airomhq/airom erreicht einen Gesundheitsindex von 66 von 100 und liegt damit im Bereich Mittel. Am stärksten schneidet es bei Security (100/100) ab, am schwächsten bei Sustainability & Governance (30/100). Zuletzt heute aktualisiert. Ein einzelner Mitwirkender trägt den Großteil der jüngsten Arbeit.
66
gesamt / 100
Mittel
Software-Gesundheitsindex
Metriken werden auf einer Skala von 1–100 in gewichtete Kategorien gruppiert. Der Gesamtwert beginnt als ihr Mittel; sobald öffentliche Evidenz die Richtlinie für Hochrisikojurisdiktionen auslöst, wird die Bewertung angepasst und erhält die Obergrenze 49 (Gefährdet). AI Readiness liegt außerhalb.
66
Exzellent85-100Vorbildlich; erfüllt im Wesentlichen alle geprüften Kriterien
Gut70-84Gesund; geringfügige Lücken
Mittel50-69Akzeptabel mit deutlichen Lücken; Überprüfung empfohlen
Gefährdet30-49Erhebliche Schwächen; eine Übernahme erfordert Vorsicht
Kritisch1-29Schwerwiegende Probleme (aufgegeben, nur ein Maintainer, keine Hygiene)
Bewertungsprofil
Jede Achse ist eine Kategorie. Die Form zählt mehr als der Durchschnitt — ein gesundes Projekt füllt die gesamte Fläche, während ein Profil aus Spitzen und Kratern bedeutet, dass Stärke in einer Dimension Risiken in einer anderen verdeckt.
Dieses Repository wird von einer Organisation getragen — geteilte, rechenschaftspflichtige Trägerschaft, die jeden einzelnen Maintainer überdauern kann.
Wie gut ist das Repository dafür ausgestattet, mit KI-Coding-Agenten entwickelt und gepflegt zu werden? Ein unabhängiges, experimentelles Badge — Gewicht 0,0, es wird eigenständig ausgewiesen und verändert den Gesamt-Gesundheitswert nicht.
Handhabbare Dateigrößen — 0/286 Quelldateien über 60 KB
Verwendete Eingangsdaten
primary_language
Go
largest_source_bytes
35.839
source_files_sampled
286
oversized_source_files
0
Eckdaten
8GitHub-Sterne
1Mitwirkende
45Commits, letzte 12 Monate
0Tage seit letztem Push
2Releases
1Bus-Faktor
0offene Issues
GoPaket-Ökosysteme
Warnungen zur Datenerhebung
GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
OpenSSF Scorecard did not return a usable result (2026/07/21 23:22:09 Warning: PATs stored in env variables GITHUB_AUTH_TOKEN and GITHUB_TOKEN differ. Scorecard will use the former.); skipping Scorecard checks
Weitere Details
Stern- und Fork-Verlauf 8 ★ / 1 ⇿
8Sterne
1Forks
1Releases
Wann jeder Stern und Fork hinzugefügt wurde, von GitHub erfasst und nach Tagen gruppiert. Das kumulierte Wachstum steht direkt über den täglichen Zugängen, aus denen es besteht, sodass beide gegeneinander lesbar sind: stetiger organischer Zuwachs sieht ganz anders aus als ein abrupter, kurzlebiger Ausschlag. Wo dieser Unterschied messbar ist, wird er als Wachstumsauthentizität ausgewiesen.
Major 0Minor 1Patch 0
Direkte Abhängigkeiten 16
Registry
Paket
Versionsvorgabe
Manifest
Go
github.com/CycloneDX/cyclonedx-go
v0.11.0
go.mod
Go
github.com/bmatcuk/doublestar/v4
v4.10.0
go.mod
Go
github.com/charlievieth/fastwalk
v1.0.14
go.mod
Go
github.com/cloudflare/ahocorasick
v0.0.0-20240916140611-054963ec9396
go.mod
Go
github.com/go-git/go-git/v5
v5.19.1
go.mod
Go
github.com/knadh/koanf/parsers/yaml
v1.1.0
go.mod
Go
github.com/knadh/koanf/providers/file
v1.2.1
go.mod
Go
github.com/knadh/koanf/providers/posflag
v1.0.1
go.mod
Go
github.com/knadh/koanf/v2
v2.3.5
go.mod
Go
github.com/spf13/cobra
v1.10.2
go.mod
Go
github.com/spf13/pflag
v1.0.10
go.mod
Go
github.com/zeebo/xxh3
v1.1.0
go.mod
Go
golang.org/x/mod
v0.38.0
go.mod
Go
golang.org/x/sync
v0.22.0
go.mod
Go
golang.org/x/tools
v0.48.0
go.mod
Go
gopkg.in/yaml.v3
v3.0.1
go.mod
Alle Abhängigkeiten nicht erhoben
Der aufgelöste Abhängigkeitssatz konnte für diesen Bericht nicht erhoben werden: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
JSON-Rohbericht maschinenlesbar
{
"data": {
"repo": {
"topics": [
"ai-governance",
"ai-security",
"aibom",
"cyclonedx",
"golang",
"mlops",
"sarif",
"sbom",
"supply-chain-security",
"ai-bill-of-materials",
"compliance",
"devsecops",
"eu-ai-act",
"llm-security",
"ml-security",
"mlsecops",
"model-scanning",
"nist-ai-rmf",
"owasp",
"vulnerability-scanner"
],
"is_fork": false,
"size_kb": 1448,
"has_wiki": true,
"homepage": null,
"languages": {
"Go": 1096330,
"MDX": 161975,
"Python": 64565,
"Makefile": 4401
},
"pushed_at": "2026-07-21T07:24:31Z",
"created_at": "2026-07-17T03:33:22Z",
"owner_type": "Organization",
"updated_at": "2026-07-21T13:37:17Z",
"description": "Open-source AI Bill of Materials (AIBOM) scanner: inventories AI models, datasets, prompts, embeddings, vector DBs & RAG pipelines across code, containers & Kubernetes — with file:line evidence, load-time risk detection (poisoned pickle / Keras Lambda / unsafe torch.load) and NIST AI RMF / OWASP compliance mapping. CycloneDX · SARIF · JSON.",
"is_archived": false,
"is_disabled": false,
"license_spdx": "Apache-2.0",
"default_branch": "main",
"license_spdx_raw": "Apache-2.0",
"primary_language": "Go",
"significant_languages": [
"Go",
"MDX"
]
},
"owner": {
"blog": null,
"name": null,
"type": "Organization",
"login": "airomhq",
"company": null,
"location": null,
"followers": 0,
"avatar_url": "https://avatars.githubusercontent.com/u/306122292?v=4",
"created_at": "2026-07-17T07:30:06Z",
"is_verified": null,
"public_repos": 1,
"account_age_days": 4
},
"license": {
"state": "standard",
"spdx_id": "Apache-2.0",
"raw_spdx": "Apache-2.0",
"file_present": true,
"scorecard_found": null,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v0.1.3",
"kind": "patch",
"published_at": "2026-07-21T06:48:02Z"
},
{
"tag": "v0.1.0",
"kind": "minor",
"published_at": "2026-07-17T13:11:03Z"
}
],
"recent_commits": [
{
"oid": "924c650897eb58a6026ffd441e29579cac2fe65b",
"body": "Rework the card so the scan-glyph badge is vertically centered on the AIROM\nwordmark in the left gutter, and every text element (eyebrow, wordmark, tagline,\nvalue line, chips, URL) shares one left margin — no more misaligned edges.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: tidy social-preview layout — glyph centered, single left margin",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-21T07:24:29Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "99434e019dbd5126443aff153014eeaca7c9c7bc",
"body": "Regenerate the 1280×640 social-preview with a small logo mark: an indigo\napp-badge holding a white magnifier scanning an AI node graph — the \"scan AI\nassets\" idea — as a lockup left of the AIROM wordmark.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: add a scan-glyph logo to the social-preview card",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-21T07:18:11Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "d9e0305d98845bfc360ccdbbbb44738e201a0076",
"body": "A 1280×640 branded card for the repository's social preview (the Open Graph\nimage shown when the repo is shared on X/Slack/LinkedIn). GitHub-dark + indigo,\nleading with the AIBOM tagline and the risk-detection / CycloneDX·SARIF /\nNIST AI RMF·OWASP / offline-deterministic differentiators.\n\nThe image \n[…]\n; setting it as the actual social preview\nis a one-time upload in Settings → General → Social preview (UI-only — GitHub\nexposes no API for it).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: add the GitHub social-preview card (.github/social-preview.png)",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-21T07:06:00Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "67c6c51a0f6137aa437b44238738b652f0104ba5",
"body": "Bring the metadata level with the shipped features (risk detection, compliance\nmapping) and cover the high-intent, low-competition search terms:\n\n- PyPI (sdk/python/pyproject.toml): keywords 7 -> 20 (ai-bill-of-materials,\n ml-bom, ai-security, llm-security, ml-security, mlsecops, ai-governance,\n c\n[…]\nset on GitHub directly (repo settings, live now): topics expanded 10 -> 20\nand a sharper repo description covering the risk + compliance angle.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: sharpen SEO metadata (keywords, descriptions) for discoverability",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-21T07:01:13Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "b475617b295f131499c67052951d5b868ac21ca6",
"body": "The AI-native risk overlay (artifact + code risks → CycloneDX vulnerabilities[]\n/ SARIF / --fail-on risk) and compliance framework mapping (NIST AI RMF, OWASP\nAgentic → CycloneDX attestations / report / --fail-on compliance) landed after\nv0.1.0, so no released binary and no PyPI wheel carried them —\n[…]\nching `v0.1.3` tag (pushed next) drives goreleaser for the signed\nbinaries + GitHub release; its notes auto-generate from the feat/fix commits.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "release: v0.1.3 — ship the risk overlay and compliance mapping",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-21T06:40:52Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "4395071462845bf10d1bb28682ad3fd8934db19d",
"body": "…isks end-to-end\n\nVerifying the risk overlay surfaced a real gap: keras-lambda, gguf-template, and\nsavedmodel-pyfunc were covered only by inline unit tests — no committed,\nscannable fixture exercised them through the full pipeline into every writer\n(the way python-langchain-rag's poisoned.pt already\n[…]\nties[]`; a real `airom fs` scan of the committed fixture flags every\nrisk and the risk/compliance gates fire. Full suite + golangci-lint clean.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "test(e2e): commit the risky-models fixture — all five artifact/code r…",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-20T13:45:53Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "2a599e27a57bed72590e9c1cb4877e0d6950bb6c",
"body": "The compliance feature (PR4–PR5) shipped but the user-facing docs didn't mention\nit. Bring both level with docs/compliance.md.\n\nREADME:\n- New \"Compliance mapping\" section: the --compliance flag, the mapping-not-\n certification contract (manual controls carry no score), the two frameworks\n (nist-ai\n[…]\ny; every claim cross-checked against the shipped behavior. Mintlify\n`broken-links` clean and `mint dev` compiles with no errors on Node 24 LTS.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: document compliance mapping in the README and the Mintlify site",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-20T13:28:03Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "1937cce51afd67bbadb73f89cfc5e81746033dfe",
"body": "… Agentic framework\n\nPR5 completes the compliance feature on top of PR4's mapping engine, adding the\ntwo things that make it usable in a real workflow — a human-readable report and\na CI gate — plus a second framework.\n\n1. Compliance report writer (`-o compliance[=report.md]`, internal/writer/\n com\n[…]\nhe\ncompliance-gate grammar/matching/guard suite, and OWASP load/RCE mapping. Docs:\ndocs/compliance.md (report, gate, frameworks) + docs/cli.md.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(compliance): report writer, --fail-on compliance gate, and OWASP…",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-20T13:18:04Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "17971f3b0bcc5734772f670399b9fa7146e6c391",
"body": "…X attestations (NIST AI RMF)\n\nPR4 of the AI-native security work, and the payoff of the risk overlay: a\n`--compliance <framework>` flag that maps the assembled AIBOM onto a governance\nframework's controls and projects the result into CycloneDX's native\nattestation model. First framework: NIST AI RM\n[…]\nonfidence regression, and the projection pinned in the cdx/native/yaml\ngoldens. Docs: docs/compliance.md + the --compliance row in docs/cli.md.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(compliance): map the AIBOM onto governance frameworks — CycloneD…",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-20T12:49:56Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "855f9710a409fd15431e601baa0e81610558bf53",
"body": "…l page\n\nThe installation page still claimed AIROM was pre-release with \"no prebuilt\nbinaries to download\" and documented only `go install` / build-from-source —\nboth false as of v0.1.0. Ground truth (verified): v0.1.0 is tagged and released\nwith cosign-signed binaries, and `airom` is on PyPI (bundl\n[…]\nnt broken-links` clean, `mint dev` compiles\nwith no errors, /installation renders 200. Every claim checked against PyPI and a\nreal pip install.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs(docs-site): add pip install and fix the stale pre-release instal…",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-20T12:01:14Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "ee463beaac61530e81ddef4b0bbfdae6e28d7f54",
"body": "…site\n\nThe hosted docs predated the artifact-risk overlay (PR1–PR3). Bring them level\nwith the README and docs/risks.md:\n\n- New concepts/risks.mdx: the five-risk catalog with severities, the\n suspicion-not-verdict framing, how risks project (CycloneDX vulnerabilities[],\n SARIF security results, na\n[…]\national.\n\nDocs only; every claim cross-checked against docs/risks.md and the shipped\nprojections. docs.json validated; MDX components balanced.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs(docs-site): mirror the risk detection section into the Mintlify …",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-20T11:52:39Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "0e725c03397bebfcf514798d5180a9709c669159",
"body": "The risk overlay (PR1–PR3) is a genuine differentiator and the README didn't\nmention it beyond a now-stale PickleRisk bullet. Add:\n\n- A \"Risk detection\" section: the five-risk catalog (pickle-import,\n keras-lambda, gguf-template, savedmodel-pyfunc, unsafe-load) with severities\n and what each catch\n[…]\n/ 101 rules / 9 categories,\n incl. the security category and risk: field).\n\nDocs only; every claim cross-checked against the shipped behavior.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs(readme): document the AI-native risk detection features",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-20T09:43:07Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "438b7d0ba9476f15f478b7732ec9646443fa7f80",
"body": "…weights_only=False)\n\nPR3 of the artifact-risk work: teach the rule engine to emit risks, and ship\nthe first code-level risk. Where PR1/PR2 attach risks to model *artifacts*, a\n`torch.load(..., weights_only=False)` is a property of the *code* — so this adds\nthe general mechanism and one exemplar.\n\nM\n[…]\n: risk-emission + unknown-id validation in ruleengine, pos/neg pack\nfixtures. Docs: risks.md catalog entry + the risk: field in rule-schema.md.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(risk): code-level risk mechanism + unsafe-load pack (torch.load …",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-20T08:54:09Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "f5ca05340feb2202fb527559ce4440daf62948e6",
"body": "…template, SavedModel PyFunc)\n\nPR2 of the artifact-risk work: the first detection checks that plug into the\nPR1 spine. Each scans bytes the detector has ALREADY read (a bounded header/\ncontent buffer, never tensor data), so it adds no memory beyond the existing\nread (P2), and each projects into vuln\n[…]\nbenign negatives), a\nreal CLI scan flags all three and gates via --fail-on risk, go test ./...\ngreen, -race green, golangci-lint + gofmt clean.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(risk): three AI-native artifact-risk checks (Keras Lambda, GGUF …",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-20T08:28:31Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "91299bee6f52899ed55a0f528c55d84bca3d7c92",
"body": "CI's `gofmt -l .` scans testdata/ (which golangci-lint and gofumpt skip\nlocally), so the comment alignment in riskyTorchPickle tripped the format gate.\nContent-identical; regenerates no fixtures.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "style: gofmt the e2e gen.go risky-pickle helper",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-20T07:54:06Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "7481603c931d181452d6d21eed4fa3bbe35ff2bc",
"body": "…-native security finding\n\nPR1 of the artifact-risk work: generalize the pickle-specific signal into a\nfirst-class, evidence-linked risk overlay projected into every format, with a\nCI gate. Zero new detection — the torch pickle walk is unchanged; this is the\nspine the later checks (Keras Lambda, GGU\n[…]\nere with tests. go test ./... green, -race green, golangci-lint\nclean. 25 of the touched files are mechanical golden regens gaining Risks:null.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(risk): artifact-risk overlay spine (ArtifactRisk) — the first AI…",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-20T07:48:59Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "0c11347278a1578da6ee382e88fc7b6cd95a0f34",
"body": "Lead with AIROM's own identity rather than \"what Trivy is to SBOMs.\"\nReworded every Trivy reference across the docs and two code comments to\nstand on its own or point at the generic category (SBOM/scanner tooling),\npreserving the technical meaning of each design rationale:\n\n- README, docs-site (inde\n[…]\n\n\nNo behavior change: comment-only in Go, docs otherwise. `go build ./...`\nand the touched packages' tests pass; `grep -ri trivy` is now empty.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: remove the Trivy analogy and comparisons throughout",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-20T06:49:20Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "7ab4927e09c571800aa27a1f1ddad0a19d35cf1d",
"body": "… MODEL_ID and training hyperparameters\n\nThe Cisco head-to-head left four gaps; the two headline ones landed in\n585352d. These are the remaining two.\n\n1. MODEL_ID env vars in compose/Dockerfile now surface as models. The k8s\n source already treated MODEL_ID as an AI signal; compose and Dockerfile\n\n[…]\nackages,\ngolangci-lint clean. New coverage: envmodel_test.go, TestModelFold*,\nthe training pack pos/neg fixtures, and a rewritten assertNoLeak.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(detectors): close the two lesser Cisco-comparison gaps — compose…",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-20T06:10:13Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "585352d38d8f4959944f050872ed7e438477e559",
"body": "…model IDs and manifest-vs-code double counting\n\nThe head-to-head against Cisco's aibom left AIROM with two verified losses.\nA fine-tuning script's BASE_MODEL = \"gpt-4o-mini-2024-07-18\" produced no\ncomponent at all — the single most important fact in the file, silently\nabsent. And the same real-worl\n[…]\n golden's warning is gone — its uses edge now survives\ninto the CycloneDX output. Full suite green under -race; goldens\nregenerated; lint clean.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(detectors): close the two Cisco-comparison gaps — variable-bound …",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-17T17:59:22Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "6e8bc541c847bfafe71040376f01e890b06dd090",
"body": "P2 (\"peak RSS is a function of configuration, never input size\") was\ndocumented as guarded by a perf-regression test. It was not. Both memory\nassertions open with `if raceEnabled { t.Skip }`, and the only `go test`\ninvocation in CI passes -race — so every P2 assertion skipped on every run.\n\nAdd a de\n[…]\neakMemory remains opt-in via AIROM_PERF_HEAVY and so is still\nnot enforced in CI -- a pre-existing choice to keep the job fast, untouched\nhere.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(perf): arm the P2 memory gate in CI, on a baseline that holds still",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-17T16:39:41Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "513e251de86ae01f3d12f54b0a378f91462ef5bd",
"body": "Bumps the Python SDK to 0.1.2, which is what publishes today's fixes to PyPI —\nthe nanosecond-timestamp decode that broke every scan on Python 3.10, and the\nmissing build test dependency. 0.1.1 on the index still carries the broken\ndecode.\n\nDry-running goreleaser before tagging (a tag is immutable o\n[…]\ngets clean with zero unmatched\nglobs, CGO_ENABLED=0 holds, and the wheel's bundled binary reports 0.1.2.\nSDK suite 26/26 on real 3.10 and 3.13.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "release: SDK 0.1.2, and prepare the v0.1.0 release",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-17T13:01:13Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "19e72f83a3bd5a2c6e43dedede45e65aa8f62be7",
"body": "… build dep\n\nCI's Python SDK job has been red since 07:21 today, on two independent faults\nthat both hid behind the same red X.\n\n1. Every scan test failed with `ValueError: Invalid isoformat string:\n '2026-07-17T12:05:20.639213449+00:00'`. Before 3.11, datetime.fromisoformat\n accepts ONLY 3- or \n[…]\n\non both, plus the wheel build and its .data/scripts guard. ruff's 9 findings\nwere all in the code added here — CI had never reached that step.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(sdk): decode Go's nanosecond timestamps, and give the tests their…",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-17T12:24:58Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "452068f34a196f430768d065c7075a2b82b28269",
"body": "`go install` fetches a zip from the module proxy, not a checkout, so the binary\ncarries no vcs.* stamps and `airom --version` printed\n\n airom v0.0.0-20260717115955-5ab297f08f99 (commit none, built unknown)\n\n— \"none\" and \"unknown\" sitting directly beside a string that spells out both.\nA pseudo-ver\n[…]\nis [-.], not \"-\": of the three documented\nforms only the base-less one uses a dash, and requiring one silently skipped\nboth post-release forms.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: read the commit and build time back out of a pseudo-version",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-17T12:04:26Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "5ab297f08f994aa0fdaa0ad50cc72ef768a42fe5",
"body": "`airom --version` printed \"dev (commit none, built unknown)\" on any binary not\nbuilt by make/goreleaser — which includes `go install ...@latest`, the way users\nactually install it. main.go carried only the ldflags sentinels and no fallback.\nThis was not cosmetic: ToolInfo is embedded in every AIBOM,\n[…]\nput\nat --parallel 1 vs 16, and zero diff against the pre-fix binary across 2 GB of\nthird-party code — no new false positives, no lost findings.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: report an honest version, and stop three flags from lying",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-17T11:59:55Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "2f59d1d37c250224dbdfabd937051cdef2408930",
"body": "… noise\n\nA real scan reported 1,330 components, roughly a thousand of them false. Three\ndetectors were claiming findings their evidence could not support. The principle\nin each case: a file's extension, path, or a keyword's presence is not evidence —\nsomething must corroborate the claim.\n\nMeasured o\n[…]\nt Cisco's aibom (verified: their CycloneDX reporter emits only\nbom_ref/licenses/name/properties/type/version), but the absolute was a liability.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(detectors): corroboration-gate the dataset, prompt, and ai-config…",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-17T11:10:35Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "daea88e5efef6627cdb5dbf0856e4e2a9b02507d",
"body": "Two terminal-UX improvements, both of which degrade to exactly the previous\nbehaviour the moment the output is not a terminal.\n\nHelp. Cobra's default was one flat list of twelve commands (with `scan`, the\ncommand most people want, sorted last behind `fs`) and one undifferentiated wall\nof twenty flag\n[…]\nsion (the\nellipsis is one column but three bytes, so it overshot and could split a\nmulti-byte character) and two dead symbols I had left behind.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(cli): grouped, styled help and a live scan progress indicator",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-17T09:34:02Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "2255bcca3f2abff00359072b4dbe45ef3f6170f4",
"body": "The 0.1.1 wheel jobs all failed with \"bundles no airom binary\": both workflow\nguards still grepped the wheel for /_bin/airom, the package-data path the binary\nshipped from before it moved to .data/scripts/. The guard was correct to fail —\nit was just asserting the old contract.\n\nThey now assert the \n[…]\nctionlint clean.\n\nThe version gate did its job: with the wheels failing, publish was skipped, so\nnothing was uploaded and 0.1.1 stays available.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(ci): verify the wheel installs the airom SCRIPT, not package data",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-17T09:06:21Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e432ce26e0947c62b6bd9d7e58168e1d76c2e257",
"body": "…s version\n\nTwo defects in the 0.1.0 wheel, both found by actually installing it:\n\n1. `pip install airom` gave you the library but NOT the command. The binary was\n packaged as package data (airom/_bin/airom), reachable only via `import\n airom` — `airom` was not on PATH at all. It now ships via t\n[…]\ninary must not report \"dev\"). Also documents the PATH caveat for\n`go install`, which writes to $(go env GOPATH)/bin and does not add it to PATH.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(sdk): make `airom` a real command after pip install, and stamp it…",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-17T09:03:10Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "13914d3333111efc6f9278dc0f7b7bfd71a89028",
"body": "The repo now lives at github.com/airomhq/airom. The Go module path must follow\nthe canonical location: with the repo transferred but go.mod still declaring\ngithub.com/Roro1727/airom, `go install github.com/airomhq/airom/cmd/airom@latest`\nfails with \"module declares its path as github.com/Roro1727/ai\n[…]\n golangci-lint (0 issues — the depguard\nimport-direction rules key on the module path), the full -race suite, and the\nPython SDK suite all pass.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "refactor: move to the airomhq org and rename the module path",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-17T07:40:21Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "283c4aae47f814cd79c464a200567cd1f5daf9d0",
"body": null,
"is_bot": false,
"headline": "Update README.md",
"author_name": "Roro",
"author_login": "Roro1727",
"committed_at": "2026-07-17T07:34:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3feb3a528e6643cc6225269f30ea8295c55f89f9",
"body": "The version-check step redirected the whole Python script's stdout into\n$GITHUB_OUTPUT, so the ::notice:: workflow command landed in the outputs file —\nwhich only accepts key=value — and the step failed with:\n\n ##[error]Invalid format '::notice::airom 0.1.0.dev0 on pypi.org: will publish'\n\nWrite \n[…]\n airom` without --pre, so publishing 0.1.0.dev0 would have produced\na release nobody gets by default. 0.1.0 makes the first publish installable.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(ci): keep ::notice:: out of $GITHUB_OUTPUT; release the SDK as 0.1.0",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-17T07:20:58Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "056b62a44c4d4d53293818e9b7b2c2d0e4b57a53",
"body": "A push to main that touches the SDK (or the scanner it bundles) builds and\npublishes sdk/python to PyPI.\n\nAuth is PyPI Trusted Publishing (OIDC): GitHub Actions proves its identity to\nPyPI directly, so no API token is stored as a secret — nothing to leak or\nrotate. Setup is a pending publisher on py\n[…]\nlint clean; the version gate dry-run resolves 0.1.0.dev0 against\nthe live index (project absent -> publish=true). The name 'airom' is available.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "ci: publish the Python SDK to PyPI from main via Trusted Publishing",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-17T07:17:57Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "dbfb298705407fec6bef3db8c33c82cd5ffcacc1",
"body": "Wraps the airom binary and decodes its native JSON — the lossless superset every\nother format projects from — into typed Python objects. Stdlib only: no\nthird-party runtime dependencies, matching the tool's own \"no runtime, no\ndependencies\" posture.\n\n import airom\n inv = airom.fs(\"./my-app\", m\n[…]\nthe test and docs now state the real semantics. 13 tests, ruff and\nmypy --strict clean, and a new CI job covering 3.10/3.13 plus wheel-bundling.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(sdk): add a dependency-free Python SDK (sdk/python)",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-17T07:06:49Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "9af574c573d8e95463b250070b6ad4a52f01c290",
"body": "`mint dev` refuses to run on non-LTS Node (\"not supported on node versions 25+\").\nDocument the symptom and the keg-only `brew install node@24` + PATH-prepend fix,\nwhich leaves an existing non-LTS node untouched.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: note the Mintlify LTS-Node requirement in the docs-site README",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-17T06:48:55Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "538f4f989ffb451d47bde65e82c2028290895776",
"body": "A 19-page Mintlify site under docs-site/ (docs.json + .mdx), separate from the\nengineering reference in docs/ (ARCHITECTURE/mapping/cli/rule-schema), which\nstays plain Markdown and is linked from source comments.\n\nSections: get started (index/quickstart/installation), concepts (aibom/evidence/\nconfi\n[…]\nts in the binary (checked by\nextracting flags from the .mdx and diffing against `airom --help` output);\nbuild/vet/-race/golangci-lint all clean.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: add a Mintlify documentation site (docs-site/)",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-17T06:35:04Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "0fb8a93b2de97f774527f2ebbc1948747da050a3",
"body": "`go install …@latest` resolves against the now-public repo (a pseudo-version\nof the latest commit) even before v0.1.0 is tagged — the old \"unavailable until\npublished\" notes were wrong. Clarify that it builds from source, requires Go,\nand needs $(go env GOPATH)/bin on PATH (the usual \"command not found\" cause).\nAlso rewrite the go.mod header comment that still said \"Trivy for AI\".\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: correct install instructions and drop a go.mod branding straggler",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-17T05:45:15Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "88756646b3a0cf07de5c19189c407b801327074f",
"body": "A local-path gitsource delegates Walk to dirsource's parallel fastwalk, so the\nWalkFunc is invoked from multiple goroutines (the source.Source contract). The\ntest helper appended to a shared slice without synchronization — a latent race\nthat CI's -race job on Linux surfaced (scheduling-dependent; lo\n[…]\nard the append with a mutex, mirroring dirsource_test.go's helper.\n\nVerified with `go test -race -count=20 -cpu=8 ./internal/source/gitsource/`.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "test: fix data race in the gitsource walkPaths helper",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-17T04:08:36Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "c528a5f2694667f1a088786871e1ebb330bf8388",
"body": "Conventional NOTICE for an Apache-licensed project; goreleaser now ships it\nalongside LICENSE in every archive.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: add Apache-2.0 NOTICE file and bundle it in release archives",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-17T04:03:48Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "eba39a20c9ff2c4f093ed0dcd452407fac8afded",
"body": "License: replace MIT with the Apache License 2.0 (explicit patent grant).\nUpdates LICENSE, the README badge/comparison/footer, CONTRIBUTING (inbound =\noutbound, Apache §5), and the ARCHITECTURE header. The \"MIT\" in cdx_test.go is\na scanned-component fixture, not our license, and is left as-is.\n\nBran\n[…]\n. Engineering references to Trivy in ARCHITECTURE.md\n(design rationale) are left intact — they're legitimate technical comparison,\nnot identity.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: relicense to Apache-2.0 and lead with AIBOM-first branding",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-17T03:50:26Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "d097e7e25a1325077dcf254d01a61299ce1548ff",
"body": "A 10-dimension multi-agent adversarial review of the whole tree, with every\nfinding independently verified against a concrete repro. 17 confirmed defects\nfixed, each with a regression test; the full suite stays green under -race,\ngolangci-lint is clean, and generated code is current.\n\nSecurity / cor\n[…]\nencies[] (no substantiated depends-on edges are ever fabricated) and the\ndeferred live registry/daemon/cluster source modes (they fail cleanly).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "review: fix 17 verified defects from the Phase 10 production review",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-17T02:29:34Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "c4e5447ea65ac6edfd22e81a22d9563cabab2a3a",
"body": "Continuous integration (.github/workflows/ci.yml):\n- lint/vet/gofmt gate; golangci-lint via the v7 action (matches the v2\n .golangci.yml, whose depguard rules enforce the §4 import-direction law)\n- race-detector tests on Linux and macOS with a coverage summary\n- CGO_ENABLED=0 cross-compile matrix o\n[…]\nTRIBUTING.md centered\n on the evidence-keyed detector workflow\n- README status ledger updated: Phases 1–8 complete, Phase 9 done, Phase 10 open\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "ci: add release automation, CI, and community health files (Phase 9)",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-16T21:43:35Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "0cf65c2cd9090a28c2ec953e2ae6f7c53e2ff6f6",
"body": "The integration coverage that ties the whole pipeline together, built by\nthree parallel workstreams over disjoint packages.\n\n- internal/e2e: four realistic fixture repos (python-langchain-rag,\n node-openai, go-openai, mixed-monorepo) scanned via app.Scan through\n the whole pipeline into all five f\n[…]\nDATE_GOLDEN honored\nalongside -update); make bench / test-heavy added. 36 packages green\nunder -race; golangci-lint clean; ~74% total coverage.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "tests: add the cross-cutting end-to-end test suite (Phase 8)",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-16T21:32:03Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "82df9789b6e82657da3df556a83e6c97999ee6f6",
"body": "Turn the assembled graph into every output format — each a pure\nprojection of the same Inventory (invariant P5), mapped per\ndocs/mapping.md, deterministic (P7).\n\n- internal/writer: the Writer interface, self-registering registry,\n multi-output Fanout, and the shared §6.2 confidence formatting\n (ro\n[…]\nroot->dependency\ndepends-on edges, so CycloneDX's dependencies[] graph is currently empty\n(the writers correctly project the edges that exist).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "writers: implement the output writers (Phase 7)",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-16T20:42:21Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "a4fe44217c55b15f6bcc448cbecea457f97b653e",
"body": "…se 6)\n\nBreadth phase — the content that makes AIROM detect AI. Built by eight\nparallel workstreams over disjoint packages, then integrated.\n\nBinary model-file parsers (internal/detectors/modelfile, modelfilex),\nheader-only, fuzzed, never load weights:\n- GGUF (arch/param-count/quantization), safeten\n[…]\nama infra, generation params, synthesized\nRAG pipeline). All 27 packages green under -race; golangci-lint clean;\nmodel-file parsers fuzz-clean.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "detectors: implement the detector suite, rule packs, and sources (Pha…",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-16T20:18:53Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "c446e6eea5dd220976f51bd6d3ddba7f41f22e6e",
"body": "The public SDK, dispatcher, rule engine, and assembler — the framework\nthat turns detector claims into the canonical component graph:\n\nPublic SDK (semver-guarded, stdlib-only by depguard):\n- pkg/airom: the full §5 domain model; tri-state fields with a lossless\n JSON contract (Absent omitted / Unkno\n[…]\nnt,\nresolves uses-edges via call-site capture, and refuses ambiguity — with\nzero built-in detectors. 15 packages green under -race; lint clean.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "framework: implement the plugin framework (Phase 5)",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-16T19:19:09Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "6e29fbbf7d613e015351601186c4fe2d4e2189e0",
"body": "The phase-1 pipeline per ARCHITECTURE.md §7-§8, wired so `airom fs .`\n(and `airom scan <dir>`) runs a real scan:\n\n- internal/xio: clamped byte-weighted I/O semaphore (the 40GB-vs-budget\n deadlock is a regression test) and size-classed buffer pools\n- internal/classify: language routing, git-style NU\n[…]\n rules and symlink containment. Every fix has\na regression test.\n\nAll packages green under -race; golangci-lint clean; scans this repo\nin ~6ms.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "scanner: implement the filesystem scanner (Phase 4)",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-16T16:14:17Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "0006bf169540335ed18c26dbf478c0d781a51851",
"body": "Adversarial review (3 lenses, every finding reproduced by running the\nbinary, zero refuted) surfaced real defects; all fixed with regression\ntests:\n\nSafety:\n- clean: the home/root refusal compared unresolved case-exact strings —\n bypassable on case-insensitive APFS (a lowercase typo of $HOME delete\n[…]\nsemantics, clean safety\nnote.\n\nAll tests pass under -race; go vet, gofmt, golangci-lint clean; every\nfix smoke-tested through the built binary.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "cli: fix 30 execution-verified review findings",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-16T14:36:37Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "696f7dc9c9abe0a0ae5f75db5c27fb09fcffdf16",
"body": "…act (Phase 3)\n\nImplements the frozen surface in docs/cli.md:\n- Commands: scan (scheme auto-detect with dir:/repo:/image: forcing),\n fs, repo, image (--input/--platform), k8s (--namespace/-A/--manifests/\n --parallel-images), clean (with home/root safety refusals), version\n- Configuration: flags > \n[…]\n lands (TODO(phase-4) in internal/app/run.go).\n\nDocs: cli.md marked implemented with the final --fail-on grammar;\nREADME status ledger updated.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "cli: implement the command tree, config layering, and exit-code contr…",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-16T14:00:56Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "2680b7ceb440fd69fa648cf5cf53386acdbd0a80",
"body": "Lay down the full skeleton per docs/ARCHITECTURE.md §4:\n- go.mod (github.com/Roro1727/airom, go 1.25), MIT LICENSE, .gitignore,\n .editorconfig, CODEOWNERS\n- Makefile with ldflags version stamping and self-documenting targets\n- golangci-lint v2 config encoding the import-direction law as depguard\n \n[…]\nound-trip test\n- rules/, schemas/, testdata/fixtures/ layout with policy READMEs\n\ngo build ./..., go vet ./..., gofmt -l all clean on go1.26.5.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "scaffold: create repository structure (Phase 2)",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-16T13:00:45Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "ba819234a9ba02002f6ff62f4c1dc83196d5d8c1",
"body": "Canonical architecture for AIROM, an evidence-first AIBOM scanner:\n- Eight enforceable invariants (read-once, bounded memory, determinism,\n pure-Go CGO_ENABLED=0, degradable-by-default, claims-not-components)\n- Canonical component graph designed as a superset of CycloneDX 1.6\n ML-BOM, SPDX 3.0.1 A\n[…]\n/semgrep),\nspec verification against published schemas, and a three-design\nadversarial review across contributor/operations/correctness lenses.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: add v1 architecture baseline (Phase 1)",
"author_name": "Roro1727",
"author_login": "Roro1727",
"committed_at": "2026-07-16T12:58:33Z",
"body_truncated": true,
"is_coding_agent": true
}
],
"releases_count": 2,
"commits_last_year": 45,
"latest_release_at": "2026-07-21T06:48:02Z",
"latest_release_tag": "v0.1.3",
"releases_from_tags": false,
"days_since_last_push": 0,
"active_weeks_last_year": 1,
"days_since_latest_release": 0,
"mean_days_between_releases": 3.7
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": true,
"health_percentage": 87,
"has_issue_template": false,
"has_code_of_conduct": true,
"has_pull_request_template": true
},
"ecosystem": {
"packages": [
{
"name": "github.com/airomhq/airom",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "go",
"matches_repo": true,
"registry_url": "https://pkg.go.dev/github.com/airomhq/airom",
"is_deprecated": false,
"latest_version": "v0.1.3",
"repository_url": "https://github.com/airomhq/airom",
"versions_count": 2,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-07-21T06:40:52Z",
"latest_version_yanked": null,
"days_since_latest_publish": 0
}
]
},
"popularity": {
"forks": 1,
"stars": 8,
"watchers": 0,
"fork_history": {
"days": [
{
"date": "2026-07-19",
"count": 1
}
],
"complete": true,
"collected": 1,
"total_forks": 1
},
"star_history": {
"days": [
{
"date": "2026-07-17",
"count": 1
},
{
"date": "2026-07-21",
"count": 7
}
],
"complete": true,
"collected": 8,
"total_stars": 8
},
"open_issues_and_prs": 1
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": true,
"has_mcp_signal": false,
"bootstrap_files": [
"Makefile"
],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [
"sdk/python/src/airom/py.typed"
],
"toolchain_manifests": [
"go.mod",
"internal/detectors/manifest/testdata/cargo/Cargo.toml",
"internal/detectors/manifest/testdata/gomod/go.mod",
"internal/detectors/manifest/testdata/gradle/build.gradle",
"internal/detectors/manifest/testdata/gradle/build.gradle.kts",
"internal/detectors/manifest/testdata/maven/pom.xml",
"internal/detectors/manifest/testdata/nuget/sample.csproj",
"internal/e2e/testdata/fixtures/go-openai/go.mod"
],
"largest_source_bytes": 35839,
"source_files_sampled": 286,
"oversized_source_files": 0,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"go.mod"
],
"advisories": {
"error": null,
"scope": null,
"source": null,
"findings": [],
"collected": false,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 0,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"go"
],
"dependencies": [
{
"name": "github.com/CycloneDX/cyclonedx-go",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.11.0"
},
{
"name": "github.com/bmatcuk/doublestar/v4",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v4.10.0"
},
{
"name": "github.com/charlievieth/fastwalk",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.0.14"
},
{
"name": "github.com/cloudflare/ahocorasick",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.0.0-20240916140611-054963ec9396"
},
{
"name": "github.com/go-git/go-git/v5",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v5.19.1"
},
{
"name": "github.com/knadh/koanf/parsers/yaml",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.1.0"
},
{
"name": "github.com/knadh/koanf/providers/file",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.2.1"
},
{
"name": "github.com/knadh/koanf/providers/posflag",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.0.1"
},
{
"name": "github.com/knadh/koanf/v2",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v2.3.5"
},
{
"name": "github.com/spf13/cobra",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.10.2"
},
{
"name": "github.com/spf13/pflag",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.0.10"
},
{
"name": "github.com/zeebo/xxh3",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.1.0"
},
{
"name": "golang.org/x/mod",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.38.0"
},
{
"name": "golang.org/x/sync",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.22.0"
},
{
"name": "golang.org/x/tools",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.48.0"
},
{
"name": "gopkg.in/yaml.v3",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v3.0.1"
}
],
"all_dependencies": {
"error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"source": null,
"packages": [],
"collected": false,
"truncated": false,
"total_count": null,
"direct_count": null,
"indirect_count": null
}
},
"maintainership": {
"issues": {
"open_prs": 1,
"merged_prs": 0,
"open_issues": 0,
"closed_ratio": null,
"closed_issues": 0,
"closed_unmerged_prs": 3
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "Roro1727",
"commits": 50,
"avatar_url": "https://avatars.githubusercontent.com/u/85880033?v=4"
}
],
"contributors_sampled": 1,
"top_contributor_share": 1
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"ci.yml",
"codeql.yml",
"release-pypi.yml",
"release.yml"
],
"has_docs_dir": true,
"linter_configs": [
".golangci.yml"
],
"has_editorconfig": true,
"has_linter_config": true,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"go.sum"
],
"scorecard": null,
"has_codeql_workflow": true,
"has_security_policy": true,
"has_dependabot_config": true
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-21T07:25:59Z",
"oldest_open_prs": [
{
"number": 3,
"created_at": "2026-07-17T07:33:59Z",
"last_comment_at": "2026-07-17T07:34:00Z",
"last_comment_author": "dependabot"
}
],
"last_merged_pr_at": null,
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": []
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/airomhq/airom",
"host": "github.com",
"name": "airom",
"owner": "airomhq"
},
"metrics": {
"overall": {
"key": "overall",
"band": "moderate",
"name": "Overall health",
"note": null,
"notes": [],
"value": 66,
"inputs": {
"security": 100,
"vitality": 74,
"community": 50,
"governance": 30,
"engineering": 87
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 74,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "moderate",
"name": "Development activity",
"note": null,
"notes": [],
"value": 57,
"inputs": {
"commits_last_year": 45,
"human_commit_share": 1,
"days_since_last_push": 0,
"active_weeks_last_year": 1
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 0 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 0
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "1/52 weeks with commits",
"points": 0.7,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 1
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "45 commits in the last year",
"points": 14.9,
"status": "partial",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 45
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "OpenSSF Scorecard unavailable",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"releases_count": 2,
"latest_release_tag": "v0.1.3",
"releases_from_tags": false,
"days_since_latest_release": 0,
"mean_days_between_releases": 3.7
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "2 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 2
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 0 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 0
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~3.7 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 3.7
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "OpenSSF Scorecard unavailable",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "unverified",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": "repository_too_young",
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": null,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "maintenance record not established from the collected data",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_unverified",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "moderate",
"name": "Community & Adoption",
"value": 50,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 14,
"inputs": {
"forks": 1,
"stars": 8,
"watchers": 0,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "below_threshold"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "8 stars",
"points": 13.7,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 8
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "1 forks",
"points": 0,
"status": "missed",
"details": [
{
"code": "forks",
"params": {
"count": 1
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "0 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 0
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "excellent",
"name": "Community health",
"note": null,
"notes": [],
"value": 92,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": true,
"has_issue_template": false,
"has_code_of_conduct": true,
"has_pull_request_template": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (Apache-2.0)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "Apache-2.0"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 18,
"status": "met",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 13.5,
"status": "met",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 6.3,
"status": "met",
"details": [],
"max_points": 6.3
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "at_risk",
"name": "Sustainability & Governance",
"value": 30,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 12,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 1,
"top_contributor_share": 1
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 100% of commits",
"points": 0,
"status": "missed",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 100
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "1 contributors",
"points": 1.4,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 1
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "OpenSSF Scorecard unavailable",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "critical",
"name": "Issue & PR responsiveness",
"note": "Excluded from scoring (no data or not applicable): Issue resolution. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"issue_resolution"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 1,
"inputs": {
"merged_prs": 0,
"open_issues": 0,
"closed_issues": 0,
"issue_closed_ratio": null,
"closed_unmerged_prs": 3
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "no issues or no data",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_issues_or_data",
"params": {}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "0/3 decided PRs merged",
"points": 0,
"status": "missed",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 0,
"decided": 3
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "OpenSSF Scorecard unavailable",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "at_risk",
"name": "Ownership & stewardship",
"note": null,
"notes": [],
"value": 32,
"inputs": {
"followers": 0,
"owner_type": "Organization",
"is_verified": null,
"owner_login": "airomhq",
"public_repos": 1,
"account_age_days": 4
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "organization-owned",
"points": 30,
"status": "met",
"details": [
{
"code": "owner_organization",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "0 followers of airomhq",
"points": 0,
"status": "missed",
"details": [
{
"code": "owner_followers",
"params": {
"count": 0,
"login": "airomhq"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "1 public repos, account ~0 yr old",
"points": 2.2,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 1
}
},
{
"code": "account_age_years",
"params": {
"years": 0
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 92,
"inputs": {
"packages": [
"github.com/airomhq/airom"
],
"ecosystems": "go",
"any_deprecated": false,
"min_days_since_publish": 0
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on go",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "go"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 0 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 0
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "2 published versions",
"points": 12,
"status": "partial",
"details": [
{
"code": "published_versions",
"params": {
"count": 2
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "excellent",
"name": "Engineering Quality",
"value": 87,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "excellent",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 88,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": true,
"has_linter_config": true,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "4 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 4
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": ".golangci.yml",
"points": 16,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": ".golangci.yml"
}
}
],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 6.4,
"status": "met",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "OpenSSF Scorecard unavailable",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "excellent",
"name": "Documentation",
"note": null,
"notes": [],
"value": 85,
"inputs": {
"topics": [
"ai-governance",
"ai-security",
"aibom",
"cyclonedx",
"golang",
"mlops",
"sarif",
"sbom",
"supply-chain-security",
"ai-bill-of-materials",
"compliance",
"devsecops",
"eu-ai-act",
"llm-security",
"ml-security",
"mlsecops",
"model-scanning",
"nist-ai-rmf",
"owasp",
"vulnerability-scanner"
],
"has_wiki": true,
"homepage": null,
"has_readme": true,
"has_docs_dir": true,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 25,
"status": "met",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": "20 topics",
"points": 10,
"status": "met",
"details": [
{
"code": "topics_count",
"params": {
"count": 20
}
}
],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "excellent",
"name": "Security",
"value": 100,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "excellent",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Dependency lockfiles. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"dependency_lockfiles"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 100,
"inputs": {
"source": "file_signals",
"lockfiles": [
"go.sum"
],
"manifests": [
"go.mod"
],
"has_codeql_workflow": true,
"has_security_policy": true,
"has_dependabot_config": true
},
"components": [
{
"key": "security_policy_security_md",
"name": "Security policy (SECURITY.md)",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "dependabot_config",
"name": "Dependabot config",
"detail": null,
"points": 25,
"status": "met",
"details": [],
"max_points": 25
},
{
"key": "dependency_lockfiles",
"name": "Dependency lockfiles",
"detail": "published library — lockfiles are an application concern, not expected",
"points": 0,
"status": "excluded",
"details": [
{
"code": "lockfiles_not_expected",
"params": {}
}
],
"max_points": 25
},
{
"key": "codeql_workflow",
"name": "CodeQL workflow",
"detail": null,
"points": 20,
"status": "met",
"details": [],
"max_points": 20
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "good",
"name": "AI Readiness",
"value": 77,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.98,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "49 of 50 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 49,
"sampled": 50
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "excellent",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 97,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"go.sum"
],
"has_dockerfile": true,
"typed_language": true,
"bootstrap_files": [
"Makefile"
],
"has_devcontainer": false,
"has_linter_config": true,
"typecheck_configs": [
"sdk/python/src/airom/py.typed"
],
"agent_commit_share": 0.98,
"toolchain_manifests": [
"go.mod",
"internal/detectors/manifest/testdata/cargo/Cargo.toml",
"internal/detectors/manifest/testdata/gomod/go.mod",
"internal/detectors/manifest/testdata/gradle/build.gradle",
"internal/detectors/manifest/testdata/gradle/build.gradle.kts",
"internal/detectors/manifest/testdata/maven/pom.xml",
"internal/detectors/manifest/testdata/nuget/sample.csproj",
"internal/e2e/testdata/fixtures/go-openai/go.mod"
],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "Makefile",
"points": 18,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Makefile"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": ".golangci.yml",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": ".golangci.yml"
}
}
],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "sdk/python/src/airom/py.typed",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "sdk/python/src/airom/py.typed"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "Dockerfile, lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Dockerfile, lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "49 of the last 50 commits agent-authored or agent-credited",
"points": 10,
"status": "met",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 49,
"sampled": 50
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "dependency automation configured, none observed in the sampled commits",
"points": 5,
"status": "partial",
"details": [
{
"code": "dependency_bot_config_only",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "OpenSSF Scorecard unavailable",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "Go",
"largest_source_bytes": 35839,
"source_files_sampled": 286,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Go (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/286 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 286,
"oversized": 0
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"OpenSSF Scorecard did not return a usable result (2026/07/21 23:22:09 Warning: PATs stored in env variables GITHUB_AUTH_TOKEN and GITHUB_TOKEN differ. Scorecard will use the former.); skipping Scorecard checks"
],
"report_type": "repository",
"generated_at": "2026-07-21T23:22:52.484637Z",
"schema_version": "0.26.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/a/airomhq/airom.svg",
"full_name": "airomhq/airom",
"license_state": "standard",
"license_spdx": "Apache-2.0"
}
Verwandte Einträge
Geprüfte Repositories, die Katalog-Tags oder Ökosysteme mit airomhq/airom teilen. Nebeneinander lesen →
Bewertungen sind Signale, keine Garantien. Sie spiegeln öffentlich sichtbare Praxis auf GitHub wider — kein Code-Audit und keine Sicherheitsgarantie.
Fehlende Daten werden ausgeschlossen und die Gewichte neu normiert, nie als null bewertet. Die Methodik ist versioniert und offen: Metriken v1.13.0, Schema v0.26.0 — vollständige Methodik · Metriken-Wiki.
