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/Clickin/stax-xml",
"host": "github.com",
"name": "stax-xml",
"owner": "Clickin"
},
"metrics": {
"overall": {
"key": "overall",
"band": "moderate",
"name": "Overall health",
"note": null,
"notes": [],
"value": 56,
"inputs": {
"security": 37,
"vitality": 83,
"community": 40,
"governance": 48,
"engineering": 66
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 83,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "good",
"name": "Development activity",
"note": null,
"notes": [],
"value": 71,
"inputs": {
"commits_last_year": 252,
"human_commit_share": 1,
"days_since_last_push": 5,
"active_weeks_last_year": 10
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 5 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 5
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "10/52 weeks with commits",
"points": 6.9,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 10
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "252 commits in the last year",
"points": 18,
"status": "met",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 252
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 100,
"inputs": {
"releases_count": 10,
"latest_release_tag": "v1.1.0",
"releases_from_tags": false,
"days_since_latest_release": 5,
"mean_days_between_releases": 33.5
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "10 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 10
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 5 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 5
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~33.5 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 33.5
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "maintained",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": null,
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": 5,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "last human commit 5 days ago",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_maintained",
"params": {
"days": 5
}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "at_risk",
"name": "Community & Adoption",
"value": 40,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 20,
"inputs": {
"forks": 0,
"stars": 19,
"watchers": 0,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "19 stars",
"points": 20.4,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 19
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "0 forks",
"points": 0,
"status": "missed",
"details": [
{
"code": "forks",
"params": {
"count": 0
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "0 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 0
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "moderate",
"name": "Community health",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (MIT)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "MIT"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
},
{
"key": "ecosystem_adoption",
"band": "moderate",
"name": "Ecosystem adoption (downloads)",
"note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"registry_dependents"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 56,
"inputs": {
"packages": [
"stax-xml"
],
"dependents": null,
"ecosystems": "npm",
"total_downloads": null,
"monthly_downloads": 2344
},
"components": [
{
"key": "monthly_downloads",
"name": "Monthly downloads",
"detail": "2,344 downloads/month across npm",
"points": 44.9,
"status": "partial",
"details": [
{
"code": "downloads_monthly",
"params": {
"count": 2344,
"ecosystems": "npm"
}
}
],
"max_points": 80
},
{
"key": "registry_dependents",
"name": "Registry dependents",
"detail": "not reported by this ecosystem",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_reported_by_this_ecosystem",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "at_risk",
"name": "Sustainability & Governance",
"value": 48,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 10,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 1,
"top_contributor_share": 1
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 100% of commits",
"points": 0,
"status": "missed",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 100
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "1 contributors",
"points": 1.4,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 1
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 0 contributing companies or organizations -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "moderate",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 54,
"inputs": {
"merged_prs": 1,
"open_issues": 0,
"closed_issues": 2,
"issue_closed_ratio": 1,
"closed_unmerged_prs": 4
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "100% of issues closed",
"points": 46.8,
"status": "met",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 100
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "1/5 decided PRs merged",
"points": 7.7,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 1,
"decided": 5
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "at_risk",
"name": "Ownership & stewardship",
"note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"verified_domain"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 47,
"inputs": {
"followers": 3,
"owner_type": "User",
"is_verified": null,
"owner_login": "Clickin",
"public_repos": 35,
"account_age_days": 4251
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "personal (user) account",
"points": 10,
"status": "partial",
"details": [
{
"code": "owner_personal",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": "not applicable to user accounts",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_applicable_to_user_accounts",
"params": {}
}
],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "3 followers of Clickin",
"points": 4.3,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 3,
"login": "Clickin"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "35 public repos, account ~11 yr old",
"points": 23.3,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 35
}
},
{
"code": "account_age_years",
"params": {
"years": 11
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"stax-xml"
],
"ecosystems": "npm",
"any_deprecated": false,
"min_days_since_publish": 5
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on npm",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "npm"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 5 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 5
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "19 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 19
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "moderate",
"name": "Engineering Quality",
"value": 66,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "moderate",
"name": "Engineering practices",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_ci_tests"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 60,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "4 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 4
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "no pull request found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "good",
"name": "Documentation",
"note": null,
"notes": [],
"value": 75,
"inputs": {
"topics": [
"library",
"stream",
"typescript",
"typescript-library",
"xml-builder",
"xml-parser"
],
"has_wiki": true,
"homepage": "https://clickin.github.io/stax-xml/",
"has_readme": true,
"has_docs_dir": false,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": "https://clickin.github.io/stax-xml/",
"points": 15,
"status": "met",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": "6 topics",
"points": 10,
"status": "met",
"details": [
{
"code": "topics_count",
"params": {
"count": 6
}
}
],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "at_risk",
"name": "Security",
"value": 37,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "at_risk",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): CI-Tests, Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"ci_tests",
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 37,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 16,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 2,
"scorecard_aggregate": 3.7
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection is not maximal on development and all release branches",
"points": 2.2,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "no pull request found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 0 contributing companies or organizations -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "no SAST tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "29 existing vulnerabilities detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 69,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "excellent",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 85,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.99,
"agent_instruction_files": [
"AGENTS.md"
],
"agent_instruction_max_bytes": 1191
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "AGENTS.md",
"points": 45,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "AGENTS.md"
}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "99 of 100 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 99,
"sampled": 100
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "moderate",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 56,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"Cargo.lock",
"package-lock.json",
"pnpm-lock.yaml"
],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [
"packages/docs/tsconfig.json",
"packages/stax-xml/tsconfig.json",
"tsconfig.json"
],
"agent_commit_share": 0,
"toolchain_manifests": [
"packages/benchmark/cross-runtime/reader-quickxml/Cargo.toml",
"packages/benchmark/cross-runtime/writer-quickxml/Cargo.toml"
],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "packages/benchmark/cross-runtime/reader-quickxml/Cargo.toml, packages/benchmark/cross-runtime/writer-quickxml/Cargo.toml (toolchain convention, no task runner)",
"points": 12.6,
"status": "partial",
"details": [
{
"code": "toolchain_convention",
"params": {
"files": "packages/benchmark/cross-runtime/reader-quickxml/Cargo.toml, packages/benchmark/cross-runtime/writer-quickxml/Cargo.toml"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "packages/docs/tsconfig.json, packages/stax-xml/tsconfig.json, tsconfig.json",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "packages/docs/tsconfig.json, packages/stax-xml/tsconfig.json, tsconfig.json"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "no agent-authored commits among the last 100",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_authored_commits",
"params": {
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "TypeScript",
"largest_source_bytes": 63517,
"source_files_sampled": 149,
"oversized_source_files": 1
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "TypeScript (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "TypeScript"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "1/149 source files over 60KB",
"points": 54.6,
"status": "partial",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 149,
"oversized": 1
}
}
],
"max_points": 55
}
]
},
{
"key": "ai_interfaces",
"band": "at_risk",
"name": "Machine-readable interfaces",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"example_dirs": [
"demos",
"samples"
],
"has_mcp_signal": false,
"api_schema_files": []
},
"components": [
{
"key": "api_schema_openapi_graphql_proto",
"name": "API schema (OpenAPI/GraphQL/proto)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 40
},
{
"key": "mcp_server",
"name": "MCP server",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "runnable_examples",
"name": "Runnable examples",
"detail": "demos, samples",
"points": 40,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "demos, samples"
}
}
],
"max_points": 40
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
"GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
],
"report_type": "repository",
"generated_at": "2026-07-25T07:12:44.080386Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/c/Clickin/stax-xml.svg",
"full_name": "Clickin/stax-xml",
"license_state": "standard",
"license_spdx": "MIT"
}Bewertungen sind Signale, keine Garantien. Sie spiegeln öffentlich sichtbare Praxis auf GitHub wider — kein Code-Audit und keine Sicherheitsgarantie.
Fehlende Daten werden ausgeschlossen und die Gewichte neu normiert, nie als null bewertet. Die Methodik ist versioniert und offen: Metriken v1.13.0, Schema v0.27.0 — vollständige Methodik · Metriken-Wiki.
Wie ein einzelnes Ergebnis im Gesamtregister steht: aggregierte Statistiken — npm.