Öffentliches RegisterGefährdet
Software-GesundheitsberichtSchema 0.27.0 · Metriken 1.13.0 · 2026-07-28 08:43 UTC
Dronnn / tinvest
CLI for the T-Invest API (T-Bank brokerage) — a thin, scriptable broker adapter with structured JSON output
Dronnn/tinvest erreicht einen Gesundheitsindex von 44 von 100 und liegt damit im Bereich Gefährdet. Am stärksten schneidet es bei AI Readiness (75/100) ab, am schwächsten bei Security (23/100). Zuletzt vor 8 Tagen aktualisiert. Ein einzelner Mitwirkender trägt den Großteil der jüngsten Arbeit.
44
gesamt / 100Software-Gesundheitsindex
Metriken werden auf einer Skala von 1–100 in gewichtete Kategorien gruppiert. Der Gesamtwert beginnt als ihr Mittel; sobald öffentliche Evidenz die Richtlinie für Hochrisikojurisdiktionen auslöst, wird die Bewertung angepasst und erhält die Obergrenze 49 (Gefährdet). AI Readiness liegt außerhalb.
44
Exzellent85-100Vorbildlich; erfüllt im Wesentlichen alle geprüften Kriterien
Gut70-84Gesund; geringfügige Lücken
Mittel50-69Akzeptabel mit deutlichen Lücken; Überprüfung empfohlen
Gefährdet30-49Erhebliche Schwächen; eine Übernahme erfordert Vorsicht
Kritisch1-29Schwerwiegende Probleme (aufgegeben, nur ein Maintainer, keine Hygiene)
Bewertungsprofil
Jede Achse ist eine Kategorie. Die Form zählt mehr als der Durchschnitt — ein gesundes Projekt füllt die gesamte Fläche, während ein Profil aus Spitzen und Kratern bedeutet, dass Stärke in einer Dimension Risiken in einer anderen verdeckt.
Eigentümerschaft
andrei maierPersönliches Konto
15 Follower37 öffentliche Reposseit Apr. 2012cocoonweaver.com
Dieses Repository gehört einem persönlichen Konto. Ein Projekt mit nur einem Eigentümer trägt ein höheres Kontinuitätsrisiko als ein organisationsgetragenes.
Paket-Ökosysteme
| Registry | Paket | Version | Downloads / Monat | Versionen | Zuletzt veröffentlicht |
|---|---|---|---|---|---|
| Go | github.com/Dronnn/tinvest | v1.2.0 | - | 4 | vor 8 Tagen |
Metriken nach Kategorie
Vitalität
Lebt das Projekt — wird Code geschrieben und werden Releases ausgeliefert?
62
Entwicklungsaktivität
43Gefährdet
Wie die Bewertung erfolgt
| 28.8/36 | Push-Aktualität — letzter Push vor 8 Tagen |
| 0.7/36 | Commit-Rhythmus — 1/52 Wochen mit Commits |
| 13.4/18 | Commit-Volumen — 30 Commits im letzten Jahr |
| 0/10 | OpenSSF Scorecard: Maintained — project was created within the last 90 days. Please review its contents carefully |
Verwendete Eingangsdaten
| commits_last_year | 30 |
| human_commit_share | 1 |
| days_since_last_push | 8 |
| active_weeks_last_year | 1 |
Release-Disziplin
90Exzellent
Wie die Bewertung erfolgt
| 27/27 | Liefert Releases aus — 4 Releases veröffentlicht |
| 36/36 | Release-Aktualität — letztes Release vor 8 Tagen |
| 27/27 | Release-Rhythmus — ein Release etwa alle 0,3 Tage |
| 0/10 | OpenSSF Scorecard: Signed-Releases — Project has not signed or included provenance with any releases. |
Verwendete Eingangsdaten
| releases_count | 4 |
| latest_release_tag | v1.2.0 |
| releases_from_tags | nein |
| days_since_latest_release | 8 |
| mean_days_between_releases | 0,3 |
Community & Verbreitung
Hat das Projekt Nutzer, Downloads, Aufmerksamkeit und ein einladendes Umfeld für Beitragende?
24
Popularität & Verbreitung
1Kritisch
Wie die Bewertung erfolgt
| 0/60 | Stars — 0 Stars |
| 0/25 | Forks — 0 Forks |
| 0/15 | Watcher — 0 Watcher |
Verwendete Eingangsdaten
| forks | 0 |
| stars | 0 |
| watchers | 0 |
| growth_state | unverified |
| growth_factor_pct | 100 |
| growth_unverified_reason | no_history |
Community-Gesundheit
50Mittel
Wie die Bewertung erfolgt
| 22.5/22.5 | README |
| 22.5/22.5 | Lizenz — anerkannte Lizenz (Apache-2.0) |
| 0/18 | CONTRIBUTING-Leitfaden |
| 0/13.5 | Verhaltenskodex |
| 0/7.2 | Issue-Vorlage |
| 0/6.3 | PR-Vorlage |
Verwendete Eingangsdaten
| has_readme | ja |
| has_license | ja |
| has_contributing | nein |
| has_issue_template | nein |
| has_code_of_conduct | nein |
| has_pull_request_template | nein |
Nachhaltigkeit & Governance
Überdauert das Projekt die Menschen, die es tragen — Bus-Faktor, Reaktionsfähigkeit, Trägerschaft und Paketpflege?
36
Maintainer-Resilienz (Bus-Faktor)
13Kritisch
Wie die Bewertung erfolgt
| 9/54 | Bus-Faktor — 1 Beitragende decken die Hälfte aller Commits ab |
| 0/22.5 | Commit-Verteilung — wichtigste beitragende Person verfasste 100 % der Commits |
| 1.4/13.5 | Breite der Beitragenden — 1 Beitragende |
| 3/10 | OpenSSF Scorecard: Contributors — project has 1 contributing companies or organizations -- score normalized to 3 |
Verwendete Eingangsdaten
| bus_factor | 1 |
| contributors_sampled | 1 |
| top_contributor_share | 1 |
Reaktionsfähigkeit bei Issues & PRs
1Kritisch
Wie die Bewertung erfolgt
| 0/46.8 | Issue-Lösungsquote — keine Issues oder keine Daten |
| 0/38.3 | PR-Annahme — keine entschiedenen Pull Requests oder keine Daten |
| 0/15 | OpenSSF Scorecard: Code-Review — Found 0/30 approved changesets -- score normalized to 0 |
Verwendete Eingangsdaten
| merged_prs | 0 |
| open_issues | 0 |
| closed_issues | 0 |
| issue_closed_ratio | — |
| closed_unmerged_prs | 0 |
Von der Bewertung ausgeschlossen (keine Daten oder nicht anwendbar): Issue-Lösungsquote, PR-Annahme. Die verbleibenden Gewichte wurden renormalisiert.
Eigentümerschaft & Trägerschaft
53Mittel
Wie die Bewertung erfolgt
| 10/30 | Organisatorische Trägerschaft — persönliches (Nutzer-)Konto |
| 0/20 | Verifizierte Domain — für Nutzerkonten nicht anwendbar |
| 8.7/25 | Reichweite des Inhabers — 15 Follower von Dronnn |
| 23.5/25 | Kontohistorie — 37 öffentliche Repos, Kontoalter ca. 14 Jahre |
Verwendete Eingangsdaten
| followers | 15 |
| owner_type | User |
| is_verified | — |
| owner_login | Dronnn |
| public_repos | 37 |
| account_age_days | 5.203 |
Von der Bewertung ausgeschlossen (keine Daten oder nicht anwendbar): Verifizierte Domain. Die verbleibenden Gewichte wurden renormalisiert.
Paketpflege
92Exzellent
Wie die Bewertung erfolgt
| 25/25 | Veröffentlicht & auflösbar — 1 Paket(e) auf go |
| 35/35 | Veröffentlichungsaktualität — letzte Veröffentlichung vor 8 Tagen |
| 12/20 | Versionshistorie — 4 veröffentlichte Versionen |
| 20/20 | Nicht veraltet — aktiv, nicht veraltet oder zurückgezogen |
Verwendete Eingangsdaten
| packages | github.com/Dronnn/tinvest |
| ecosystems | go |
| any_deprecated | nein |
| min_days_since_publish | 8 |
Engineering-Qualität
Sind grundlegende Engineering- und Dokumentationspraktiken vorhanden?
68
Wie die Bewertung erfolgt
| 24/24 | CI-Workflows — 3 Workflow(s) |
| 24/24 | Tests vorhanden |
| 16/16 | Linter-Konfiguration — .golangci.yml |
| 0/9.6 | Pre-Commit-Hooks |
| 0/6.4 | .editorconfig |
| 0/20 | OpenSSF Scorecard: CI-Tests — keine Daten |
Verwendete Eingangsdaten
| has_ci | ja |
| has_tests | ja |
| has_editorconfig | nein |
| has_linter_config | ja |
| has_precommit_config | nein |
Von der Bewertung ausgeschlossen (keine Daten oder nicht anwendbar): OpenSSF Scorecard: CI-Tests. Die verbleibenden Gewichte wurden renormalisiert.
Dokumentation
50Mittel
Wie die Bewertung erfolgt
| 30/30 | README |
| 0/25 | Dokumentationsverzeichnis |
| 0/15 | Dokumentations-/Homepage-Site |
| 10/10 | Repository-Beschreibung |
| 0/10 | Topics |
| 10/10 | Wiki |
Verwendete Eingangsdaten
| topics | — |
| has_wiki | ja |
| homepage | — |
| has_readme | ja |
| has_docs_dir | nein |
| has_description | ja |
Sicherheit
Sind die sichtbaren Sicherheits- und Lieferkettenpraktiken belastbar, ohne ungeklärte Exposition gegenüber Hochrisikojurisdiktionen?
23
Sicherheitslage
23Kritisch
Wie die Bewertung erfolgt
| 7.5/7.5 | Binary-Artifacts — no binaries found in the repo |
| 0/7.5 | Branch-Protection — branch protection not enabled on development/release branches |
| 0/2.5 | CI-Tests — keine Daten |
| 0/2.5 | CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected |
| 0/7.5 | Code-Review — Found 0/30 approved changesets -- score normalized to 0 |
| 0.8/2.5 | Contributors — project has 1 contributing companies or organizations -- score normalized to 3 |
| 10/10 | Dangerous-Workflow — no dangerous workflow patterns detected |
| 0/7.5 | Dependency-Update-Tool — no update tool detected |
| 0/5 | Fuzzing — project is not fuzzed |
| 2.5/2.5 | Lizenz — license file detected |
| 0/7.5 | Maintained — project was created within the last 90 days. Please review its contents carefully |
| 0/5 | Packaging — keine Daten |
| 0/5 | Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0 |
| 0/5 | SAST — no SAST tool detected |
| 0/5 | Security-Policy — security policy file not detected |
| 0/7.5 | Signed-Releases — Project has not signed or included provenance with any releases. |
| 0/7.5 | Token-Permissions — detected GitHub workflow tokens with excessive permissions |
| 1.5/7.5 | Vulnerabilities — 8 existing vulnerabilities detected |
Verwendete Eingangsdaten
| source | openssf_scorecard |
| checks_evaluated | 16 |
| scorecard_version | v5.5.0 |
| checks_inconclusive | 2 |
| scorecard_aggregate | 2,3 |
Von der Bewertung ausgeschlossen (keine Daten oder nicht anwendbar): ci_tests, packaging. Die verbleibenden Gewichte wurden renormalisiert.
AI Readiness
Wie gut ist das Repository dafür ausgestattet, mit KI-Coding-Agenten entwickelt und gepflegt zu werden? Ein unabhängiges, experimentelles Badge — Gewicht 0,0, es wird eigenständig ausgewiesen und verändert den Gesamt-Gesundheitswert nicht.
75
AI-Agentenkontext & Leitlinien
85Exzellent
Wie die Bewertung erfolgt
| 45/45 | Agentenanweisungen — AGENTS.md |
| 0/15 | Maschinenlesbare Doku (llms.txt) |
| 40/40 | Lesbare Commit-Historie — 27 von 30 menschlichen Commits benennen ihre Absicht (strukturierter Betreff oder erläuternder Text) |
Verwendete Eingangsdaten
| has_llms_txt | nein |
| legible_history_share | 0,9 |
| agent_instruction_files | AGENTS.md |
| agent_instruction_max_bytes | 6.232 |
Wie die Bewertung erfolgt
| 18/18 | Bootstrap mit einem Befehl — Makefile |
| 22/22 | Automatisierte Tests |
| 11/11 | Lint-/Format-Konfiguration — .golangci.yml |
| 11/11 | Statische Typprüfung — Go (statisch typisiert) |
| 10/10 | Reproduzierbare Umgebung — lockfile |
| 0/10 | Belegte Agentenpraxis — keine von Agenten verfassten Commits unter den letzten 30 |
| 0/8 | Automatisierte Wartung — keine automatisierten Abhängigkeits-Updates beobachtet |
| 0/10 | OpenSSF Scorecard: Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0 |
Verwendete Eingangsdaten
| has_nix | nein |
| has_tests | ja |
| lockfiles | go.sum |
| has_dockerfile | nein |
| typed_language | ja |
| bootstrap_files | Makefile |
| has_devcontainer | nein |
| has_linter_config | ja |
| typecheck_configs | — |
| agent_commit_share | 0 |
| toolchain_manifests | go.mod |
| dependency_bot_commit_share | 0 |
AI-Code-Lesbarkeit für Modelle
97Exzellent
Wie die Bewertung erfolgt
| 45/45 | Typprüfbarer Code — Go (statisch typisiert) |
| 52.4/55 | Handhabbare Dateigrößen — 8/172 Quelldateien über 60 KB |
Verwendete Eingangsdaten
| primary_language | Go |
| largest_source_bytes | 695.010 |
| source_files_sampled | 172 |
| oversized_source_files | 8 |
Maschinenlesbare AI-Schnittstellen
40Gefährdet
Wie die Bewertung erfolgt
| 40/40 | API-Schema (OpenAPI/GraphQL/proto) — proto/common.proto, proto/google/api/field_behavior.proto, proto/instruments.proto, proto/marketdata.proto, proto/operations.proto, proto/orders.proto, proto/sandbox.proto, proto/signals.proto, proto/stoporders.proto, proto/users.proto |
| 0/20 | MCP-Server |
| 0/40 | Lauffähige Beispiele |
Verwendete Eingangsdaten
| example_dirs | — |
| has_mcp_signal | nein |
| api_schema_files | proto/common.proto, proto/google/api/field_behavior.proto, proto/instruments.proto, proto/marketdata.proto, proto/operations.proto, proto/orders.proto, proto/sandbox.proto, proto/signals.proto, proto/stoporders.proto, proto/users.proto |
Eckdaten
0GitHub-Sterne
1Mitwirkende
30Commits, letzte 12 Monate
8Tage seit letztem Push
4Releases
1Bus-Faktor
0offene Issues
GoPaket-Ökosysteme
Warnungen zur Datenerhebung
- GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
Weitere Details
OpenSSF Scorecard 2.3 / 10
2.3Gesamtwert
Unabhängige, werkzeugneutrale Sicherheitsbewertung durch das quelloffene OpenSSF Scorecard. Jede Prüfung honoriert eine Sicherheits-Praxis, nicht das Werkzeug eines bestimmten Anbieters. Prüfungen, die Scorecard nicht ermitteln konnte, sind mit k. A. markiert und vom Sicherheitswert ausgeschlossen (nie als null gezählt).
| 10 | Binary-Artifacts | no binaries found in the repo |
| 0 | Branch-Protection | branch protection not enabled on development/release branches |
| k. A. | CI-Tests | no pull request found |
| 0 | CII-Best-Practices | no effort to earn an OpenSSF best practices badge detected |
| 0 | Code-Review | Found 0/30 approved changesets -- score normalized to 0 |
| 3 | Contributors | project has 1 contributing companies or organizations -- score normalized to 3 |
| 10 | Dangerous-Workflow | no dangerous workflow patterns detected |
| 0 | Dependency-Update-Tool | no update tool detected |
| 0 | Fuzzing | project is not fuzzed |
| 10 | License | license file detected |
| 0 | Maintained | project was created within the last 90 days. Please review its contents carefully |
| k. A. | Packaging | packaging workflow not detected |
| 0 | Pinned-Dependencies | dependency not pinned by hash detected -- score normalized to 0 |
| 0 | SAST | no SAST tool detected |
| 0 | Security-Policy | security policy file not detected |
| 0 | Signed-Releases | Project has not signed or included provenance with any releases. |
| 0 | Token-Permissions | detected GitHub workflow tokens with excessive permissions |
| 2 | Vulnerabilities | 8 existing vulnerabilities detected |
Direkte Abhängigkeiten 6
| Registry | Paket | Versionsvorgabe | Manifest |
|---|---|---|---|
| Go | github.com/BurntSushi/toml | v1.6.0 | go.mod |
| Go | github.com/spf13/cobra | v1.10.2 | go.mod |
| Go | golang.org/x/sys | v0.47.0 | go.mod |
| Go | golang.org/x/term | v0.45.0 | go.mod |
| Go | google.golang.org/grpc | v1.82.1 | go.mod |
| Go | google.golang.org/protobuf | v1.36.11 | go.mod |
Alle Abhängigkeiten nicht erhoben
Der aufgelöste Abhängigkeitssatz konnte für diesen Bericht nicht erhoben werden: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
JSON-Rohbericht maschinenlesbar
{
"data": {
"repo": {
"topics": [],
"is_fork": false,
"size_kb": 1214,
"has_wiki": true,
"homepage": null,
"languages": {
"Go": 1030122,
"Shell": 1100,
"Makefile": 2307
},
"pushed_at": "2026-07-20T04:53:26Z",
"created_at": "2026-07-18T16:56:23Z",
"owner_type": "User",
"updated_at": "2026-07-20T04:53:29Z",
"description": "CLI for the T-Invest API (T-Bank brokerage) — a thin, scriptable broker adapter with structured JSON output",
"is_archived": false,
"is_disabled": false,
"license_spdx": "Apache-2.0",
"default_branch": "main",
"license_spdx_raw": "Apache-2.0",
"primary_language": "Go",
"significant_languages": [
"Go"
]
},
"owner": {
"blog": "https://www.facebook.com/dddronnn",
"name": "andrei maier",
"type": "User",
"login": "Dronnn",
"company": "cocoonweaver.com",
"location": "Armenia",
"followers": 15,
"avatar_url": "https://avatars.githubusercontent.com/u/1688334?v=4",
"created_at": "2012-04-28T16:57:53Z",
"is_verified": null,
"public_repos": 37,
"account_age_days": 5203
},
"license": {
"state": "standard",
"spdx_id": "Apache-2.0",
"raw_spdx": "Apache-2.0",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v1.2.0",
"kind": "minor",
"published_at": "2026-07-20T04:57:40Z"
},
{
"tag": "v1.1.0",
"kind": "minor",
"published_at": "2026-07-19T11:13:44Z"
},
{
"tag": "v1.0.1",
"kind": "patch",
"published_at": "2026-07-19T09:32:16Z"
},
{
"tag": "v1.0.0",
"kind": "major",
"published_at": "2026-07-19T05:26:45Z"
}
],
"recent_commits": [
{
"oid": "18d2322e5abc901c60e7d2a05fce237d0b94002c",
"body": "Module path becomes github.com/Dronnn/tinvest; generated protobuf\ntypes move from internal/pb to the public pb/investapi so consumers\ncan use returned values. A new root package exposes a curated\nread-only facade over one shared connection with the CLI's exact\ninterceptor stack: instrument resolutio\n[…]\nses to internal ones\n\nThe CLI is byte-for-byte unchanged: the regenerated COMMANDS.md shows\nan empty diff and the full suite, including crash-injection e2e and\nthe live sandbox lifecycle, stays green.",
"is_bot": false,
"headline": "Make tinvest importable as a Go library",
"author_name": "andreas maier",
"author_login": "Dronnn",
"committed_at": "2026-07-20T04:53:21Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a9a46307eaab19312ae215a74385e28d3bb6cc69",
"body": "… insider deals\n\nFive read-only InstrumentsService RPCs from the pinned 1.49 contract,\nexposed per the standard envelope and exit-code contract:\n\n- research news: one page of the broker news feed (--cursor/--limit)\n- research fundamentals: full 56-field fundamentals for asset UIDs or\n instruments r\n[…]\nsion-tested against the\nheavy 15/min group). New internal/broker/research package reuses the\nexisting connection, resolver, and cache; renderers keep schema_version\nunchanged. COMMANDS.md regenerated.",
"is_bot": false,
"headline": "Add research command group: news, fundamentals, forecasts, consensus,…",
"author_name": "andreas maier",
"author_login": "Dronnn",
"committed_at": "2026-07-19T11:09:10Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "539cc7d5c1c7a924a1e233f73bfb0cf54f993327",
"body": "The fixes landed in 898913c, but git add -u skipped this then-new file;\nthe regression tests for the round-4 findings ship here.",
"is_bot": false,
"headline": "Add round-4 regression tests missed from the fix commit",
"author_name": "andreas maier",
"author_login": "Dronnn",
"committed_at": "2026-07-19T11:09:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9a375e566bb8fa928c2ad10bafeeaad25528041c",
"body": "…release archives\n\nCOMMANDS.md is generated from the binary's own --help output via\nmake docs-commands (scripts/gen-commands-doc.sh), so the reference\ncannot drift from the code. AGENTS.md and COMMANDS.md now travel in\nrelease archives so agents consuming a release get the full contract;\nREADME and AGENTS.md cross-reference both documents.",
"is_bot": false,
"headline": "Add generated command reference (COMMANDS.md) and ship agent docs in …",
"author_name": "andreas maier",
"author_login": "Dronnn",
"committed_at": "2026-07-19T09:53:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "63b8f8d17298e86571213a80ecf9ea32f369ef6a",
"body": null,
"is_bot": false,
"headline": "Drop private-doc reference from stop-orders place help text",
"author_name": "andreas maier",
"author_login": "Dronnn",
"committed_at": "2026-07-19T09:27:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "898913c2d80ee88d0d6e3f05c4806ae74b556b69",
"body": "…caps, fail-closed paths\n\nFourth independent review round, all findings probe-verified before fixing:\n\n- stop-order reconcile consumes each broker stop id once per run (seeded\n from confirmed ledger history), so one broker order can no longer\n resolve two distinct intents\n- max_open_orders is seri\n[…]\nced\n without broker calls\n- reconcile rendering failures exit 1, not the usage path\n\nOne lead refuted with evidence: stop-cancel already queries\nSTOP_ORDER_STATUS_ALL and needed no day-list fallback.",
"is_bot": false,
"headline": "Close round-4 review findings: reconcile truthfulness, cross-process …",
"author_name": "andreas maier",
"author_login": "Dronnn",
"committed_at": "2026-07-19T09:06:55Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "48d136b4fed1ec4104484a63409d2fe60debb8a7",
"body": "Black-box tests driving the compiled binary against the real T-Invest\nsandbox, behind the e2elive build tag and gated on TINVEST_TOKEN:\n\n- full order lifecycle: open, topup, place, replace, cancel, stop order,\n reconcile, close, with envelope and exit-code assertions per step\n- crash injection thro\n[…]\n and stray sandbox accounts via t.Cleanup\n\nMakefile gains test-live and lint-live (the default lint run does not\ncompile e2elive-tagged files); README points at the suite. Not part of\nmake test or CI.",
"is_bot": false,
"headline": "Add opt-in live sandbox integration suite (test/e2e-live)",
"author_name": "andreas maier",
"author_login": "Dronnn",
"committed_at": "2026-07-19T08:05:54Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1fff49e4c8a6edaebd04690952dc462f22735b7b",
"body": "Reconcile now reaches today's terminal orders through GetOrders\nadvanced execution-status filters, so a placed-then-quickly-terminal\norder (sync or async) is found instead of being falsely closed or\nnever converging; intents older than the day's list stay unresolved\nwith an operations-lookup pointer\n[…]\n envelopes\ncarry inspection guidance; post-outcome journal write failures warn on\nstderr. Release archives now carry license texts for every linked\ndependency, and the README drops the pre-1.0 banner.",
"is_bot": false,
"headline": "Make reconciliation converge and report honestly; finish release hygiene",
"author_name": "andreas maier",
"author_login": "Dronnn",
"committed_at": "2026-07-19T05:21:56Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "17ea65ba3b4f6accf7f3bbb1d30d3de63a647eb8",
"body": "…rail strictness\n\nA raw context error surfacing from the retry backoff carried no gRPC\nstatus and hit the internal-error branch before the phase rule, closing\na journal entry as rejected despite an unconfirmed send - the\nmutation-unconfirmed rule now wins regardless of error shape. Recovery\naggregat\n[…]\n, explicitly non-positive caps are rejected at load, notional\nchecks fail closed when instrument currency or lot size is unknown, and\nthe kill switch uses Lstat so a dangling symlink still engages it.",
"is_bot": false,
"headline": "Close core-layer review findings: classification, recovery, and guard…",
"author_name": "andreas maier",
"author_login": "Dronnn",
"committed_at": "2026-07-19T05:15:30Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2dead9638a8f1c0c8b4f3ddc7866b9e6a3131d30",
"body": "Broker error 30057 means the order_id was recognized as a duplicate but\nthe original report could not be returned - proof the key reached the\nbroker with the outcome unknown. Treating it as a rejection invited a\nreplacement order against a possibly live one; on mutations it now\nclassifies as unconfirmed (exit 7), the reconcile hint attaches, and\nthe intent stays unresolved in the journal.",
"is_bot": false,
"headline": "Classify duplicate-without-report as unconfirmed, not rejected",
"author_name": "andreas maier",
"author_login": "Dronnn",
"committed_at": "2026-07-19T04:14:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5e07dd76cf884dbbf913534e7b61dbec518f835a",
"body": "PostOrderAsync orders become queryable only after exchange acceptance,\ndelivered via the orders stream with no documented upper bound - so a\nNOT_FOUND probe proves nothing about an async intent. Reconciliation\nnow checks the day's order list for the exchange order by\norder_request_id; when absent it\n[…]\n re-run reconcile or watch the orders stream. The delayed\ndouble-check applies to synchronous placements only, where a persistent\nNOT_FOUND is meaningful - it was previously gated the wrong way round.",
"is_bot": false,
"headline": "Never close an async intent as not-placed on GetOrderState NOT_FOUND",
"author_name": "andreas maier",
"author_login": "Dronnn",
"committed_at": "2026-07-19T04:09:11Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "0e1f0aa39ab2966818b4eb60e708dc2a53de4395",
"body": "A kill-switch check that errors (permissions, ENOTDIR, transient I/O)\nnow blocks the mutation instead of silently passing - an emergency\nbrake must engage when its own state is unreadable. The switch is also\nre-checked at the last safe moment before the intent journal's\nsend-started record on all fi\n[…]\nas outside max_notional (they carry no local\nprice; allow_market_orders is their gate). GetAssets/GetAssetBy join\nthe 15-requests-per-minute instrument-list limiter group per the June\n2026 API limits.",
"is_bot": false,
"headline": "Make the kill switch fail closed and re-check it before every send",
"author_name": "andreas maier",
"author_login": "Dronnn",
"committed_at": "2026-07-19T04:01:40Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4304f5a7bd9d3f878472dfa35aa008079470773b",
"body": "Reliability core: call phase now tracks the final attempt rather than a\nmonotonic high-water mark, so a retried mutation whose last attempt died\nmid-send classifies as unconfirmed (exit 7) even when an earlier attempt\ngot a response. The journal repairs a torn tail on open (quarantining\nthe partial \n[…]\n\n--confirm-margin-trade, preview/max-lots table output, Apache-2.0\nLICENSE with attribution files shipped in release archives, and the\nrelease workflow gates on build/vet/lint/tests before publishing.",
"is_bot": false,
"headline": "Fix production-readiness review findings across the mutation path",
"author_name": "andreas maier",
"author_login": "Dronnn",
"committed_at": "2026-07-19T03:36:41Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "eabce2e6b6c2bde78eafd66e6f2bd4be39614dcf",
"body": "The test keyed shutdown on the count of successful reconciles and\nasserted the server-side snapshot count, but connection 0 is built to\ndrop while its reconcile may be in flight: whether that RPC survives\nthe drop is a race, so on jittery runners a third connection appeared\n(the ~1s runs were the wa\n[…]\nterministic.\n\nAlso pin the shutdown-latency invariant with a regression test:\ncancelling the run context on an established silent connection must\nexit well under the watchdog window without redialing.",
"is_bot": false,
"headline": "Deracify the reconnect-replay test; guard shutdown latency",
"author_name": "andreas maier",
"author_login": "Dronnn",
"committed_at": "2026-07-18T23:15:39Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b0bc9fe32ddd6e65e1297b4089d54c9776c6e110",
"body": "…m event polish\n\nAGENTS.md documents the machine contract for automation callers: the\nenvelope, the exit-code table with required actions (notably exit 7 ->\nreconcile before any retry), idempotent order IDs, policy guardrails,\nthe NDJSON stream event catalogue, and rate-limit behavior.\n\nEmpty broker\n[…]\neration is covered by tests and documented, and\ngoreleaser snapshot builds produce artifacts for all six platforms.\nMan pages are omitted: generation would pull dependencies the module\ndoes not carry.",
"is_bot": false,
"headline": "Prepare release: agent guide, completions docs, Windows ledger, strea…",
"author_name": "andreas maier",
"author_login": "Dronnn",
"committed_at": "2026-07-18T22:32:27Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4552740a94661ab265181407804f85ebb64b1d76",
"body": "stream marketdata/portfolio/positions/orders emit NDJSON: one\nself-describing event per line (type, schema_version, RFC3339 time)\nwith explicit lifecycle events - connected, disconnected, resubscribed,\nsnapshot, lagging - and a final shutdown event on SIGINT/SIGTERM.\n\nThe runner stores subscription \n[…]\nts and refreshed best-effort\nfrom GetUserTariff; every retry attempt is charged. When waiting would\noverrun the call deadline the call fails fast as RATE_LIMITED (exit 4).\n--no-rate-limit disables it.",
"is_bot": false,
"headline": "Add resilient streaming and client-side rate limiting",
"author_name": "andreas maier",
"author_login": "Dronnn",
"committed_at": "2026-07-18T21:49:43Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7d9b1b526a09b1766c374311b677db8b62c492c4",
"body": "…, user, signals\n\nCommand groups: portfolio get, positions get, balance get; operations\nlist and trades list over GetOperationsByCursor with cursor paging and\n--all; instruments list/dividends/coupons/accrued-interest/schedules/\ntrading-status; candles get with client-side windowing over the\nper-int\n[…]\nariff and\nuser margin; signals strategies and signals list.\n\nAll read-only: no ledger involvement, no mutations. Views render both\nJSON envelopes and tables; money and quotations stay decimal strings.",
"is_bot": false,
"headline": "Add read-only breadth: portfolio, operations, reference data, candles…",
"author_name": "andreas maier",
"author_login": "Dronnn",
"committed_at": "2026-07-18T20:22:47Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "6fc027ab871627f49c2be94e5b0f1d7575fb7bec",
"body": "The fake listens on 127.0.0.1 only, but the profile pointed the CLI at\nlocalhost, which macOS resolves IPv6-first: every dial tried ::1, failed\nover, and on an IPv6-filtered CI runner the dead attempt could ride the\nwhole 10s per-call deadline (TestConcurrentDuplicateIntents, exit 6).\nTarget the bound address directly; the leaf cert already carries a\n127.0.0.1 IP SAN.",
"is_bot": false,
"headline": "Dial the e2e fake by numeric loopback to avoid the IPv6-first race",
"author_name": "andreas maier",
"author_login": "Dronnn",
"committed_at": "2026-07-18T20:04:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2c622e8c7469c52a8b86feb76593373df528605c",
"body": "Build the real binary once and drive it as a subprocess against an\nin-process gRPC fake served over TLS from a runtime-generated CA:\nhappy path, SIGKILL between send and confirmation plus reconcile,\nbroker rejection, policy kill switch, stdout/stderr discipline, and\nconcurrent duplicate intents. Each run is isolated in its own XDG\nsandbox; the suite is deterministic (no sleeps) and runs in ~2s.",
"is_bot": false,
"headline": "Add black-box crash-injection e2e suite",
"author_name": "andreas maier",
"author_login": "Dronnn",
"committed_at": "2026-07-18T19:30:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a99450a45ad4c94869e4e0357550e247be33c740",
"body": "Cancel the context only after the fake server confirms receipt of the\nrequest, instead of racing a fixed deadline against the send. Removes\nthe CI flake where a slow runner hit the deadline before the request\nwent on the wire (not_sent, exit 6) rather than after (exit 7).",
"is_bot": false,
"headline": "Make ambiguous-order test deterministic",
"author_name": "andreas maier",
"author_login": "Dronnn",
"committed_at": "2026-07-18T19:14:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8cca00cf9112a0c2f95e2af723bb3f953f4edc2b",
"body": "…EADME",
"is_bot": false,
"headline": "Wire CA bundle from config into transport; clarify cert bundling in R…",
"author_name": "andreas maier",
"author_login": "Dronnn",
"committed_at": "2026-07-18T18:15:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cea23b0c6be64e395f46b52acc961d8600fc816e",
"body": "ca_file profile option / TINVEST_CA_FILE env pointing at a PEM bundle\nused as the root pool for API connections. Hostname verification stays\nenabled; there is deliberately no way to disable certificate checks.",
"is_bot": false,
"headline": "Support app-local CA bundle for Russian trusted certificates",
"author_name": "andreas maier",
"author_login": "Dronnn",
"committed_at": "2026-07-18T18:11:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "70804ab91fb014435de468b274869fc7c805e2ce",
"body": "- Stop orders are never auto-retried (no documented dedup guarantees);\n reconcile matches by instrument/direction/quantity/stop price and\n reports ambiguity instead of guessing\n- Sandbox commands force the sandbox endpoint and honor the kill switch",
"is_bot": false,
"headline": "Add stop-orders and sandbox command groups",
"author_name": "andreas maier",
"author_login": "Dronnn",
"committed_at": "2026-07-18T18:11:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1abebdafc8ff961b3bd3ce115cc88be10aacbbc2",
"body": "- CI: build/vet/test with race detector on ubuntu+macos, lint via the\n same pinned invocation as local dev, generated-code sync check\n- Drift: weekly advisory buf-breaking comparison against upstream\n contracts; never blocks commit status\n- Release: goreleaser on v* tags, static binaries for darwin/linux/windows",
"is_bot": false,
"headline": "Add CI, weekly contract-drift check, and release automation",
"author_name": "andreas maier",
"author_login": "Dronnn",
"committed_at": "2026-07-18T17:57:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bebb21bb5ae84d12b35481e0092f0aedb67b488e",
"body": "- Place flow journals every intent before the network send; ambiguous\n outcomes exit 7 with a reconcile hint carrying the idempotency key\n- orders reconcile resolves unconfirmed intents via GetOrderState;\n orders wait polls to a terminal state\n- Policy file: kill switch, market-order opt-in, lot/n\n[…]\ninstrument allowlist, open-order limit - checked before any network call\n- JSON stdin input for place; retries enabled for reads by default\n- Local input validation now precedes token/connection setup",
"is_bot": false,
"headline": "Add orders command group with intent ledger and policy guardrails",
"author_name": "andreas maier",
"author_login": "Dronnn",
"committed_at": "2026-07-18T17:50:16Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "65e8347706fbbf6bfbc9736e85f3cd760382c914",
"body": "Resolver accepts uid, FIGI, or TICKER@CLASSCODE with a 24h file cache;\nquotes last/close and orderbook get with depth validation; NOT_FOUND\nmaps to the broker-rejection exit code.",
"is_bot": false,
"headline": "Add instrument resolver, quotes, and orderbook commands",
"author_name": "andreas maier",
"author_login": "Dronnn",
"committed_at": "2026-07-18T17:27:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7d52e71e200ff4c93d58f61e06fe8b53a8106de0",
"body": "Append-only JSONL journal with fsync-per-append, flock interprocess\nlocking, crc32c corruption detection, monthly rotation, and an\nUnresolved scan for crash recovery of in-flight order intents.",
"is_bot": false,
"headline": "Add write-ahead intent ledger",
"author_name": "andreas maier",
"author_login": "Dronnn",
"committed_at": "2026-07-18T17:27:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3fb73ef3ef2df73fa0a62d15cd33db9cd025fbf3",
"body": "Adapted from invest-api-go-sdk v1.40.1 retry package (Apache-2.0,\nattribution preserved in NOTICE and THIRD_PARTY_LICENSES.md). Reads are\nretried by default; mutations only with an explicit idempotency marker.\nRESOURCE_EXHAUSTED honors the x-ratelimit-reset trailer.",
"is_bot": false,
"headline": "Port retry interceptor with jittered backoff and idempotency gating",
"author_name": "andreas maier",
"author_login": "Dronnn",
"committed_at": "2026-07-18T17:27:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "95fa5476bd4a753738eb55cf5ba1837a18908dbb",
"body": "- gRPC transport with auth/deadline/app-name interceptors and call-phase tracking\n- TOML config profiles with flag/env/file precedence\n- Uniform JSON envelope with schema_version, error classification, exit-code contract\n- Commands: version, token check, accounts list\n- Unit tests: decimal conversion, envelope goldens, exit codes, config, bufconn transport",
"is_bot": false,
"headline": "Add transport layer, config profiles, JSON envelope, and first commands",
"author_name": "andreas maier",
"author_login": "Dronnn",
"committed_at": "2026-07-18T17:15:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f5275e7eacbd8786c9ba9ecea8a84e884bbd7e21",
"body": "…eline, module layout",
"is_bot": false,
"headline": "Scaffold project: vendored T-Invest contracts (1.49), buf codegen pip…",
"author_name": "andreas maier",
"author_login": "Dronnn",
"committed_at": "2026-07-18T16:56:15Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 4,
"commits_last_year": 30,
"latest_release_at": "2026-07-20T04:57:40Z",
"latest_release_tag": "v1.2.0",
"releases_from_tags": false,
"days_since_last_push": 8,
"active_weeks_last_year": 1,
"days_since_latest_release": 8,
"mean_days_between_releases": 0.3
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": false,
"health_percentage": 42,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "github.com/Dronnn/tinvest",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "go",
"matches_repo": true,
"registry_url": "https://pkg.go.dev/github.com/Dronnn/tinvest",
"is_deprecated": false,
"latest_version": "v1.2.0",
"repository_url": "https://github.com/Dronnn/tinvest",
"versions_count": 4,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-07-20T04:53:21Z",
"latest_version_yanked": null,
"days_since_latest_publish": 8
}
]
},
"popularity": {
"forks": 0,
"stars": 0,
"watchers": 0,
"fork_history": {
"days": [],
"complete": true,
"collected": 0,
"total_forks": 0
},
"star_history": {
"days": [],
"complete": true,
"collected": 0,
"total_stars": 0,
"collected_at": null
},
"open_issues_and_prs": 0
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [
"Makefile"
],
"api_schema_files": [
"proto/common.proto",
"proto/google/api/field_behavior.proto",
"proto/instruments.proto",
"proto/marketdata.proto",
"proto/operations.proto",
"proto/orders.proto",
"proto/sandbox.proto",
"proto/signals.proto",
"proto/stoporders.proto",
"proto/users.proto"
],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [
"go.mod"
],
"largest_source_bytes": 695010,
"source_files_sampled": 172,
"oversized_source_files": 8,
"agent_instruction_files": [
"AGENTS.md"
],
"agent_instruction_max_bytes": 6232
},
"dependencies": {
"manifests": [
"go.mod"
],
"advisories": {
"error": null,
"scope": null,
"source": null,
"findings": [],
"collected": false,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 0,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"go"
],
"dependencies": [
{
"name": "github.com/BurntSushi/toml",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.6.0"
},
{
"name": "github.com/spf13/cobra",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.10.2"
},
{
"name": "golang.org/x/sys",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.47.0"
},
{
"name": "golang.org/x/term",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.45.0"
},
{
"name": "google.golang.org/grpc",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.82.1"
},
{
"name": "google.golang.org/protobuf",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.36.11"
}
],
"all_dependencies": {
"error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"source": null,
"packages": [],
"collected": false,
"truncated": false,
"total_count": null,
"direct_count": null,
"indirect_count": null
}
},
"maintainership": {
"issues": {
"open_prs": 0,
"merged_prs": 0,
"open_issues": 0,
"closed_ratio": null,
"closed_issues": 0,
"closed_unmerged_prs": 0
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "Dronnn",
"commits": 30,
"avatar_url": "https://avatars.githubusercontent.com/u/1688334?v=4"
}
],
"contributors_sampled": 1,
"top_contributor_share": 1
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"ci.yml",
"drift.yml",
"release.yml"
],
"has_docs_dir": false,
"linter_configs": [
".golangci.yml"
],
"has_editorconfig": false,
"has_linter_config": true,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"go.sum"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 0,
"reason": "branch protection not enabled on development/release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": null,
"reason": "no pull request found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/30 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 3,
"reason": "project has 1 contributing companies or organizations -- score normalized to 3",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 0,
"reason": "project was created within the last 90 days. Please review its contents carefully",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": null,
"reason": "packaging workflow not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 0,
"reason": "dependency not pinned by hash detected -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "no SAST tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": 0,
"reason": "Project has not signed or included provenance with any releases.",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 2,
"reason": "8 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "18d2322e5abc901c60e7d2a05fce237d0b94002c",
"ran_at": "2026-07-28T08:43:17Z",
"aggregate_score": 2.3,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-27T09:40:00Z",
"oldest_open_prs": [],
"last_merged_pr_at": null,
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": []
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/Dronnn/tinvest",
"host": "github.com",
"name": "tinvest",
"owner": "Dronnn"
},
"metrics": {
"overall": {
"key": "overall",
"band": "at_risk",
"name": "Overall health",
"note": null,
"notes": [],
"value": 44,
"inputs": {
"security": 23,
"vitality": 62,
"community": 24,
"governance": 36,
"engineering": 68
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "moderate",
"name": "Vitality",
"value": 62,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "at_risk",
"name": "Development activity",
"note": null,
"notes": [],
"value": 43,
"inputs": {
"commits_last_year": 30,
"human_commit_share": 1,
"days_since_last_push": 8,
"active_weeks_last_year": 1
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 8 days ago",
"points": 28.8,
"status": "partial",
"details": [
{
"code": "push_recency",
"params": {
"days": 8
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "1/52 weeks with commits",
"points": 0.7,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 1
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "30 commits in the last year",
"points": 13.4,
"status": "partial",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 30
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": null,
"notes": [],
"value": 90,
"inputs": {
"releases_count": 4,
"latest_release_tag": "v1.2.0",
"releases_from_tags": false,
"days_since_latest_release": 8,
"mean_days_between_releases": 0.3
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "4 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 4
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 8 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 8
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~0.3 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 0.3
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "Project has not signed or included provenance with any releases.",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "unverified",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": "repository_too_young",
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": null,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "maintenance record not established from the collected data",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_unverified",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "critical",
"name": "Community & Adoption",
"value": 24,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 1,
"inputs": {
"forks": 0,
"stars": 0,
"watchers": 0,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "0 stars",
"points": 0,
"status": "missed",
"details": [
{
"code": "stars",
"params": {
"count": 0
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "0 forks",
"points": 0,
"status": "missed",
"details": [
{
"code": "forks",
"params": {
"count": 0
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "0 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 0
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "moderate",
"name": "Community health",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (Apache-2.0)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "Apache-2.0"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "at_risk",
"name": "Sustainability & Governance",
"value": 36,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 13,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 1,
"top_contributor_share": 1
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 100% of commits",
"points": 0,
"status": "missed",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 100
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "1 contributors",
"points": 1.4,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 1
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 1 contributing companies or organizations -- score normalized to 3",
"points": 3,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "critical",
"name": "Issue & PR responsiveness",
"note": "Excluded from scoring (no data or not applicable): Issue resolution, PR acceptance. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"issue_resolution",
"pr_acceptance"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 1,
"inputs": {
"merged_prs": 0,
"open_issues": 0,
"closed_issues": 0,
"issue_closed_ratio": null,
"closed_unmerged_prs": 0
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "no issues or no data",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_issues_or_data",
"params": {}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "no decided pull requests or no data",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_decided_prs_or_data",
"params": {}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "moderate",
"name": "Ownership & stewardship",
"note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"verified_domain"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 53,
"inputs": {
"followers": 15,
"owner_type": "User",
"is_verified": null,
"owner_login": "Dronnn",
"public_repos": 37,
"account_age_days": 5203
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "personal (user) account",
"points": 10,
"status": "partial",
"details": [
{
"code": "owner_personal",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": "not applicable to user accounts",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_applicable_to_user_accounts",
"params": {}
}
],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "15 followers of Dronnn",
"points": 8.7,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 15,
"login": "Dronnn"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "37 public repos, account ~14 yr old",
"points": 23.5,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 37
}
},
{
"code": "account_age_years",
"params": {
"years": 14
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 92,
"inputs": {
"packages": [
"github.com/Dronnn/tinvest"
],
"ecosystems": "go",
"any_deprecated": false,
"min_days_since_publish": 8
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on go",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "go"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 8 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 8
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "4 published versions",
"points": 12,
"status": "partial",
"details": [
{
"code": "published_versions",
"params": {
"count": 4
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "moderate",
"name": "Engineering Quality",
"value": 68,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "good",
"name": "Engineering practices",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_ci_tests"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 80,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": true,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "3 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 3
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": ".golangci.yml",
"points": 16,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": ".golangci.yml"
}
}
],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "no pull request found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "moderate",
"name": "Documentation",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"topics": [],
"has_wiki": true,
"homepage": null,
"has_readme": true,
"has_docs_dir": false,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "critical",
"name": "Security",
"value": 23,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "critical",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): CI-Tests, Packaging. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"ci_tests",
"packaging"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 23,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 16,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 2,
"scorecard_aggregate": 2.3
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection not enabled on development/release branches",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "no pull request found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 1 contributing companies or organizations -- score normalized to 3",
"points": 0.8,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow not detected",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "no SAST tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "Project has not signed or included provenance with any releases.",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "8 existing vulnerabilities detected",
"points": 1.5,
"status": "partial",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 2
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "good",
"name": "AI Readiness",
"value": 75,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "excellent",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 85,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.9,
"agent_instruction_files": [
"AGENTS.md"
],
"agent_instruction_max_bytes": 6232
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "AGENTS.md",
"points": 45,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "AGENTS.md"
}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "27 of 30 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 27,
"sampled": 30
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "good",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 72,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"go.sum"
],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [
"Makefile"
],
"has_devcontainer": false,
"has_linter_config": true,
"typecheck_configs": [],
"agent_commit_share": 0,
"toolchain_manifests": [
"go.mod"
],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "Makefile",
"points": 18,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Makefile"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": ".golangci.yml",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": ".golangci.yml"
}
}
],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "Go (statically typed)",
"points": 11,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "no agent-authored commits among the last 30",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_authored_commits",
"params": {
"sampled": 30
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 97,
"inputs": {
"primary_language": "Go",
"largest_source_bytes": 695010,
"source_files_sampled": 172,
"oversized_source_files": 8
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Go (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "8/172 source files over 60KB",
"points": 52.4,
"status": "partial",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 172,
"oversized": 8
}
}
],
"max_points": 55
}
]
},
{
"key": "ai_interfaces",
"band": "at_risk",
"name": "Machine-readable interfaces",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"example_dirs": [],
"has_mcp_signal": false,
"api_schema_files": [
"proto/common.proto",
"proto/google/api/field_behavior.proto",
"proto/instruments.proto",
"proto/marketdata.proto",
"proto/operations.proto",
"proto/orders.proto",
"proto/sandbox.proto",
"proto/signals.proto",
"proto/stoporders.proto",
"proto/users.proto"
]
},
"components": [
{
"key": "api_schema_openapi_graphql_proto",
"name": "API schema (OpenAPI/GraphQL/proto)",
"detail": "proto/common.proto, proto/google/api/field_behavior.proto, proto/instruments.proto, proto/marketdata.proto, proto/operations.proto, proto/orders.proto, proto/sandbox.proto, proto/signals.proto, proto/stoporders.proto, proto/users.proto",
"points": 40,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "proto/common.proto, proto/google/api/field_behavior.proto, proto/instruments.proto, proto/marketdata.proto, proto/operations.proto, proto/orders.proto, proto/sandbox.proto, proto/signals.proto, proto/stoporders.proto, proto/users.proto"
}
}
],
"max_points": 40
},
{
"key": "mcp_server",
"name": "MCP server",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "runnable_examples",
"name": "Runnable examples",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 40
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
],
"report_type": "repository",
"generated_at": "2026-07-28T08:43:22.349278Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/d/Dronnn/tinvest.svg",
"full_name": "Dronnn/tinvest",
"license_state": "standard",
"license_spdx": "Apache-2.0"
}Bewertungen sind Signale, keine Garantien. Sie spiegeln öffentlich sichtbare Praxis auf GitHub wider — kein Code-Audit und keine Sicherheitsgarantie.
Fehlende Daten werden ausgeschlossen und die Gewichte neu normiert, nie als null bewertet. Die Methodik ist versioniert und offen: Metriken v1.13.0, Schema v0.27.0 — vollständige Methodik · Metriken-Wiki.
Wie ein einzelnes Ergebnis im Gesamtregister steht: aggregierte Statistiken — Go.