go-kruda / kruda

Der aufgelöste Abhängigkeitssatz konnte für diesen Bericht nicht erhoben werden: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository

{
  "data": {
    "repo": {
      "topics": [
        "epoll",
        "generics",
        "go",
        "golang",
        "high-performance",
        "http",
        "microservice",
        "rest-api",
        "type-safe",
        "web-framework"
      ],
      "is_fork": false,
      "size_kb": 31230,
      "has_wiki": false,
      "homepage": "https://pkg.go.dev/github.com/go-kruda/kruda",
      "languages": {
        "Go": 2079278,
        "Rust": 9687,
        "Shell": 112207,
        "Makefile": 554,
        "Go Template": 9925
      },
      "pushed_at": "2026-07-18T23:37:44Z",
      "created_at": "2026-02-22T17:48:04Z",
      "owner_type": "Organization",
      "updated_at": "2026-07-18T23:34:15Z",
      "description": "High-performance, type-safe Go web framework with custom async I/O transport — faster than Fiber and Actix on every benchmark route",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "MIT",
      "default_branch": "main",
      "license_spdx_raw": "MIT",
      "primary_language": "Go",
      "significant_languages": [
        "Go"
      ]
    },
    "owner": {
      "blog": null,
      "name": null,
      "type": "Organization",
      "login": "go-kruda",
      "company": null,
      "location": null,
      "followers": 1,
      "avatar_url": "https://avatars.githubusercontent.com/u/263207365?v=4",
      "created_at": "2026-02-22T17:46:26Z",
      "is_verified": null,
      "public_repos": 2,
      "account_age_days": 151
    },
    "license": {
      "state": "standard",
      "spdx_id": "MIT",
      "raw_spdx": "MIT",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v1.6.2",
          "kind": "patch",
          "published_at": "2026-07-18T19:31:29Z"
        },
        {
          "tag": "v1.6.1",
          "kind": "patch",
          "published_at": "2026-07-18T10:09:32Z"
        },
        {
          "tag": "v1.6.0",
          "kind": "minor",
          "published_at": "2026-07-04T07:37:59Z"
        },
        {
          "tag": "v1.5.0",
          "kind": "minor",
          "published_at": "2026-06-28T17:16:42Z"
        },
        {
          "tag": "v1.4.0",
          "kind": "minor",
          "published_at": "2026-06-27T14:05:42Z"
        },
        {
          "tag": "v1.3.1",
          "kind": "patch",
          "published_at": "2026-06-13T17:25:38Z"
        },
        {
          "tag": "v1.3.0",
          "kind": "minor",
          "published_at": "2026-06-12T18:45:39Z"
        },
        {
          "tag": "v1.2.5",
          "kind": "patch",
          "published_at": "2026-06-06T14:59:45Z"
        },
        {
          "tag": "v1.2.4",
          "kind": "patch",
          "published_at": "2026-05-27T18:47:43Z"
        },
        {
          "tag": "v1.2.3",
          "kind": "patch",
          "published_at": "2026-05-23T04:54:37Z"
        },
        {
          "tag": "v1.2.0",
          "kind": "minor",
          "published_at": "2026-04-19T16:25:46Z"
        },
        {
          "tag": "v1.1.3",
          "kind": "patch",
          "published_at": "2026-04-16T03:29:11Z"
        },
        {
          "tag": "v1.0.5",
          "kind": "patch",
          "published_at": "2026-04-06T06:16:34Z"
        },
        {
          "tag": "v1.0.4",
          "kind": "patch",
          "published_at": "2026-03-29T06:44:42Z"
        },
        {
          "tag": "v1.0.3",
          "kind": "patch",
          "published_at": "2026-03-28T03:28:38Z"
        },
        {
          "tag": "v1.0.0",
          "kind": "major",
          "published_at": "2026-03-08T17:48:44Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "2d6eeac97aee3a837a73eef3c422dff77cc7ae48",
          "body": null,
          "is_bot": false,
          "headline": "docs: remove stale Wing setup guidance (#180)",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-07-18T23:34:11Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0b6663e0224443a3fcebafd060396c431dbd4a8f",
          "body": null,
          "is_bot": false,
          "headline": "fix: honor Wing HTTP persistence semantics (#179)",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-07-18T22:53:34Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "911150134ee10fd43cc599268a995d08f6f6cfa9",
          "body": null,
          "is_bot": false,
          "headline": "fix: complete Wing 100-continue requests (#178)",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-07-18T22:18:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1ce298255460b37e5bc56bcf7c5b3f7e5648686e",
          "body": null,
          "is_bot": false,
          "headline": "test: wait for Wing HTTP readiness (#177)",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-07-18T21:37:36Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e8219cd1d496e4cff18cd562e814480e327bd9be",
          "body": null,
          "is_bot": false,
          "headline": "fix: validate Wing Host before dispatch (#176)",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-07-18T21:06:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e6cd66a0b293030347e0c9a897b911cb28b30891",
          "body": "Keep dependency-container services alive while transports stop accepting and drain work, then run container cleanup and shutdown hooks in the established order.",
          "is_bot": false,
          "headline": "fix: drain transport before container shutdown (#175)",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-07-18T19:58:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a3c96a7d23fcd32bf2292e2c5ddedf4487492357",
          "body": "Document the static root containment fix and the post-v1.6.1 documentation corrections, including the contrib/ws v1.3.2 publication scope.",
          "is_bot": false,
          "headline": "docs: prepare v1.6.2 release notes (#174)",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-07-18T19:22:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4f7bff4eb7da629d8a280ab365f36acd573c6ee4",
          "body": "Keep release ancestry checks on full history and scan the root, CLI, and every tracked contrib module against their own module graphs.",
          "is_bot": false,
          "headline": "ci: harden release preflight and security scan (#173)",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-07-18T18:47:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9cb4041d28f3a78ecfe4a055cf17e05986785bf8",
          "body": "Use a rooted filesystem for App.Static, preserve in-root symlinks and sendfile support, and cover file, directory, index, and SPA symlink escapes.",
          "is_bot": false,
          "headline": "fix: confine static files to configured root (#172)",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-07-18T18:22:05Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2a7375bba2ee6fdb19b0d67a6d6ecfa28030e032",
          "body": "Use GitHub-generated release notes and align public documentation with the current release, transport, WebSocket, JSON engine, and typed-handler behavior.",
          "is_bot": false,
          "headline": "ci: simplify release notes and refresh docs (#171)",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-07-18T11:52:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cfe67eb8fbfec5bf7f3fae0d1357dbbace6c227a",
          "body": "* chore: prepare v1.6.1 release\n\n* ci: gate release preparation commits",
          "is_bot": false,
          "headline": "Prepare v1.6.1 release (#170)",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-07-18T09:59:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "74192d8834c0c3356409569f8b6b8ac7c81bb307",
          "body": "* fix: harden correctness gates\n\n* fix(examples): sync websocket core version",
          "is_bot": false,
          "headline": "Harden correctness and protocol gates (#169)",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-07-18T09:26:18Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b00bc91912848460cbab2e18ef471ec08cfa1b57",
          "body": "Add the cookieless Cloudflare Web Analytics beacon to the VitePress\nhead so it loads on every page. Manual snippet installation is used\nbecause kruda.dev is DNS-only (not proxied through Cloudflare), so the\nbeacon cannot be auto-injected. The token is a public site identifier\nembedded in every page's HTML, not a secret.",
          "is_bot": false,
          "headline": "docs: add Cloudflare Web Analytics beacon to docs site (#168)",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-07-15T10:14:37Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "21ba9f6884a11d56da69feb8d1df67d78ee54a56",
          "body": "Switch the VitePress site from the go-kruda.github.io/kruda/ project\npath to the root of kruda.dev: base path to '/', hardcoded favicon and\nog:image URLs updated, and a CNAME file in docs/public so GitHub Pages\nserves the custom domain on every Actions-based deploy regardless of\nrepo Settings state. Update README documentation links to the new\ndomain and add a direct link to the full guide site, which previously\nhad no entry point from the GitHub repo page.",
          "is_bot": false,
          "headline": "docs: migrate documentation site to custom domain kruda.dev (#167)",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-07-15T09:41:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "be88f7a0257b5dff0200a34b14b6a5b8d2958ae4",
          "body": "The kruda mcp server's docs and preset suggestions predated the\nkruda.Stream (v1.5.0) and kruda.Hijack (v1.6.0) presets, so an AI\nassistant using the server was told SSE/streaming has no Wing preset\nand got no WebSocket guidance at all.\n\n- kruda_docs: add a websocket topic (ws.HandleFunc + Conn API)\n[…]\ntes instead of \"none\".\n- ai-integration.md: list the doc topics (surfacing real-time coverage);\n  fix stale example count (22 -> 23).\n- Tests updated/added to lock the streaming/WebSocket suggestions.",
          "is_bot": false,
          "headline": "docs(mcp): update AI-facing docs for streaming/WebSocket on Wing (#166)",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-07-04T16:07:14Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7a7092eb97f10826f92152d508071cba613a6c84",
          "body": "App.Serve's doc comment promised systemd socket activation\nunconditionally, but Wing (the default transport on Linux) closes the\npassed listener and re-binds one SO_REUSEPORT socket per worker, so it\ncannot serve an inherited fd. Clarify that net/http and fasthttp serve\nthe supplied fd directly and point fd-passing users to kruda.NetHTTP().\nAdd a matching bullet to the Wing-limitations list in the transport guide.",
          "is_bot": false,
          "headline": "docs: correct App.Serve socket-activation claim for Wing (#165)",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-07-04T15:30:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "caa59abac4b0aacbd91f156b0aabb3e6b1b57c4b",
          "body": "…rning\n\nDocs-honesty bundle: a Wing protocol-support matrix page, production-TLS deployment guidance (terminate in front of Wing; direct WithTLS falls back to net/http), a one-time warning when Use() is called after routes, and removal of the stale transport/wing require. Also fixes a flaky WS-over-Wing test harness (returned an address before the server was accepting) and corrects the stale 'Wing doesn't support SSE' doc. Ships in the next release.",
          "is_bot": false,
          "headline": "docs: Wing protocol matrix, production TLS, and Use()-after-routes wa…",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-07-04T14:07:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d3a4aec65c25780919c13782d82ae494473ae6c7",
          "body": null,
          "is_bot": false,
          "headline": "chore(release): contrib/ws requires core v1.6.0, drop dev replace",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-07-04T10:12:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d6eea3ddff3464ea7f87135c1f776727633f444c",
          "body": null,
          "is_bot": false,
          "headline": "chore(release): date-stamp v1.6.0 changelog (2026-07-04)",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-07-04T07:36:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8b40774ac7d808d597fc5cb5ecef3b06b8c5744a",
          "body": "contrib/ws now works on Wing (the default on Linux), previously net/http-only. Register with ws.HandleFunc(app, \"/ws\", handler) — identical on every transport. Wing hands the taken-over connection to contrib/ws via the standard http.Hijacker contract (a new generic kruda.Hijack route preset); the RF\n[…]\nre rejected packet-independently, and Wing now retains the Connection header so the handshake works. Adds App.Serve(ln net.Listener). Reviewed per-task + whole-branch + four codex rounds (final SHIP).",
          "is_bot": false,
          "headline": "feat(wing): WebSocket support on the Wing transport",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-07-04T07:34:26Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "79e08b58af6fbffcd85ebd9f07e940edcd41cfce",
          "body": "Reject undefined/reserved opcodes, fragmented control frames, and control frames whose declared payload exceeds 125 bytes (closing an unbounded-allocation DoS reachable before the payload buffer was sized), reject non-minimal length encodings, and reject unmasked client frames in ReadMessage (RFC 6455 §5.1). All superset checks — valid frames still pass. Latent while WebSocket ran only on net/http; fixed as WebSocket extends to the Wing transport.",
          "is_bot": false,
          "headline": "fix(ws): harden WebSocket frame parser (RFC 6455 §5)",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-07-04T07:03:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "bca09be131e361c83cb2a54b815484bcd51128c2",
          "body": "Differential fuzzer (Wing parser vs net/http) found and fixed real request-smuggling-class bugs: obs-fold on any header line, whitespace before header colons, duplicate Host headers, a method-interning hash collision, malformed HTTP-version/method/CR handling. Fuzzer wired into pre-release.sh. Adds \n[…]\n shutdown-drain regression gate for SSE streams and a reusable soak-test harness (goroutine/RSS stability under load). No API changes; all fixes verified against real net/http behavior before landing.",
          "is_bot": false,
          "headline": "fix(wing): anti-smuggling parser hardening + shutdown/soak quality gates",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-07-03T16:30:54Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "473f98a0859f3184173b84a55806a69e23e28953",
          "body": "…govulncheck CI\n\nWing's HTTP parser silently dropped request headers past the 8th (a fixed [8] inline array); c.Header() returned \"\" for the 9th+. Requests carrying more than 8 non-fast-path headers now spill into a heap slice, so no header is ever dropped. The inline fast path stays at 8 so the pooled request struct keeps its footprint (benchmark-neutral). Adds WingHeaderSpills() for observability and a weekly govulncheck CI across all released modules.",
          "is_bot": false,
          "headline": "fix(wing): retain all request headers (spill past inline capacity) + …",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-07-03T13:00:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e8a077bd138d0a1cc7bc7cfb69e64b40b5fe75a9",
          "body": "Stamp the [1.5.0] heading with its release date so the tagged commit carries the dated changelog.",
          "is_bot": false,
          "headline": "chore(release): date-stamp v1.5.0 changelog (2026-06-29)",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-28T17:06:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cbc89f2d8f68a8db35dbabf46d56d6268b4cd3c4",
          "body": "Add WithHeaderLimit(n) and env vars (HEADER_LIMIT, TRUST_PROXY, MAX_CONNS, MAX_CONNS_PER_IP, ACCEPT_RATE_*) so K8s/ConfigMap deployments can tune the v1.4.0 safety bundle.",
          "is_bot": false,
          "headline": "feat(config): WithHeaderLimit + env tuning for the Wing safety bundle",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-28T05:54:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f126be28ecc4fc93f5a709cd4b608fe87bf5a87d",
          "body": "…ixes\n\ngo1.25.10 and go1.26.0-1.26.3 carry GO-2026-5037 (crypto/x509) and GO-2026-5039 (net/textproto); raise the floor repo-wide (core, CLI, contrib, examples, scaffold templates, docs, CI) to 1.25.11 / 1.26.4.",
          "is_bot": false,
          "headline": "chore(release): raise minimum Go to 1.25.11 / 1.26.4 for stdlib CVE f…",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-28T05:54:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5c51a5931f7fe950fe52ce22c07bf148041c0f66",
          "body": "Add FuzzParseHTTPRequest to the pre-release fuzz suite — the internet-facing request parser only replayed its seed corpus before.",
          "is_bot": false,
          "headline": "chore(ci): fuzz the Wing HTTP parser in pre-release",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-28T05:54:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ffc27e44bda27a42375849b94abe9ada7c8abb93",
          "body": "fasthttp WebSocket is not implemented in v1; the package doc and Wing error message wrongly suggested it. Point callers to net/http.",
          "is_bot": false,
          "headline": "docs(ws): correct false fasthttp WebSocket support claim",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-28T05:54:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e17356a890ae7a60a91772e68e4f1d2e0a3460d5",
          "body": "Makes c.SSE() and c.Stream() work on Wing (default on Linux) via the kruda.Stream route preset — previously they errored unless the route ran on net/http. A dedicated wingStreamWriter streams chunks to the takeover *os.File (hot path untouched); client disconnect cancels the handler context; a stuck\n[…]\nts an actionable error; TestClient.SSE() helper added. Reviewed per-task + whole-branch (opus) + codex (caught and fixed a header-flush bug); Linux/epoll -race validated on tiger; alloc guards stay 0.",
          "is_bot": false,
          "headline": "feat(wing): SSE and incremental streaming on the Wing transport",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-28T05:41:54Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b6228ca0f8665b9cf2dae64487f964b41e5e3eab",
          "body": "WithHTTP3 and Config.HTTP3 advertised HTTP/3 (QUIC) serving but were never implemented — nothing read config.HTTP3, so a caller got the net/http fallback (HTTP/1.1 + HTTP/2), not QUIC. HTTP/3 is not on the roadmap, so the dead, misleading API is removed (breaking, ADR 0001; effectively zero adopters). TLS is unaffected — WithTLS is unchanged. Removes the field, the option, its godoc cross-reference, the option test, and the config API-reference section.",
          "is_bot": false,
          "headline": "remove no-op WithHTTP3 option and HTTP3 config field",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-27T18:08:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "de50e3d8b7fddcbdd21639cbe088b36f39aa8937",
          "body": "Core v1.4.0 is published, so contrib/observability resolves kruda@v1.4.0 from the proxy. Remove the development-only replace and populate go.sum so the module is self-contained and publishable as contrib/observability/v1.0.0.",
          "is_bot": false,
          "headline": "chore(release): drop local replace from contrib/observability",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-27T14:19:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8d7ab9374e96a39e1dad3f85719f5edcea805f37",
          "body": "Fix stale contrib/otel public docs: README listed ServiceName/SpanNameFormatter/ExtraAttributes but the exported Config fields are ServerName/SpanNameFunc/Attributes; and the New() doc comment falsely claimed it injects trace context into response headers, which the middleware deliberately does not. Docs/comment-only.",
          "is_bot": false,
          "headline": "docs(otel): correct stale config field names and response-header claim",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-27T14:19:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2b6c917a3d1ab6cd3033a27fd7a1f8cdac9dcc02",
          "body": "Pre-tag review caught release-record accuracy issues; this fixes them. Add contrib/observability to the user-facing contrib listings (count 10->11 across README, docs/guide/contrib.md, docs/index.md); scope the README benchmark revalidation to what the evidence supports (reversed-order confirmation \n[…]\ne p99 values are sub-millisecond) and back it with absolute numbers in the evidence file; clarify the MaxConnsPerWorker migration as a per-worker -> server-wide-total semantics change. No .go changes.",
          "is_bot": false,
          "headline": "docs: fix v1.4.0 release-record gaps found in review",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-27T14:01:08Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c51586ec679721a3073846860f15c4eba3d6335c",
          "body": "Stamp the CHANGELOG [1.4.0] heading with its release date, mirroring the dated [1.3.1]/[1.3.0] headings, so the tagged commit carries the dated changelog.",
          "is_bot": false,
          "headline": "chore(release): date-stamp v1.4.0 changelog (2026-06-27)",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-27T12:54:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "fb5e3244481a867c06c0cdb98c495ae4a7332078",
          "body": "Finishing docs for the v1.4.0 release (per the readiness panel): complete the CHANGELOG [1.4.0] record (accept-DoS + observability + resource Added; Logger/prometheus/body-budget Fixed; a Breaking section for the MaxConnsPerWorker removal with migration + ADR 0001), fix the transport/wing v1.2.0->v1.1.3 reference and stale example/contrib/CLI counts, and revalidate the README performance claims at HEAD (12d6a80) with a consolidated v1.3.1->HEAD tiger A/B showing no regression. No .go changes.",
          "is_bot": false,
          "headline": "docs: complete v1.4.0 changelog, fix doc refs, revalidate perf at HEAD",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-27T12:43:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "12d6a8006a7e755206b4d2c03aab92d837a80b0e",
          "body": "The per-IP accept-DoS limiter keys on ev.PeerIP (the kernel accept-time socket peer) by design. Document that it must never be repointed at RemoteAddr()/X-Forwarded-For: that value is attacker-spoofable when TrustProxy is on, so trusting it for per-IP admission would let a single client evade the cap. Comment-only; no behavioral change.",
          "is_bot": false,
          "headline": "docs(wing): note per-IP cap must key on socket peer, not XFF",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-27T08:22:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ddc48b092cd9228cefda6aba1f33b32495f67bc0",
          "body": "* feat(openapi): resource operation metadata + generic component-name sanitizer\n\nAdd resourceOp to routeInfo so kruda.Resource auto-CRUD routes can render\nexplicit OpenAPI operations (list/get/create/update/delete) with correct\n200/201/204 status codes, page/limit query params, request body, a 422 o\n[…]\ndirect callers. The resource path is opt-in and off the\nframework hot path; this only removes avoidable per-request work.\n\nAdd regression tests: out-of-range id -> 400, and gate/parser kind agreement.",
          "is_bot": false,
          "headline": "feat(resource): input validation + OpenAPI 3.1 for auto-CRUD",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-21T14:48:33Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2e67c2053b8d4b5273d4fae65e14c6871183fc67",
          "body": "requestsInFlight.Dec() ran after c.Next(), so a panicking handler (recovered\nat the serve level, above this middleware) skipped the decrement and leaked\nthe gauge by 1 per panic. Defer it right after Inc(). Regression test drives a\npanicking handler with prometheus as the only middleware and asserts the gauge\nreturns to 0.",
          "is_bot": false,
          "headline": "fix(prometheus): defer in-flight gauge Dec so a panic can't leak it",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-21T14:40:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1b282e42788e72d0b9e1b5c442050ee8efd6130b",
          "body": "The built-in Logger read c.Latency() but never called c.MarkStart(), which\nhad zero callers in production, so every request logged latency=0s. MarkStart\nis opt-in (the Logger is its intended caller) to avoid the time.Now() cost when\nunused; the call was simply missing. Add it after the skip check so skipped\npaths still pay nothing. Regression test asserts a 2ms handler logs latency>=1ms.",
          "is_bot": false,
          "headline": "fix(middleware): Logger records real latency (was always 0)",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-21T14:39:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2ba7676626c5be625c5d33dece03069cc15a56ca",
          "body": "Adds accept-time connection limits to the Wing transport: a global total cap (CAS reserve; default derived from RLIMIT_NOFILE), plus opt-in per-IP limit and accept-rate token bucket — all enforced on the accept path only, closing over-limit connections with a TCP RST (never an HTTP status). Peer IP \n[…]\nping chokepoint does the accounting. Removes the now-dead WingConfig.MaxConnsPerWorker field (breaking, ADR 0001). Validated on Linux/epoll under -race and a paired tiger A/B (no hot-path regression).",
          "is_bot": false,
          "headline": "feat(wing): accept-side DoS limits — connection cap, per-IP, accept-rate",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-21T08:24:24Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8b02738b84776e1c4f3e2cccecc0dce08cf8ce8b",
          "body": "… traceparent inject (D3)\n\nD3 observability enabled-path A/B harness (obs-ab.sh, bench wiring, evidence) plus a quantified HPA/cost note in the contrib/observability README. Also removes the dead response-side traceparent injection from contrib/observability and contrib/otel — it ran after c.Next(), by which point the response is already committed, so it never reached the wire — with regression guards added in both packages.",
          "is_bot": false,
          "headline": "test(bench): obs enabled-path A/B + HPA note; drop dead response-side…",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-21T06:35:11Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f1243093c2707b16171885cea389ce105d28336f",
          "body": "- Mark the conn takenOver at Takeover dispatch.\n- The doneCh drain and a new post-drain sweep close each Takeover *os.File so\n  the fd is released during shutdown instead of leaking to a finalizer that\n  could later close a recycled fd.\n- The cleanup loop skips closeFd for takenOver conns, so a Take\n[…]\nh the event-loop and Takeover shutdown paths.\n\nVerified on Linux/epoll: the new test is a deterministic red before the fix\n(accept4: bad file descriptor) and green after; hot-path bench A/B is parity.",
          "is_bot": false,
          "headline": "fix(wing): close takeover File on shutdown to prevent fd double-close",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-19T15:55:23Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "927c066403887466e70c7664ffd6688ff749e17c",
          "body": "…eservation\n\n- Takeover path now charges and refunds the per-worker in-flight body budget\n  (MaxInflightBodyBytes), returning 503 when exceeded. Total in-flight body\n  memory is now bounded across both the event-loop and Takeover paths.\n- Preserve pipelined bytes that arrive in the same read as a re\n[…]\nbody:\n  relocate the surplus past Content-Length, and drain already-buffered\n  pipelined bytes once the body completes (edge-triggered epoll does not\n  re-notify for bytes already in the read buffer).",
          "is_bot": false,
          "headline": "fix(wing): shared takeover body budget + pipelined-after-body byte pr…",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-19T14:35:29Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8c77fc4410c7854a0ba7a704458b30fe587c833a",
          "body": null,
          "is_bot": false,
          "headline": "feat: typed-handler test client + OpenAPI 3.1 polish (D4)",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-16T14:52:52Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1348c4e359745a4db482908f7d34c5caf8c33005",
          "body": "… core seam",
          "is_bot": false,
          "headline": "feat: turnkey observability (contrib/observability) + WithLogEnricher…",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-16T06:03:29Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "88acc18245d2a275aa3758cd99b7a91ee2a4e72c",
          "body": "* fix(wing): parse X-Forwarded-For/X-Real-IP into dedicated fields; 431 for oversized header line\n\nTwo adopter-visible correctness fixes deferred from the body-limit review:\n\n- TrustProxy: X-Forwarded-For / X-Real-IP were stored in the 8-slot generic\n  extra-header array, so a request with >8 unknow\n[…]\ner\nretention.\n\nAlso add TestWing_HeaderLineLengthBoundary which pins the exact\noff-by-one contract of classifyIncomplete: len(hline) == HeaderLimit\nis accepted, len(hline) == HeaderLimit+1 yields 431.",
          "is_bot": false,
          "headline": "fix(wing): XFF dedicated fields and segmentation-independent 431",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-15T17:23:29Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3fe1fc2b44f09757f2d0ec3848ffc7f37a6cfc11",
          "body": "… + 413/431/501)\n\nMake the default Wing transport honor Kruda's request-size contract on both read paths (event loop + takeover): accept legal bodies up to BodyLimit via a memory-bounded accumulator with a per-worker in-flight budget, and return deterministic 413/431/501 plus Expect: 100-continue ha\n[…]\nroxy (X-Forwarded-For / X-Real-IP). No-body hot path unchanged (0-alloc fast-path guard; paired tiger A/B shows no regression). Drains the socket during accumulation for edge-triggered epoll on Linux.",
          "is_bot": false,
          "headline": "Wing: enforce request-size contract (BodyLimit/HeaderLimit/TrustProxy…",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-15T16:00:58Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4e9d3004880e8fb59aa60f0b8887ea7846a7001b",
          "body": "Add two release gates wired into CI so documentation defects fail the build instead of shipping silently.\n\n- scripts/check-godoc.sh: fails when an exported symbol in a released module lacks a doc comment; checks root + every contrib module + cmd/kruda across linux/darwin/windows; fails hard if reviv\n[…]\nck per-PR (revive pinned v1.12.0); docs.yml runs the docs check. Also fixes stale WingStaticText/WingStaticJSON references in transport.md and security.md (renamed to StaticText/StaticJSON in v1.3.0).",
          "is_bot": false,
          "headline": "ci: enforce doc correctness for exported APIs and current guides",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-15T04:00:30Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1eed571b1e16b76c7d7683322b736daa82854379",
          "body": "Add an opt-in /realworld-profile/:id route implemented identically across kruda/fiber/actix: route param, query validation, an auth-token gate, X-Request-Id handling, one PostgreSQL read, and a nested JSON response envelope. Claimed separately from CPU-only and DB-only results.\n\nHarden bench.sh: rou\n[…]\ne metadata, fiber/actix version capture. Bump fiber bench module to v2.52.13.\n\nIncludes 2026-06-14 tiger evidence: RPS parity with Fiber at the PostgreSQL ceiling with a p99 win, ~190% RPS over Actix.",
          "is_bot": false,
          "headline": "bench: add realistic API profile route across kruda/fiber/actix",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-14T14:35:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c57decb65afa707ed397681b9fba61387a899ee4",
          "body": "Add one-line opt-in RFC 9457 application/problem+json error responses plus fluent KrudaError builders (WithType/WithDetail/WithInstance/With). Additive and non-breaking: default error shape unchanged, WithErrorHandler still takes precedence. Targets v1.4.0.",
          "is_bot": false,
          "headline": "feat: opt-in RFC 9457 problem+json error responses",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-14T06:18:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0c2bd705a26d2348df8d8cfd63b81980d45459cc",
          "body": "…erf audits\n\nv1.3.1 (PATCH, no API change). P1 adaptive spin removes the v1.3.0 db/queries p99 trade (now beat Fiber p99, RPS parity at pgx ceiling); CPU +27-35%, fortunes +6.7-7.5%. P2/P3/P4 audits (alloc/footprint/low-conc) + tooling, no runtime change. pre-release.sh + consolidated 5-round validation green. Evidence under bench/reproducible/results/2026-06-13-*.",
          "is_bot": false,
          "headline": "release: stamp v1.3.1 — takeover spin removes db/queries p99 trade; p…",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-13T17:15:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b231dd0b89a4b5e71bf948d11dc4f6cdfe8fa2dc",
          "body": "Perf-track P4 (v1.3.1): opt-in BENCH_LOWC=1 profiles (c8/16/32) + finding. Kruda leads RPS at every concurrency; p99 better-or-equal from c16 up (P1 spin helps DB tail even at low load). Only c8 plaintext p99 (0.25 vs 0.07ms, sub-ms) favors Fiber — immaterial. Harness only, no production change. Evidence: bench/reproducible/results/2026-06-13-low-concurrency-evidence.md.",
          "is_bot": false,
          "headline": "bench: low-concurrency latency profiles + finding",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-13T16:36:11Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f026f735ccdc93362d4d06faaa8425e9f9cd1962",
          "body": "Perf-track P3 (v1.3.1): measure-first footprint. tiger startup 5ms, idle RSS 13.79MB, binary 21.9MB (stdjson)/26.6MB (Sonic). Already lean; Go-runtime+dep dominated; knobs (kruda_stdjson, GOGC/GOMEMLIMIT) already documented. Adds footprint.sh. No production change. Evidence: bench/reproducible/results/2026-06-13-footprint-evidence.md.",
          "is_bot": false,
          "headline": "bench: runtime footprint measurement + finding",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-13T15:53:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "99686e31dcaf788febf48f47b14c20c4e0e87354",
          "body": "Perf-track P2 (v1.3.1): allocation audit. The Wing hot path is already alloc-optimal (Ctx pool and string lane 0 allocs/op; lane plaintext/JSON 1 alloc = the payload). The 7-alloc generic path is the safe-string contract plus a bench buffer-pool artifact, not a real cut. Adds TestStringLaneZeroAlloc guard. No production code change. Evidence: bench/reproducible/results/2026-06-13-alloc-audit-evidence.md.",
          "is_bot": false,
          "headline": "test: lock Wing string-lane zero-alloc; record hot-path allocation audit",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-13T15:19:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "885611784f9fbcc1389c5a59838aac9f53daa13f",
          "body": "Perf-track P1 (v1.3.1): bounded non-blocking spin before the netpoller park on the Takeover keep-alive read. Fixes /queries throughput p99 (was +11.33% over Fiber, now -14.8%); every db/queries cell beats Fiber on RPS and p99. No API change. Evidence: bench/reproducible/results/2026-06-13-takeover-spin-p99-evidence.md.",
          "is_bot": false,
          "headline": "Wing: adaptive spin before netpoller park on takeover keep-alive read",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-13T11:43:48Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9a0c9f84c72a10b40d5d11edd889a4e48a568902",
          "body": "Profile-first follow-up to v1.3.0: DB-route ceiling evidence (pgx floor, DB-bound proof, 3+5-round battery), the ExamplePreset godoc example, and the coming-from-fiber claim-wording fix. Docs/bench/test only; no runtime change, no tag.",
          "is_bot": false,
          "headline": "docs: DB-route ceiling evidence + Preset godoc example",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-13T10:07:48Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "fa29a2fa041f6be57db9e73cd1f6954fd1930aaa",
          "body": "Date the 1.3.0 CHANGELOG section and update the performance and Fiber migration guides to the committed v1.3.0 evidence: the claim gate passes against both Actix and Fiber on every benchmark route (queries versus Fiber on the default Sonic build), with the netpoll takeover p99 trade noted. Claim rule generalized from Actix-only to any rival. Pre-release script all green.",
          "is_bot": false,
          "headline": "release: stamp v1.3.0 and record cross-rival claims in guides",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-12T18:21:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "590f0f9d05110629369b308da3cff235428c3cb2",
          "body": "Takeover dispatch previously pinned one OS thread per connection (237-250 threads at c256, 1.40 context switches per request, identical CPU per request to Fiber's model). Wrap the non-blocking fd in an os.File so reads and writes park the goroutine on the runtime netpoller; the worker closes through\n[…]\nch apps, Kruda now passes the claim gate against Fiber on every benchmark route (queries on the default Sonic build). Evidence: bench/reproducible/results/2026-06-12-wing-netpoll-takeover-evidence.md.",
          "is_bot": false,
          "headline": "Wing: park takeover connections on the runtime netpoller",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-12T17:11:48Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a4b0f3275ed1003c962273881e32328c85a0dc2b",
          "body": "Remove maintainer-local planning notes from tracking (files stay on disk, shielded by the local exclude rule) and point the AI-context file at the in-repo ADR and CHANGELOG migration table. Format ten legacy files so gofmt -l is clean repo-wide; doc-comment indent and alignment only, no code changes.",
          "is_bot": false,
          "headline": "chore: untrack internal planning docs and format legacy files",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-12T12:09:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e534ed99d201b8e2d2490accbc0fa9ada29b18ef",
          "body": "Reshape the per-route API around presets passed directly as route options (structural Bolt/Arrow/Spear + semantic Plaintext/JSON/DB/Render), add the Wing string response fast lane behind c.Text/c.HTML, and add the blocking advisor that warns once when an inline route blocks the event loop. Remove th\n[…]\n static-text cache, and the transport/wing shim module. Migration table in CHANGELOG.md; tiger release gates all passed per bench/reproducible/results/2026-06-12-v1-3-0-string-lane-preset-evidence.md.",
          "is_bot": false,
          "headline": "Release v1.3.0: preset route options, Wing string lane, blocking advisor",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-12T10:37:34Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e61165f7045148d3c78aeda13c29b132c76bc1cc",
          "body": null,
          "is_bot": false,
          "headline": "bench: add Fiber-inclusive DB read evidence",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-11T15:13:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b84e19b5fe72ac413095f1ddcf2217b6e126b7d4",
          "body": null,
          "is_bot": false,
          "headline": "bench: add Actix queries DB route",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-07T17:15:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "94044cf1c60f700a93cc2baa467e6739e714f4c9",
          "body": null,
          "is_bot": false,
          "headline": "bench: reject PGO candidate",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-07T16:41:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "eaf46fcb72ec8b4ddf65639f3193dfeeb5eabd6c",
          "body": "Record same-host tiger-linux evidence rejecting the Linux Wing fd-indexed conn pointer table candidate. Evidence-only; no runtime code changes.",
          "is_bot": false,
          "headline": "bench: reject epoll conn pointer table candidate",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-07T16:08:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f49f067a0556d0f5d069cf450c613a68b14c6470",
          "body": "Record current main read-only DB follow-up evidence from tiger-linux and confirm takeover remains the supported DB benchmark dispatch mode. This is evidence-only and does not claim a broad CPU-bound fair-handler win.",
          "is_bot": false,
          "headline": "bench: record main DB follow-up evidence",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-07T15:12:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2991641b2ec1cc23d48868b8ece3c7e80344e9d9",
          "body": null,
          "is_bot": false,
          "headline": "bench: record main syscall profile inventory",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-07T14:14:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "447372436ead75f0d8ac5d0091dbaba09b24a80e",
          "body": null,
          "is_bot": false,
          "headline": "bench: add non-pipelined syscall ratios",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-07T13:51:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8bd4686c288249bf07bcd70f05f2d185a1277b7d",
          "body": null,
          "is_bot": false,
          "headline": "bench: add CPU dispatch sweep control (#113)",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-07T13:22:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "24a42d279e0e6a594643883cef1c05bf45053804",
          "body": null,
          "is_bot": false,
          "headline": "ci: pin Windows test runner (#112)",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-07T12:52:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "11f035ddbe7a4b7ea7001f83cea6ca0dac99102d",
          "body": null,
          "is_bot": false,
          "headline": "bench: add Actix worker-count control (#111)",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-07T09:52:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7b7a621ba7295eeedb3d047a3ed460525fbad47a",
          "body": null,
          "is_bot": false,
          "headline": "ci: share benchmark regression checker (#110)",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-07T09:27:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8483f4f76aac4ed4065d76c40e7fe9ed06b0921c",
          "body": null,
          "is_bot": false,
          "headline": "ci: upload benchmark evidence artifacts (#109)",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-07T09:09:20Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c3884a321051cb275df39ee2f35aab8a75457014",
          "body": null,
          "is_bot": false,
          "headline": "bench: record dispatch sweep git metadata (#108)",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-07T08:50:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "87b65f1c3a0cd7281b700d3432b7e865d076ec32",
          "body": null,
          "is_bot": false,
          "headline": "bench: record git metadata in harness output (#107)",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-07T08:29:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b5701a28902fe04ef5a4c4ba7b0561576eeaf582",
          "body": null,
          "is_bot": false,
          "headline": "ci: add benchmark review checklist (#106)",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-07T08:10:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "af25d4501532832828d73cf727be33e011a9c1c6",
          "body": null,
          "is_bot": false,
          "headline": "docs: align v1.2.6 roadmap source evidence wording (#105)",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-07T07:53:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d8340f66d2674a6b5b1fb5b2c7beba31db1e8334",
          "body": "Replaces stale latest-clean wording for the post-v1.2.5 CPU-bound tiger follow-up and keeps that evidence separated from the v1.2.6 DB, pipelined HTTP/1.1, and read-buffer tracks. No runtime change and no release tag.",
          "is_bot": false,
          "headline": "docs: clarify CPU-bound evidence wording",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-07T07:19:50Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a902f9133eeae7b6054239d550207cb880cd254f",
          "body": "Replaces the self-invalidating latest-main commit pointer in the v1.2.6 roadmap with a stable closure record. Keeps the release decision unchanged: no v1.2.6 tag from the current docs/evidence-only delta.",
          "is_bot": false,
          "headline": "docs: make v1.2.6 roadmap status stable",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-07T06:40:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "42e8a7abedc02020fafe6ad1a6e742998008639d",
          "body": "Refreshes the v1.2.6 candidate roadmap execution status to the latest merged main commit after PR #100 and PR #101. Keeps the release decision unchanged: no v1.2.6 tag from the current docs/evidence-only delta.",
          "is_bot": false,
          "headline": "docs: refresh v1.2.6 roadmap status",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-07T06:33:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "eab700a9ac9b02926877b0aa4aaa20d97f5a7e96",
          "body": "Updates public benchmark wording to reference the accepted v1.2.6 read-only DB revalidation instead of the earlier follow-up investigation. Keeps the claim scoped to read-style DB workloads and does not justify a release tag by itself.",
          "is_bot": false,
          "headline": "docs: point DB benchmark wording at v1.2.6 evidence",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-07T04:51:23Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7d6f6dc785da41c7f917a7794cd30f1f7b3e5501",
          "body": "Marks the docs-only v1.2.6 candidate roadmap as complete after all scoped evidence tracks were recorded. Keeps the release decision unchanged: no changelog section, release proof, or v1.2.6 tag for the current docs/evidence-only delta.",
          "is_bot": false,
          "headline": "docs: close v1.2.6 performance roadmap",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-06T22:38:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c816915b2fdacab8b5ca657e07beb3c0737d8e35",
          "body": "Records the v1.2.6 JSON serialization recheck as docs/evidence only. Keeps the claim local to kruda_stdjson microbenchmarks, closes the JSON track without runtime changes, and does not justify a release tag by itself.",
          "is_bot": false,
          "headline": "bench: record v1.2.6 JSON recheck",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-06T20:07:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "095d6df6be28c196f250257ac0a705ddd7ef01b8",
          "body": "Records the v1.2.6 HTTP/1.1 pipelined diagnostic evidence. Keeps the claim scoped to pipelined diagnostics and does not reopen runtime response batching or a broad default fair-handler claim.",
          "is_bot": false,
          "headline": "bench: record v1.2.6 pipelined diagnostics",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-06T19:49:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b57fbeee13ada58148b218500ed87696362b373e",
          "body": "Records the v1.2.6 same-runner read-buffer resource evidence. Keeps KRUDA_READ_BUF_SIZE=2048 as an optional short-header memory profile and rejects changing the framework default because the strict p99/RPS gate did not pass.",
          "is_bot": false,
          "headline": "bench: record v1.2.6 read-buffer evidence",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-06T19:02:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6e69e25dd9c7e8726e62ba346278ce2afce13ea7",
          "body": "Records the v1.2.6 no-release decision after the accepted read-only DB evidence. Clarifies that the current post-v1.2.5 delta is docs/evidence-only and should remain untagged until an upgrade-worthy framework change exists.",
          "is_bot": false,
          "headline": "docs: record v1.2.6 no-release decision",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-06T18:17:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "85df3d3efb1f21404ef5b94c09c897e27966bbba",
          "body": "Record fresh tiger-linux read-only DB benchmark evidence for v1.2.6. The scoped DB workload claim is accepted for /db and /fortunes with zero socket errors, zero non-2xx responses, no manual DB DSN overrides, and lower p99 than Actix. This does not support a broad CPU-bound fair-handler claim.",
          "is_bot": false,
          "headline": "bench: record v1.2.6 read-only DB evidence",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-06T17:38:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7f0fef0fda039aae95e91e871544058e3f0b7419",
          "body": "Add a v1.2.6 candidate boundary to the reproducible benchmark docs and link the same boundary from the performance guide so CPU-bound, read-only DB, pipelined HTTP/1.1, and read-buffer memory evidence remain separate.",
          "is_bot": false,
          "headline": "docs: define v1.2.6 performance candidate boundary",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-06T17:12:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4962bfaf958a677a57dbadbafa982874add599e2",
          "body": "Add a docs-only v1.2.6 candidate roadmap with evidence gates for read-only DB, JSON serialization, pipelined diagnostics, read-buffer resource profiling, and release-worthiness decisions.",
          "is_bot": false,
          "headline": "docs: plan v1.2.6 performance candidates",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-06T16:50:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6d5aee6d807eac54d7c2648422630d0670ba085c",
          "body": "Add the v1.2.5 changelog entry on top of current main, including the accepted Wing runtime fixes, benchmark tooling, and scoped benchmark documentation updates since v1.2.4.",
          "is_bot": false,
          "headline": "docs: prepare v1.2.5 release notes",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-06T14:48:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6dfe1e42b5ce0300a18524c1098783f2c572c36b",
          "body": "Document the scoped read-only DB benchmark evidence in the README and performance guide while keeping CPU-bound handler-path claims separate.",
          "is_bot": false,
          "headline": "docs: document read-only DB benchmark evidence",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-06T14:28:48Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "67ad9e8d8f66880711608efa7eaaf0be134b1b32",
          "body": "Add framework-specific DB DSN defaults to the reproducible benchmark harnesses and record follow-up Wing/Actix evidence for CPU-bound and read-only DB workloads.",
          "is_bot": false,
          "headline": "bench: support framework-specific DB DSNs",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-06T14:15:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c3a17efc34c393430e3e2e7b222b2ec73d10d8a0",
          "body": "Skip duplicate worker-level accept re-arms on Linux epoll accept events by marking successful accept completions with the existing cqeFMore flag.\n\nAlso add clean CPU/resource benchmark evidence, Linux accept re-arm evidence, bench module replace-path normalization, and documentation for KRUDA_READ_B\n[…]\nZE=2048 as an optional short-header memory profile candidate. This keeps Kruda defaults unchanged and intentionally excludes the rejected io_uring, CPU affinity, PGO, and speculative-read experiments.",
          "is_bot": false,
          "headline": "perf: skip duplicate Linux accept rearm",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-06T11:16:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ef3fb0520fd4a4055d47e7ffa147ebb67b40d78c",
          "body": "Add an intrusive HTTP/1.1 pipelined syscall-count harness and tiger evidence showing Wing already coalesces depth-8 inline pipelined responses. This does not change runtime behavior.",
          "is_bot": false,
          "headline": "bench: add pipelined syscall diagnostic harness",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-02T16:08:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5ed9d33a2896f63e96c363c6ef200fc856ec8f33",
          "body": "Stream Wing stdjson JSON serialization responses into a response-owned buffer, add focused tests, and record local plus tiger evidence. The default Sonic response path remains unchanged, and the evidence keeps the Actix claim boundary at same-ballpark for the broader diagnostic workload.",
          "is_bot": false,
          "headline": "perf: stream Wing stdjson responses into pooled buffers",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-02T15:09:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6ad22a7e63c44977ad60657d61d2a70b7bb4a5a6",
          "body": "Add a diagnostic HTTP/1.1 pipelined benchmark harness and tiger evidence for future Wing I/O architecture work.\n\nThis does not change runtime behavior.",
          "is_bot": false,
          "headline": "bench: add pipelined I/O diagnostic harness",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-02T14:28:03Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a969a894ac0b3d095dcce69bdfc937c5bab6cd55",
          "body": "Record rejected Wing JSON bytes responder evidence and add focused benchmark coverage. No runtime behavior change and no public benchmark claim.",
          "is_bot": false,
          "headline": "bench: record rejected Wing JSON bytes candidate",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-02T09:38:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1395a66a32c3e7ce71cb0dbe34b694e040d72302",
          "body": "Prefer Wing's JSONResponder path before the fasthttp static body check in SendStaticJSON. Includes local microbenchmark evidence; no public Actix claim.",
          "is_bot": false,
          "headline": "perf: prefer Wing JSON responder for static JSON",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-02T08:22:47Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f60ea8917b43536990b679aae78881b59b2ba9f8",
          "body": "Record local microbenchmark evidence rejecting the Sonic buffer encoder candidate. No runtime behavior changes.",
          "is_bot": false,
          "headline": "bench: record rejected Sonic buffer encoder candidate",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-02T07:40:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "48d6da62ada24f56e0a0c770c1ca53ccc9ac6d9c",
          "body": "Clarify that WingQuery is query-profile guidance for DB/Redis read-style workloads and that write-heavy routes need workload-specific p99 and error evidence.",
          "is_bot": false,
          "headline": "docs: clarify Wing query profile guidance",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-02T05:51:30Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d290f8beacc7724666a61d491beb4906696a2b13",
          "body": "Clarify that benchmark evidence was captured at commit 984f0d6 and align public performance docs on the same evidence set.",
          "is_bot": false,
          "headline": "docs: clarify benchmark evidence wording",
          "author_name": "WhiteTiger",
          "author_login": "wtigero",
          "committed_at": "2026-06-02T05:32:50Z",
          "body_truncated": false,
          "is_coding_agent": false
        }
      ],
      "releases_count": 16,
      "commits_last_year": 296,
      "latest_release_at": "2026-07-18T19:31:29Z",
      "latest_release_tag": "v1.6.2",
      "releases_from_tags": false,
      "days_since_last_push": 5,
      "active_weeks_last_year": 18,
      "days_since_latest_release": 5,
      "mean_days_between_releases": 6.3
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": true,
      "health_percentage": 75,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": true
    },
    "ecosystem": {
      "packages": [
        {
          "name": "github.com/go-kruda/kruda",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": true,
          "registry_url": "https://pkg.go.dev/github.com/go-kruda/kruda",
          "is_deprecated": false,
          "latest_version": "v1.6.2",
          "repository_url": "https://github.com/go-kruda/kruda",
          "versions_count": 21,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-18T19:22:27Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 5
        }
      ]
    },
    "popularity": {
      "forks": 1,
      "stars": 22,
      "watchers": 0,
      "fork_history": {
        "days": [
          {
            "date": "2026-04-19",
            "count": 1
          }
        ],
        "complete": true,
        "collected": 1,
        "total_forks": 1
      },
      "star_history": null,
      "open_issues_and_prs": 0
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [
        "examples"
      ],
      "has_llms_txt": false,
      "has_dockerfile": false,
      "has_mcp_signal": false,
      "bootstrap_files": [
        "Makefile"
      ],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [
        "bench/go.mod",
        "bench/reproducible/actix/Cargo.toml",
        "bench/reproducible/fiber/go.mod",
        "bench/reproducible/kruda/go.mod",
        "bench/reproducible/soak/go.mod",
        "cmd/kruda/go.mod",
        "contrib/cache/go.mod",
        "contrib/compress/go.mod",
        "contrib/etag/go.mod",
        "contrib/jwt/go.mod",
        "contrib/observability/go.mod",
        "contrib/otel/go.mod",
        "contrib/prometheus/go.mod",
        "contrib/ratelimit/go.mod",
        "contrib/session/go.mod",
        "contrib/swagger/go.mod",
        "contrib/ws/go.mod",
        "examples/observability/go.mod",
        "examples/ratelimit/go.mod",
        "examples/session/go.mod",
        "examples/websocket/go.mod",
        "go.mod"
      ],
      "largest_source_bytes": 72807,
      "source_files_sampled": 367,
      "oversized_source_files": 1,
      "agent_instruction_files": [
        "CLAUDE.md"
      ],
      "agent_instruction_max_bytes": 6503
    },
    "dependencies": {
      "manifests": [
        "bench/go.mod",
        "docs/package.json",
        "go.mod"
      ],
      "advisories": {
        "error": null,
        "scope": null,
        "source": null,
        "findings": [],
        "collected": false,
        "malicious": [],
        "truncated": false,
        "by_severity": {},
        "advisory_count": 0,
        "affected_count": 0,
        "assessed_count": 0,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "go",
        "npm"
      ],
      "dependencies": [
        {
          "name": "github.com/go-kruda/kruda",
          "manifest": "bench/go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-00010101000000-000000000000"
        },
        {
          "name": "github.com/gofiber/fiber/v2",
          "manifest": "bench/go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.52.12"
        },
        {
          "name": "github.com/valyala/fasthttp",
          "manifest": "bench/go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.69.0"
        },
        {
          "name": "github.com/bytedance/sonic",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.15.0"
        },
        {
          "name": "github.com/valyala/fasthttp",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.69.0"
        }
      ],
      "all_dependencies": {
        "error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
        "source": null,
        "packages": [],
        "collected": false,
        "truncated": false,
        "total_count": null,
        "direct_count": null,
        "indirect_count": null
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 180,
        "open_issues": 0,
        "closed_ratio": null,
        "closed_issues": 0,
        "closed_unmerged_prs": 0
      },
      "bus_factor": 1,
      "bot_contributors": 0,
      "top_contributors": [
        {
          "type": "User",
          "login": "wtigero",
          "commits": 293,
          "avatar_url": "https://avatars.githubusercontent.com/u/56679729?v=4"
        },
        {
          "type": "User",
          "login": "claude",
          "commits": 3,
          "avatar_url": "https://avatars.githubusercontent.com/u/81847?v=4"
        }
      ],
      "contributors_sampled": 2,
      "top_contributor_share": 0.99
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "benchmark.yml",
        "docs.yml",
        "govulncheck.yml",
        "release.yml",
        "test.yml"
      ],
      "has_docs_dir": true,
      "linter_configs": [
        ".golangci.yml"
      ],
      "has_editorconfig": false,
      "has_linter_config": true,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "Cargo.lock",
        "go.sum",
        "package-lock.json"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": null,
            "reason": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 9,
            "reason": "29 out of 30 merged PRs checked by a CI test -- score normalized to 9",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/30 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 3,
            "reason": "project has 1 contributing companies or organizations -- score normalized to 3",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 0,
            "reason": "no update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 10,
            "reason": "project is fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 10,
            "reason": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": null,
            "reason": "packaging workflow not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 1,
            "reason": "dependency not pinned by hash detected -- score normalized to 1",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "SAST tool is not run on all commits -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 10,
            "reason": "security policy file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": 0,
            "reason": "Project has not signed or included provenance with any releases.",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 0,
            "reason": "43 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "2d6eeac97aee3a837a73eef3c422dff77cc7ae48",
        "ran_at": "2026-07-24T00:46:04Z",
        "aggregate_score": 4.4,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": true,
      "has_dependabot_config": false
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-19T21:48:09Z",
      "oldest_open_prs": [],
      "last_merged_pr_at": "2026-07-18T23:34:11Z",
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": []
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/go-kruda/kruda",
    "host": "github.com",
    "name": "kruda",
    "owner": "go-kruda"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "moderate",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 63,
      "inputs": {
        "security": 44,
        "vitality": 82,
        "community": 47,
        "governance": 52,
        "engineering": 85
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "good",
        "name": "Vitality",
        "value": 82,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "good",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 76,
            "inputs": {
              "commits_last_year": 296,
              "human_commit_share": 1,
              "days_since_last_push": 5,
              "active_weeks_last_year": 18
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 5 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 5
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "18/52 weeks with commits",
                "points": 12.5,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 18
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "296 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 296
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": null,
            "notes": [],
            "value": 90,
            "inputs": {
              "releases_count": 16,
              "latest_release_tag": "v1.6.2",
              "releases_from_tags": false,
              "days_since_latest_release": 5,
              "mean_days_between_releases": 6.3
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "16 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 16
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 5 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 5
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~6.3 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 6.3
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "at_risk",
        "name": "Community & Adoption",
        "value": 47,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 21,
            "inputs": {
              "forks": 1,
              "stars": 22,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "22 stars",
                "points": 21.4,
                "status": "partial",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 22
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "1 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "good",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 77,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": true,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (MIT)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "MIT"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 18,
                "status": "met",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 6.3,
                "status": "met",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "moderate",
        "name": "Sustainability & Governance",
        "value": 52,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 15,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 2,
              "top_contributor_share": 0.99
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 99% of commits",
                "points": 0.2,
                "status": "partial",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 99
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "2 contributors",
                "points": 2.7,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 1 contributing companies or organizations -- score normalized to 3",
                "points": 3,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "good",
            "name": "Issue & PR responsiveness",
            "note": "Excluded from scoring (no data or not applicable): Issue resolution. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "issue_resolution"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 72,
            "inputs": {
              "merged_prs": 180,
              "open_issues": 0,
              "closed_issues": 0,
              "issue_closed_ratio": null,
              "closed_unmerged_prs": 0
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "no issues or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_issues_or_data",
                    "params": {}
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "180/180 decided PRs merged",
                "points": 38.2,
                "status": "met",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 180,
                      "decided": 180
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "at_risk",
            "name": "Ownership & stewardship",
            "note": null,
            "notes": [],
            "value": 36,
            "inputs": {
              "followers": 1,
              "owner_type": "Organization",
              "is_verified": null,
              "owner_login": "go-kruda",
              "public_repos": 2,
              "account_age_days": 151
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "organization-owned",
                "points": 30,
                "status": "met",
                "details": [
                  {
                    "code": "owner_organization",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "1 followers of go-kruda",
                "points": 2.2,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 1,
                      "login": "go-kruda"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "2 public repos, account ~0 yr old",
                "points": 4.3,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 2
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 0
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "github.com/go-kruda/kruda"
              ],
              "ecosystems": "go",
              "any_deprecated": false,
              "min_days_since_publish": 5
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on go",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "go"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 5 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 5
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "21 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 21
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "excellent",
        "name": "Engineering Quality",
        "value": 85,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "good",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 82,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": true,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "5 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 5
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": ".golangci.yml",
                "points": 16,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yml"
                    }
                  }
                ],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "29 out of 30 merged PRs checked by a CI test -- score normalized to 9",
                "points": 18,
                "status": "partial",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "excellent",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 90,
            "inputs": {
              "topics": [
                "epoll",
                "generics",
                "go",
                "golang",
                "high-performance",
                "http",
                "microservice",
                "rest-api",
                "type-safe",
                "web-framework"
              ],
              "has_wiki": false,
              "homepage": "https://pkg.go.dev/github.com/go-kruda/kruda",
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": "https://pkg.go.dev/github.com/go-kruda/kruda",
                "points": 15,
                "status": "met",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": "10 topics",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "topics_count",
                    "params": {
                      "count": 10
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "at_risk",
        "name": "Security",
        "value": 44,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "at_risk",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): Branch-Protection, Packaging. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "branch_protection",
                    "packaging"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 44,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 16,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 2,
              "scorecard_aggregate": 4.4
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "29 out of 30 merged PRs checked by a CI test -- score normalized to 9",
                "points": 2.2,
                "status": "partial",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 1 contributing companies or organizations -- score normalized to 3",
                "points": 0.8,
                "status": "partial",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "no update tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is fuzzed",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow not detected",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 1",
                "points": 0.5,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool is not run on all commits -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "43 existing vulnerabilities detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "good",
        "name": "AI Readiness",
        "value": 76,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "excellent",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 1,
              "agent_instruction_files": [
                "CLAUDE.md"
              ],
              "agent_instruction_max_bytes": 6503
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "CLAUDE.md",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "CLAUDE.md"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "100 of 100 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 100,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "good",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 73,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "Cargo.lock",
                "go.sum",
                "package-lock.json"
              ],
              "has_dockerfile": false,
              "typed_language": true,
              "bootstrap_files": [
                "Makefile"
              ],
              "has_devcontainer": false,
              "has_linter_config": true,
              "typecheck_configs": [],
              "agent_commit_share": 0,
              "toolchain_manifests": [
                "bench/go.mod",
                "bench/reproducible/actix/Cargo.toml",
                "bench/reproducible/fiber/go.mod",
                "bench/reproducible/kruda/go.mod",
                "bench/reproducible/soak/go.mod",
                "cmd/kruda/go.mod",
                "contrib/cache/go.mod",
                "contrib/compress/go.mod",
                "contrib/etag/go.mod",
                "contrib/jwt/go.mod",
                "contrib/observability/go.mod",
                "contrib/otel/go.mod",
                "contrib/prometheus/go.mod",
                "contrib/ratelimit/go.mod",
                "contrib/session/go.mod",
                "contrib/swagger/go.mod",
                "contrib/ws/go.mod",
                "examples/observability/go.mod",
                "examples/ratelimit/go.mod",
                "examples/session/go.mod",
                "examples/websocket/go.mod",
                "go.mod"
              ],
              "dependency_bot_commit_share": 0
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "Makefile",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Makefile"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": ".golangci.yml",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yml"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "Go (statically typed)",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "no agent-authored commits among the last 100",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_authored_commits",
                    "params": {
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "no automated dependency updates observed",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_dependency_automation",
                    "params": {}
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 1",
                "points": 1,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "Go",
              "largest_source_bytes": 72807,
              "source_files_sampled": 367,
              "oversized_source_files": 1
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Go (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "1/367 source files over 60KB",
                "points": 54.9,
                "status": "partial",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 367,
                      "oversized": 1
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "at_risk",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "example_dirs": [
                "examples"
              ],
              "has_mcp_signal": false,
              "api_schema_files": []
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": "examples",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "examples"
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
    "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-24T00:46:22.078401Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/g/go-kruda/kruda.svg",
  "full_name": "go-kruda/kruda",
  "license_state": "standard",
  "license_spdx": "MIT"
}