InverseAltruism / cairn-cli

Der aufgelöste Abhängigkeitssatz konnte für diesen Bericht nicht erhoben werden: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository

Die Installation von npm:@inversealtruism/cairn-cli@0.3.23 zieht 6 Pakete nach sich, direkt und transitiv: 0 tragen bekannte Advisories, davon 0 direkte Abhängigkeiten.

Keine bekannten Advisories betreffen die bewerteten Abhängigkeiten.

Ein Advisory bedeutet, dass die im Abhängigkeitsgraphen erfasste Version in den betroffenen Bereich eines Advisories fällt. Erreichbarkeit wird nicht analysiert, und der Graph enthält Entwicklungs- und Test-Pins — ein Fund kann das Werkzeug betreffen und nicht die ausgelieferte Software.

{
  "data": {
    "repo": {
      "topics": [],
      "is_fork": false,
      "size_kb": 174,
      "has_wiki": true,
      "homepage": "https://cairn-substrate.com",
      "languages": {
        "Shell": 2340,
        "JavaScript": 133734,
        "TypeScript": 41091
      },
      "pushed_at": "2026-07-23T18:02:03Z",
      "created_at": "2026-05-28T22:55:53Z",
      "owner_type": "User",
      "updated_at": "2026-07-23T18:02:16Z",
      "description": "Command-line client for Cairn on Compute Substrate -- browse, verify, propose, and attest directly in the CLI.",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "MIT",
      "default_branch": "master",
      "license_spdx_raw": "MIT",
      "primary_language": "JavaScript",
      "significant_languages": [
        "JavaScript",
        "TypeScript"
      ]
    },
    "owner": {
      "blog": "https://cairn-substrate.com",
      "name": "Inverse",
      "type": "User",
      "login": "InverseAltruism",
      "company": null,
      "location": null,
      "followers": 16,
      "avatar_url": "https://avatars.githubusercontent.com/u/129900527?v=4",
      "created_at": "2023-04-04T20:12:40Z",
      "is_verified": null,
      "public_repos": 12,
      "account_age_days": 1211
    },
    "license": {
      "state": "standard",
      "spdx_id": "MIT",
      "raw_spdx": "MIT",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.3.1",
          "kind": "patch",
          "published_at": "2026-06-06T21:18:34Z"
        },
        {
          "tag": "v0.3.0",
          "kind": "minor",
          "published_at": "2026-06-04T17:41:23Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "87830654087685ea06b3c99a5d736777c614c0fb",
          "body": "…REBIND LTS baseline",
          "is_bot": false,
          "headline": "docs(FU-C): refresh the AGENTS State snapshot to the 2026-07-23 post-…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-23T18:02:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a7678986b453a56e1d4e8c4b2c03a3979346d91f",
          "body": null,
          "is_bot": false,
          "headline": "release: cairn-cli 0.3.23 (re-pin 0.1.40)",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-21T12:41:23Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "45affbdc142c926ed062013435eca3e80696d441",
          "body": "- State snapshot to S-06: version 0.3.22 @ 6af70df, pin truth (cairnx-core\n  0.1.38; the 0.1.40 re-pin + patch release = runbook), stale cairn-sdk\n  neighbor note dropped (it re-pinned long ago).\n- Plan 71 LTS perimeter: cairn-cli NAMED not-deep-audited per the residual\n  register, with its standing documented trust residuals (CLI-C1, CLI-C5/F10)\n  restated so the exclusion is written, not silent.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "B8-docs (REBIND): cairn-cli AGENTS/truth pass",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-21T00:36:00Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "6af70df9c23c5af2c549efbd9c68d42d6e41d873",
          "body": "Plan 70 consumer re-pin (handoff 71). Published @inversealtruism/cairn-cli@0.3.22\nnow pins the freshly published cairnx-core 0.1.38, satisfying the strict\ncheck-consumer-pins consumer. resolve()/records() byte-identical 0.1.37 to\n0.1.38 (only FILL_TIP_MARGIN + verifyfill changed, neither imported by the CLI),\nso the CLI runtime is identical. clean+tsc build and the full test suite\n(security, cairnx, e2e) green on the new pin.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(release): re-pin cairnx-core 0.1.38 for the v0.3.22 publish",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-17T18:05:56Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "768edbf5ba6082ff7fe8f40eee6d5df05d80cacb",
          "body": "Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_017h7GYgP2JsDnoVu5uP1VAH",
          "is_bot": false,
          "headline": "Merge Plan 70 R2/R3 into master (branch plan70-r2)",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-17T09:07:01Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "6a051a4999e000efadf185e42f8d1e10c947a8b1",
          "body": "…argv)\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_017h7GYgP2JsDnoVu5uP1VAH",
          "is_bot": false,
          "headline": "release: cairn-cli 0.3.22 (Plan 70 R2: F10 --base-units + L7 key off …",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-17T09:06:14Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "cd3e3377c28894b552c7c5726de0d096fb20ef70",
          "body": "…s addr derive\n\nF10 (CLI-C5): token-send scaled a human amount by the untrusted `decimals`\nfrom the CairnX read API; a hostile/pinned/MITM'd gateway over-reporting\ndecimals inflated the magnitude, and --yes/piped runs skip the y/N confirm,\nso automation could silently over-send. Additive, no honest-\n[…]\nnoEmit clean.\nNo version bump/tag/publish (maintainer release actions).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_017h7GYgP2JsDnoVu5uP1VAH",
          "is_bot": false,
          "headline": "Plan 70 R2 Batch E: F10 --base-units/--expect-decimals + L7 in-proces…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-17T00:53:58Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "c65870113cb847b01ef36c038d2220a8c8fb0a02",
          "body": "V28 fclaim is a consensus-gate release, so the CLI re-pins per the standing rule. cairnx-core 0.1.37\ncarries the V28 fclaim rules (gate 60,000, inert below); the CLI consensus shapes stay imported. Tests 38/0.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: re-pin cairnx-core 0.1.36 -> 0.1.37 (V28 gate); release v0.3.21",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-13T14:03:26Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "28cf94ced4ad06a40045e45298a7bb389ad646c5",
          "body": "Consensus-identical helper bump (0.1.35..0.1.36 resolve/records/types diff\nempty; CLI imports only stable consensus-surface exports). Lockfile\nregenerated; suite 38/0.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: re-pin cairnx-core 0.1.35 -> 0.1.36; release v0.3.20",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-10T20:11:47Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "68d6e335b2f2a926791210966bf37016d256a3b3",
          "body": "AGENTS.md is the canonical repo briefing for coding agents and outside\ncontributors; CLAUDE.md imports it via @AGENTS.md (edit AGENTS.md only).\nProduction and operations specifics are intentionally out of scope and\nmaintained privately.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: add public agent onboarding briefing (AGENTS.md + CLAUDE.md)",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-09T22:59:17Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "f08b067a6f46cfb123dc7377ae54018990c2344a",
          "body": "…mer-pins passes)\n\ncairn-cli uses only stable exports (epochOf/EPOCH_LEN/MIN_FEE_*/NAME_RE, all present since 0.1.34)\nso this is backward-compatible; the re-pin keeps the ecosystem on one canonical cairnx-core. 38/38.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: re-pin cairnx-core 0.1.35 (post-publish coherence; check-consu…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-06T17:41:09Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "dcab050732cb196c3a14ef218351a203ffe8e509",
          "body": "… CLI feeCap marked KEEP-DISTINCT\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "release: v0.3.19 — fee/epoch constants imported from pinned packages;…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-06T17:21:47Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "aab8ea518ad817bcabff990548a1a89951c88b6f",
          "body": "…e CLI fee bound as deliberately distinct\n\n- src/lib/config.ts: MIN_FEE_PROPOSE/MIN_FEE_ATTEST re-exported from @inversealtruism/csd-codec\n  (the local literals were a duplicate of an import that already existed 10 lines away).\n- src/cli.ts: the three Math.floor(tip / 30) hardcodes now use epochOf/E\n[…]\neCap - this is a deliberate CLI-level\n  25%-of-value sanity bound, not the consensus-side input cap; do not dedupe.\n\nnpm test green (38 passed).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "quality: import fee/epoch constants from the pinned packages; mark th…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-06T15:25:05Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "88d19187f6fdd96d1ed2c5204a3308557e946278",
          "body": null,
          "is_bot": false,
          "headline": "0.3.18",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-05T00:11:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2b7f6a4e01ae39d8f7abba5c9468f4ad109410f1",
          "body": "…l-closed)",
          "is_bot": false,
          "headline": "cli: re-pin cairnx-core 0.1.34 / csd-registry 0.1.16 (M2 registry fai…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-05T00:11:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "538819be94ee31c9877547ddb6e6dd15955c2cf2",
          "body": "…,440 / V26 46,480 / V27 46,520)\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "cli 0.3.17: re-pin cairnx-core 0.1.33 (gate move: V24 46,400 / V25 46…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-03T13:21:03Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "3320d3fed01841c18c1c44c36baf989f70b2098a",
          "body": "Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "cairn-cli 0.3.16: re-pin cairnx-core 0.1.32 (V27 sale-embargo gate)",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-03T07:48:16Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "fb819e938e92dd249a0ffa4cafc41f8b5a48da13",
          "body": "…); ships the P8 --fee fallback warning\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "cairn-cli 0.3.15: re-pin cairnx-core 0.1.31 + csd-* 0.1.15 (published…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-02T23:00:42Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "50048d817874e7979b1fa1c2a591d53ff316ebe8",
          "body": "…8, Plan 57)\n\nSafe direction already (the fee only falls DOWN to the default/minimum since 0.3.14's exact\nparsing), but silently: a typo like --fee 2e-2 looked accepted while a different fee was used.\nOne shared warnBadFee helper, all six fee sites covered.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(cli): warn when an unparseable --fee falls back to the default (P…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-02T22:58:08Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "e89ee84819b0cdbca241894a852f3420a35f07cf",
          "body": "…oney seam) + transfer() via cairnx-core\n\nPlan 57 B5a (Plan 56 items 17 + micro-9). CSD() now reuses the token path's\nexact humanToBase (8 dp): both money paths speak the same input language.\nCloses real input footguns the old Number() path accepted: a bare --amount\nflag sent 1 CSD, '1e2' sent 100 C\n[…]\nlus a\n5,000-case fuzz in review. Suite 38/38. Independent review: SHIP (3 NITs,\n2 applied, fee-fallback warn declined to keep old UX semantics).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(cli): exact decimal-string CSD parsing (kills the last float-on-m…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-02T20:00:49Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "164ccd571996d021c80f51239f6bc2fb5be04207",
          "body": "…ames (H1); 0.3.14\n\nA v2.5/v2.6 reservation (revealed, not yet finalized) was listed indistinguishably from an owned name. Display-only\n(the CLI has no name-write path, so no burn), but it misled the reserver. Now `tokens` and `names` mark a reservation\n\"(finalizing)\" using the new /cairnx/address n\n[…]\ntails.pending flag (cairnx 0.4.14+); defensive against an older\nresolver that omits nameDetails (empty set). --json output unchanged. tsc clean.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(cli): mark `pending` name reservations \"(finalizing)\" in tokens/n…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-01T21:35:14Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "f899599d81a7d2a7dee1826ee57c511e4740e5c5",
          "body": "Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "cairn-cli 0.3.13: re-pin cairnx-core 0.1.30 (V25/V26 close gates)",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-01T19:33:22Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "8b1bd41cad7f8a732d8b5ce30e2bdfc22500114b",
          "body": "Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "0.3.12: re-pin cairnx-core 0.1.28",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-01T18:32:35Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "987936073e666fbce32c4aa711bc16cd2e2a1c10",
          "body": "Read-only names (no register flow), so no nfinalize command needed. Builds + tests green\n(security 37/0, cairnx 89/0). Published @inversealtruism/cairn-cli 0.3.10.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "0.3.10: re-pin cairnx-core 0.1.26 (V25-aware core)",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-01T17:46:06Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "7ca73555a1e5b73a878095730186ed04202c28d6",
          "body": "… v0.3.9\n\nRe-pinned to the V24 core so the cli resolves names against the same fee schedule as the\nresolver. Below V24 (49200) byte-identical; no name-fee build path in the cli (read/verify).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(cli): re-pin cairnx-core 0.1.23 -> 0.1.24 (v2.4 name-fee gate);…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-30T20:08:51Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "3c4aeab40d92c25c0714784535b7f8ea6abc4923",
          "body": "…dTo); v0.3.8\n\nLockstep with the published V23 core. Byte-identical below the gate; the CLI signs payment\nfields itself, so this is a transparent dependency refresh.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(cli): re-pin cairnx-core 0.1.20 -> 0.1.23 (V23 nset-clear + pai…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-27T14:55:41Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "a9a41cc264a4b9d014f26032fcfadc3b491cb5e3",
          "body": "Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: remove em dashes from READMEs and docs (house style, no AI-slop)",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-26T19:38:45Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "f2aa5c7777caa9a7cf72b908ea0a7e9608b2c25f",
          "body": "Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(cli): re-pin cairnx-core 0.1.19 -> 0.1.20 (V22 un-cap); v0.3.7",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-26T15:43:34Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "67b3a3797a556035cae1ed50566558369427e91d",
          "body": "…er publish)\n\n0.1.19 is published; align the CLI pin so every consumer references one coherent contract version\n(audit Batch-3 version-skew finding). Byte-identical regexes/limits (0.1.19 is purely additive over 0.1.18);\nbuild + test/cairnx 89/0 + test/security 37/0 green.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(cli): re-pin cairnx-core 0.1.18 → 0.1.19 (version-coherence aft…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-24T19:10:43Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "c427e46c681d5239f069cae67852d308fea1d89d",
          "body": "…e missed CLI mirror (Phase 3)\n\ncairn-cli/src/lib/cairnx.ts hand-declared NAME_RE/TICKER_RE/ADDR_RE/MAX_AMOUNT/MAX_RECORD_BYTES and used\nthem to validate a record BEFORE the CLI spends the 0.25-CSD anchor fee — a genuine fork-class (a drifted\nregex builds a record the resolver no-ops → lost fee) tha\n[…]\nmjs 37/0. Byte-identical: the imported regexes/\nlimits equal the old hand-decls (the published 0.1.18 dist exports them verbatim).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(cli): import the consensus shapes from cairnx-core — collapse th…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-24T18:05:03Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "4d72518581d15256f538286ba2ac2308dd9e8187",
          "body": "…p 0.1.14\n\nRemediates the Wave-3 deep audit (cairn/docs/security/cairn-cli-deep-audit-2026-06-21.md).\nFunds-safe as audited (no recipient redirection possible — csd signs the payment fields);\nall fixes reject-more / fail-closed on the hostile path, honest path unchanged. Suites green\n(security 37 +C\n[…]\nn (single source; byte-identical).\n\nSupply chain: 0.3.5->0.3.6, csd-codec/registry 0.1.3->0.1.14 (lockstep), lockfile regenerated.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "security(wave3-audit): v0.3.6 — C3/C1 HIGH fixes + C4/C5/C2 + lockste…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-21T02:14:19Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "bc7fe36f69b90b778eeea256ce7f7a5bdf05f4bf",
          "body": "Adds .github/workflows/ci.yml running npm ci/build/test on push and PR.\nThe e2e suite skips cleanly offline (exit 0) by design.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "ci: add GitHub Actions workflow (build + test on Node 22)",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-21T00:58:04Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "6e316dcb4289f29bf05c87bee2c861808eb78927",
          "body": "…v0.3.5",
          "is_bot": false,
          "headline": "merge: cli H-1/H-2 key handling + UTXO-VALUE-1 cross-source + H-7 -> …",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-15T00:32:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ac0f46c8ea1b7f991e6dd1bd7f269fc0aa1ad9d0",
          "body": "…+ H-7 (v0.3.5)\n\nCloses the cairn-cli audit findings the prior max-fee guard (v0.3.4) did not:\n\nH-1 — `csd` binary was a bare $PATH lookup (a planted csd steals the wallet key on\n  any write, even --dry-run). Now resolved from CANONICAL absolute locations first\n  (defeats PATH-order hijack), PATH on\n[…]\n cross-source mismatch refusal, H-7 wording);\ncairnx 89, e2e 38 — all green. Live happy-path verified (\"✓ verified vs your node\").\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "security(cli): H-1/H-2 key handling + UTXO-VALUE-1 cross-source cure …",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-15T00:32:51Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "bc01dc97517f160c17d9b0060ac5eba8d27ebf5d",
          "body": "Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "release: v0.3.4 — UTXO-VALUE-1 max-fee guard",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-14T23:34:33Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "c802719f32ff542de4b5eda1302ef1caafd0faf6",
          "body": "…arning\n\ncairn-cli shells out to `csd` with a proxy-fetched UTXO and has no codec to recompute\nreal input values, so a lying RPC could under-report a value and silently burn the gap\nas fee. Add a max-fee sanity guard (refuse a fee > max(1 CSD, 25% of value moved), with\na --max-fee override) on send/\n[…]\nsend, plus a collapsed-\nchange warning (the under-report signature); --dry-run surfaces it without spending.\nsecurity suite 25→29.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "security(cli): UTXO-VALUE-1 max-fee sanity guard + collapsed-change w…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-14T23:34:33Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "f58440ef1a4ad92b48eaa4871dfc0d7ca6275ad1",
          "body": "…g-addr + verify-badge (v0.3.3)\n\n2026-06-14 audit remediation (see /opt/cairn_substrate/HANDOFF-HARDENING-2026-06-14.md):\n- R17 — submit success is EVIDENCE-BASED: a non-acked submit confirms OUR exact txid on-chain\n  (api.confirmTxMined) rather than trusting a forgeable \"already present/conflict\" s\n[…]\nndent; the payload_hash recompute\n  is unchanged.\n\nTests: 152 passed (security 25 + cairnx 89 + e2e 38), 0 regressions; tsc clean.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "security(hardening): evidence-based submit, RPC freshness gate, confi…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-14T06:06:52Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "21dca0871904066b09750a8e9d3853842ee7f9e7",
          "body": "Block commits that introduce secrets (private keys, API tokens). Scans\nstaged diff only; never edits files. .gitleaks.toml extends the default\nruleset and allowlists public on-chain data, conformance vectors, vendored\nforge-std, and doc placeholders (verified 0 false positives over full\nhistory). Missing-binary degrades to warn-and-skip; bypass a confirmed FP\nwith --no-verify. Activate on clone: bash .githooks/install.sh\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: add gitleaks pre-commit secret-scan hook",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-12T22:27:42Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "0e6b3c9c34782b86f9f4b2b7277666905c3e38d6",
          "body": "Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: ignore .claude/ worktrees",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-12T15:36:50Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "5bf0be41d9221b298aee75fa3039d57147a421ea",
          "body": "…info / token-send / names / name)\n\n- src/lib/cairnx.ts: CairnX read client (base order: $CAIRNX_API → local\n  127.0.0.1:8794/cairnx → public gateway, GET-only, fallback on network\n  failure only) + hand-rolled canonical transfer record builder (no dep on\n  the private cairnx repo; byte-exact vs cai\n[…]\nired into npm test; full suite 142 green (15 security + 89\n  cairnx + 38 e2e).\n- README: CairnX section + command table + CAIRNX_API config row.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(cairnx): first-class token + .csd name commands (tokens / token-…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-12T15:18:12Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "8151815f26d28e05e4432fb46b3ead411bc779dd",
          "body": "Updated README formatting for clarity and consistency.",
          "is_bot": false,
          "headline": "Fix formatting and punctuation in README.md",
          "author_name": "Inverse",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-09T08:37:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9a863a86270aa210dacf78c7d09679da035dee0f",
          "body": "…cess key-load (C-L3)\n\nFor send/propose/support the user's key stays inside the external `csd` wallet and\nnever enters the cairn-cli process. The L3 registry commands (gateway register /\npeer announce / identity claim) are the exception: they read the key from\n`csd wallet config` and sign the regist\n[…]\nreen\n(e2e 38, security 15); 0 vulns.\n\nBumps @inversealtruism/cairn-cli 0.3.1 -> 0.3.2. Found by the 2026-06-08 baseline (C-L3/D2).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "security(cli): pin L3 deps to exact versions + document the L3 in-pro…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-08T19:24:37Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "b6a1893c95088b666ef70b8199fb97592f2f5b24",
          "body": "cairn gateway register --url …/{hash}   → csd:gateways record\ncairn peer announce --peer-id --addr …   → csd:peers record\ncairn identity claim <handle> [--commit-only|--reveal --salt] → csd:identity (commit-reveal)\n\nEach builds a SIGNED record via @inversealtruism/csd-registry (binding sig computed\n\n[…]\nytes to the content origin (self-certified).\nMirrors the live-proven publish loop. --dry-run on all. Existing 53 tests still pass.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "L3 P6.0: cairn registry publish commands (gateway/peer/identity)",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-07T01:09:21Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "c64cb0279e0c9af946a78ead5e238b150d4cde3c",
          "body": "tsc never deletes outputs for removed sources, so a dirty local dist could ship\nstale artifacts (the discarded own-key keygen build left csdcore/key/txclient.js\nbehind). Clean dist first — portable, dependency-free (node fs.rmSync) — so every\nbuild/publish/clone produces only current sources. npm 0.3.1 was already published\nwith a clean (manually-wiped) dist; this prevents recurrence.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "build(cli): clean dist before tsc (build/prepare/prepublishOnly)",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-06T21:27:33Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "705ffaf5d006c2d178ee57a4ddf962619612b0f0",
          "body": "- decode-reveal banner, elapsed spinner, flicker-free watch countdown\n- security: san()/ANSI-injection strip, verify trust-claim downgrade, txid/\n  redirect validation, always-submit-via-proxy fix, privkey-off-argv\n- --dry-run on propose/support/wall place; e2e 20→38 + new security suite (15)\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Merge: v0.3.1 — terminal animations + security hardening + full e2e",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-06T21:18:17Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "2c271ccd1cb8d10aa2a4825b284e330b88f94015",
          "body": "…ll e2e\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "release: v0.3.1 — terminal animation polish + security hardening + fu…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-06T21:18:07Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "68a1bea2aa15f02aa313b311146dc1f81cbb56c7",
          "body": "signAndSubmit no longer returns early trusting csd's own auto-submit — csd\ntargets its configured node (e.g. 8789), which may not be the node the board +\nminer read (8790), so a tx could sit in the wrong mempool. Now always POST the\nsigned tx to the Cairn proxy; a benign 'already present / mempool c\n[…]\ncess (safe for a single-key wallet). Drops the unusable\ntxKnown() (the node /tx endpoint only indexes mined txs, not the mempool).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(cli): always submit via the Cairn proxy (miner-connected node)",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-06T20:46:48Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "61544e252cd9b4e6194eb33888b50fca9f837015",
          "body": "animations (TTY-gated, clig.dev preserved):\n- decode-reveal banner now scrambles each glyph then locks L→R behind a green\n  cursor (~420ms); spinner shows an elapsed counter on slow ops + clean stop;\n  new typeOut() typewriter + cursorHome() flicker-free repaint\n- watch repaints from cursor-home (no\n[…]\n (ANSI injection across 9 commands, forged-item verify, junk-txid rejection,\n  token-redirect leak, san unit); wired into npm test\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(cli): richer terminal animations + security hardening + full e2e",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-06T20:06:58Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "a5a12d4e81d0bbe0956ec2a329c2885390fc1a8c",
          "body": "cairn-cli can now transact, without ever holding a key: it drives the user's own\n`csd` wallet for signing and adds the Cairn layer on top.\n\n- New `src/lib/csd.ts`: wraps the installed `csd` binary (resolve, run, wallet config,\n  derive addr). Writes shell out to `csd` (easy-path propose/attest/spend\n[…]\n functional against the user's csd wallet. e2e 20/20\n(CAIRN_CSD forced absent in tests so they never sign). README + help updated.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: v0.3.0 — non-custodial wallet over your installed `csd`",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-04T17:40:58Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "b5c3be00fdee36225f10764213188af3e1b9cf60",
          "body": "….2.0\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Merge: CLI read commands (wall/network/quests/profile/leaderboard) v0…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-02T14:16:32Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "ed12c2dc3c59f29b989e50cde08aa524fb0736e8",
          "body": "Round out the CLI to match the site's surfaces — all read-only GET wrappers over existing board endpoints, monochrome phosphor theme preserved: cairn wall (King + top stones), cairn network/stats (live telemetry), cairn quests, cairn profile <addr> (identity + reputation), cairn leaderboard. README + version bumped to 0.2.0.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(cli): wall, network, quests, profile, leaderboard commands (v0.2.0)",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-02T14:16:32Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "fca6316fa34f9f4b982f73ac9138a0807f309f38",
          "body": "Scoped package name + public access + repo/homepage metadata; README install updated. v0.1.0 published.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Merge: publish to npm as @inversealtruism/cairn-cli",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-02T13:41:56Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "5c1c063059e29883331a1676ca6c1522495864d4",
          "body": "The bare name \"cairn-cli\" is owned by an unrelated third party, so publish under\nour own scope. Set the scoped package name, mark it public, and add repository +\nhomepage metadata. Install is now: npm i -g @inversealtruism/cairn-cli\n(README + the Cairn site updated to match). Published v0.1.0.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: publish to npm as @inversealtruism/cairn-cli",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-02T13:38:46Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "74c302cd28e8fe369810360c16215c258c041961",
          "body": "…-green); clig.dev\n\nRetheme the UI layer to match the website + wallet: black-and-white terminal with a\nsingle phosphor-green accent (#6ee7a0), bright-white emphasis, soft-red errors —\ndropping the old neon cyan/magenta. New banner is a fast (~360ms) decode-reveal of\nthe CAIRN wordmark with a blinki\n[…]\nrade\n- help documents the display flags\n\nLegacy color role-names remapped to the theme, so call sites are unchanged. CLI E2E\nstill 18/18 green.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "style: align CLI theme + animations with Cairn (monochrome + phosphor…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-05-30T12:17:20Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "92acad57f8b767b6d3a6f8aa17930ebe4720db40",
          "body": "test/e2e.mjs runs the built CLI as a subprocess against a live Cairn instance and\nasserts on real output — every command (domains, ls, lenses, show, verify, recent,\nhelp) plus error/edge paths (bad id, unreachable API, missing token). Read-only by\ndefault and skips cleanly when no instance is reacha\n[…]\n). 18 read/error assertions + the gated write probe — all green\nagainst the live board; verified the full propose→index→show→verify round-trip.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "test: black-box E2E harness for the CLI",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-05-30T11:55:43Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "798313c63e7d11e33ad8bd7c6c72afc10f9a8eaa",
          "body": "- `cairn domains` now also lists open (discovered) domains, not just featured.\n- `cairn ls --sort <lens>` ranks by any lens the board precomputes\n  (totalWeight|quadratic|repWeight|conviction|supporterCount|createdHeight),\n  matching the web UI; sealed/revealed items are flagged.\n- help + README cla\n[…]\ntodial posting + sealed claims.\n\nReads + token-posting verified against the live API; the CLI was not broken, just\nbehind on the newer surface.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: open domains in `domains`, lens `--sort` for `ls`, accurate help",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-05-30T11:47:16Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "5a2f648d872ac689e3ba62d05d159a50a6607dcf",
          "body": null,
          "is_bot": false,
          "headline": "add MIT LICENSE file",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-05-30T00:46:33Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2991a868a5126bec014b2f1361072aea5a8523df",
          "body": "Pure HTTP client (no csd binary/keys needed to browse): ls/top/watch/recent/show\nread the board API; verify recomputes the content hash and (with CAIRN_RPC) checks\nit on-chain; propose/support post through the instance with CAIRN_TOKEN. Cyberpunk\nANSI UI, npm bin (cairn), tsc build via prepare. Config: CAIRN_API/TOKEN/RPC.",
          "is_bot": false,
          "headline": "cairn-cli v0.1.0 — installable terminal client for a Cairn board",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-05-28T22:55:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        }
      ],
      "releases_count": 2,
      "commits_last_year": 58,
      "latest_release_at": "2026-06-06T21:18:34Z",
      "latest_release_tag": "v0.3.1",
      "releases_from_tags": false,
      "days_since_last_push": 6,
      "active_weeks_last_year": 9,
      "days_since_latest_release": 52,
      "mean_days_between_releases": 2.2
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": false,
      "health_percentage": 42,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "@inversealtruism/cairn-cli",
          "exists": true,
          "license": "MIT",
          "keywords": [
            "cairn",
            "compute-substrate",
            "cli"
          ],
          "ecosystem": "npm",
          "matches_repo": true,
          "registry_url": "https://www.npmjs.com/package/@inversealtruism/cairn-cli",
          "is_deprecated": false,
          "latest_version": "0.3.23",
          "repository_url": "https://github.com/InverseAltruism/cairn-cli",
          "versions_count": 21,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": 1,
          "monthly_downloads": 2644,
          "first_published_at": "2026-06-02T13:34:00.690000Z",
          "latest_published_at": "2026-07-21T12:41:47.389000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 8
        }
      ]
    },
    "popularity": {
      "forks": 0,
      "stars": 0,
      "watchers": 0,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 0
      },
      "star_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_stars": 0,
        "collected_at": null
      },
      "open_issues_and_prs": 0
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [],
      "has_llms_txt": false,
      "has_dockerfile": false,
      "has_mcp_signal": false,
      "bootstrap_files": [],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [
        "tsconfig.json"
      ],
      "toolchain_manifests": [],
      "largest_source_bytes": 76515,
      "source_files_sampled": 10,
      "oversized_source_files": 1,
      "agent_instruction_files": [
        "AGENTS.md",
        "CLAUDE.md"
      ],
      "agent_instruction_max_bytes": 13082
    },
    "dependencies": {
      "manifests": [
        "package.json"
      ],
      "advisories": {
        "error": null,
        "scope": "published_package",
        "source": "osv",
        "findings": [],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {},
        "advisory_count": 0,
        "affected_count": 0,
        "assessed_count": 6,
        "malicious_count": 0,
        "assessed_package": "npm:@inversealtruism/cairn-cli@0.3.23",
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "npm"
      ],
      "dependencies": [
        {
          "name": "@inversealtruism/cairnx-core",
          "manifest": "package.json",
          "ecosystem": "npm",
          "version_constraint": "0.1.40"
        },
        {
          "name": "@inversealtruism/csd-codec",
          "manifest": "package.json",
          "ecosystem": "npm",
          "version_constraint": "0.1.15"
        },
        {
          "name": "@inversealtruism/csd-crypto",
          "manifest": "package.json",
          "ecosystem": "npm",
          "version_constraint": "0.1.15"
        },
        {
          "name": "@inversealtruism/csd-registry",
          "manifest": "package.json",
          "ecosystem": "npm",
          "version_constraint": "0.1.16"
        }
      ],
      "all_dependencies": {
        "error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
        "source": null,
        "packages": [],
        "collected": false,
        "truncated": false,
        "total_count": null,
        "direct_count": null,
        "indirect_count": null
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 0,
        "open_issues": 0,
        "closed_ratio": null,
        "closed_issues": 0,
        "closed_unmerged_prs": 0
      },
      "bus_factor": 1,
      "bot_contributors": 0,
      "top_contributors": [
        {
          "type": "User",
          "login": "InverseAltruism",
          "commits": 58,
          "avatar_url": "https://avatars.githubusercontent.com/u/129900527?v=4"
        }
      ],
      "contributors_sampled": 1,
      "top_contributor_share": 1
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "ci.yml"
      ],
      "has_docs_dir": false,
      "linter_configs": [],
      "has_editorconfig": false,
      "has_linter_config": false,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "package-lock.json"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": null,
            "reason": "no pull request found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/30 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 0,
            "reason": "project has 0 contributing companies or organizations -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 0,
            "reason": "no update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 0,
            "reason": "project was created within the last 90 days. Please review its contents carefully",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": null,
            "reason": "packaging workflow not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 3,
            "reason": "dependency not pinned by hash detected -- score normalized to 3",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "no SAST tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 0,
            "reason": "security policy file not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": null,
            "reason": "no releases found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 9,
            "reason": "1 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "87830654087685ea06b3c99a5d736777c614c0fb",
        "ran_at": "2026-07-29T19:56:31Z",
        "aggregate_score": 3.1,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": false,
      "has_dependabot_config": false
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-23T18:02:31Z",
      "oldest_open_prs": [],
      "last_merged_pr_at": null,
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": []
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/InverseAltruism/cairn-cli",
    "host": "github.com",
    "name": "cairn-cli",
    "owner": "InverseAltruism"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "moderate",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 50,
      "inputs": {
        "security": 45,
        "vitality": 75,
        "community": 32,
        "governance": 34,
        "engineering": 62
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "good",
        "name": "Vitality",
        "value": 75,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "moderate",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 58,
            "inputs": {
              "commits_last_year": 58,
              "human_commit_share": 1,
              "days_since_last_push": 6,
              "active_weeks_last_year": 9
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 6 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 6
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "9/52 weeks with commits",
                "points": 6.2,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 9
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "58 commits in the last year",
                "points": 15.9,
                "status": "partial",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 58
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "releases_count": 2,
              "latest_release_tag": "v0.3.1",
              "releases_from_tags": false,
              "days_since_latest_release": 52,
              "mean_days_between_releases": 2.2
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "2 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 52 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 52
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~2.2 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 2.2
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "at_risk",
        "name": "Community & Adoption",
        "value": 32,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 1,
            "inputs": {
              "forks": 0,
              "stars": 0,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "0 stars",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "0 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "moderate",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 50,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": false,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (MIT)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "MIT"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          },
          {
            "key": "ecosystem_adoption",
            "band": "moderate",
            "name": "Ecosystem adoption (downloads)",
            "note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "registry_dependents"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 57,
            "inputs": {
              "packages": [
                "@inversealtruism/cairn-cli"
              ],
              "dependents": null,
              "ecosystems": "npm",
              "total_downloads": null,
              "monthly_downloads": 2644
            },
            "components": [
              {
                "key": "monthly_downloads",
                "name": "Monthly downloads",
                "detail": "2,644 downloads/month across npm",
                "points": 45.6,
                "status": "partial",
                "details": [
                  {
                    "code": "downloads_monthly",
                    "params": {
                      "count": 2644,
                      "ecosystems": "npm"
                    }
                  }
                ],
                "max_points": 80
              },
              {
                "key": "registry_dependents",
                "name": "Registry dependents",
                "detail": "not reported by this ecosystem",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_reported_by_this_ecosystem",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "at_risk",
        "name": "Sustainability & Governance",
        "value": 34,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 10,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 1,
              "top_contributor_share": 1
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 100% of commits",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 100
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "1 contributors",
                "points": 1.4,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 0 contributing companies or organizations -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "critical",
            "name": "Issue & PR responsiveness",
            "note": "Excluded from scoring (no data or not applicable): Issue resolution, PR acceptance. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "issue_resolution",
                    "pr_acceptance"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 1,
            "inputs": {
              "merged_prs": 0,
              "open_issues": 0,
              "closed_issues": 0,
              "issue_closed_ratio": null,
              "closed_unmerged_prs": 0
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "no issues or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_issues_or_data",
                    "params": {}
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "no decided pull requests or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_decided_prs_or_data",
                    "params": {}
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "at_risk",
            "name": "Ownership & stewardship",
            "note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "verified_domain"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 42,
            "inputs": {
              "followers": 16,
              "owner_type": "User",
              "is_verified": null,
              "owner_login": "InverseAltruism",
              "public_repos": 12,
              "account_age_days": 1211
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "personal (user) account",
                "points": 10,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_personal",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": "not applicable to user accounts",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_applicable_to_user_accounts",
                    "params": {}
                  }
                ],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "16 followers of InverseAltruism",
                "points": 8.8,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 16,
                      "login": "InverseAltruism"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "12 public repos, account ~3 yr old",
                "points": 14.7,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 12
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 3
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "@inversealtruism/cairn-cli"
              ],
              "ecosystems": "npm",
              "any_deprecated": false,
              "min_days_since_publish": 8
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on npm",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "npm"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 8 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 8
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "21 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 21
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "moderate",
        "name": "Engineering Quality",
        "value": 62,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "moderate",
            "name": "Engineering practices",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_ci_tests"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 60,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": false,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "1 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "moderate",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 65,
            "inputs": {
              "topics": [],
              "has_wiki": true,
              "homepage": "https://cairn-substrate.com",
              "has_readme": true,
              "has_docs_dir": false,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": "https://cairn-substrate.com",
                "points": 15,
                "status": "met",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "at_risk",
        "name": "Security",
        "value": 45,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "at_risk",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): CI-Tests, Packaging, Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "ci_tests",
                    "packaging",
                    "signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 31,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 15,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 3,
              "scorecard_aggregate": 3.1
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 0 contributing companies or organizations -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "no update tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow not detected",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 3",
                "points": 1.5,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "no SAST tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file not detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "1 existing vulnerabilities detected",
                "points": 6.8,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "excellent",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): No advisories left outstanding. Remaining weights renormalized. Matched the npm:@inversealtruism/cairn-cli@0.3.23 runtime dependency closure — what installing the published package pulls in — 6 packages. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "no_advisories_left_outstanding"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_published",
                "params": {
                  "package": "npm:@inversealtruism/cairn-cli@0.3.23",
                  "assessed": 6
                }
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "source": "osv",
              "advisories": 0,
              "affected_packages": 0,
              "assessed_packages": 6,
              "unassessed_packages": 0,
              "affected_by_severity": "none",
              "direct_affected_packages": 0
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "no direct dependency carries a known advisory",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "no_direct_advisories",
                    "params": {}
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "no indirect dependency carries a known advisory",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "no_indirect_advisories",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory carries a publication date",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_no_publication_date",
                    "params": {}
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 6,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "good",
        "name": "AI Readiness",
        "value": 70,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "excellent",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 0.879,
              "agent_instruction_files": [
                "AGENTS.md",
                "CLAUDE.md"
              ],
              "agent_instruction_max_bytes": 13082
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "AGENTS.md, CLAUDE.md",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "AGENTS.md, CLAUDE.md"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "51 of 58 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 51,
                      "sampled": 58
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "moderate",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 56,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "package-lock.json"
              ],
              "has_dockerfile": false,
              "typed_language": false,
              "bootstrap_files": [],
              "has_devcontainer": false,
              "has_linter_config": false,
              "typecheck_configs": [
                "tsconfig.json"
              ],
              "agent_commit_share": 0.862,
              "toolchain_manifests": [],
              "dependency_bot_commit_share": 0
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "tsconfig.json",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "tsconfig.json"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "50 of the last 58 commits agent-authored or agent-credited",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "agent_authored_commits",
                    "params": {
                      "count": 50,
                      "sampled": 58
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "no automated dependency updates observed",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_dependency_automation",
                    "params": {}
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 3",
                "points": 3,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "good",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 76,
            "inputs": {
              "primary_language": "JavaScript",
              "largest_source_bytes": 76515,
              "source_files_sampled": 10,
              "oversized_source_files": 1
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "JavaScript with type-check config (tsconfig.json)",
                "points": 27,
                "status": "partial",
                "details": [
                  {
                    "code": "typecheck_config_language",
                    "params": {
                      "files": "tsconfig.json",
                      "language": "JavaScript"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "1/10 source files over 60KB",
                "points": 49.5,
                "status": "partial",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 10,
                      "oversized": 1
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-29T19:56:34.983650Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/i/InverseAltruism/cairn-cli.svg",
  "full_name": "InverseAltruism/cairn-cli",
  "license_state": "standard",
  "license_spdx": "MIT"
}