isazajuancarlos / quipu

Vollständig aufgelöster Abhängigkeitssatz aus dem GitHub-Abhängigkeitsgraphen: 34 direkte und 141 indirekte (transitive) Pakete. Die transitive Hülle ist vollständig, wenn das Repository eine Lockfile eincheckt.

Dieses Repository veröffentlicht kein vom Index auflösbares Paket, daher wurde sein eigener Abhängigkeitsgraph bewertet – 151 Pakete, darunter auch Entwicklungs- und Test-Pins, die nie ausgeliefert werden: 0 tragen bekannte Advisories, davon 0 direkte. 24 konnten nicht bewertet werden – keine aufgelöste Version, ein nicht unterstütztes Ökosystem, oder außerhalb der ausgewiesenen Paketliste.

Keine bekannten Advisories betreffen die bewerteten Abhängigkeiten.

Ein Advisory bedeutet, dass die im Abhängigkeitsgraphen erfasste Version in den betroffenen Bereich eines Advisories fällt. Erreichbarkeit wird nicht analysiert, und der Graph enthält Entwicklungs- und Test-Pins — ein Fund kann das Werkzeug betreffen und nicht die ausgelieferte Software.

{
  "data": {
    "repo": {
      "topics": [
        "agpl",
        "argon2",
        "cryptography",
        "encryption",
        "ml-dsa",
        "ml-kem",
        "post-quantum-cryptography",
        "rust",
        "voprf",
        "xchacha20"
      ],
      "is_fork": false,
      "size_kb": 1312,
      "has_wiki": true,
      "homepage": "https://crates.io/crates/quipu",
      "languages": {
        "Rust": 564374,
        "Shell": 3986,
        "Python": 83557,
        "Dockerfile": 875
      },
      "pushed_at": "2026-07-27T23:54:43Z",
      "created_at": "2026-07-01T13:43:47Z",
      "owner_type": "User",
      "updated_at": "2026-07-27T14:34:08Z",
      "description": "Post-quantum hybrid cryptography for data at rest (Rust core; Python/Node/Go bindings). AGPL-3.0. XChaCha20-Poly1305 · Argon2id · ML-KEM-1024 · ML-DSA-87 · VOPRF.",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "AGPL-3.0",
      "default_branch": "estable",
      "license_spdx_raw": "AGPL-3.0",
      "primary_language": "Rust",
      "significant_languages": [
        "Rust",
        "Python"
      ]
    },
    "owner": {
      "blog": "https://xiliux.com",
      "name": "Juan Carlos Isaza",
      "type": "User",
      "login": "isazajuancarlos",
      "company": "Xiliux",
      "location": null,
      "followers": 0,
      "avatar_url": "https://avatars.githubusercontent.com/u/54165021?v=4",
      "created_at": "2019-08-16T04:31:35Z",
      "is_verified": null,
      "public_repos": 10,
      "account_age_days": 2538
    },
    "license": {
      "state": "standard",
      "spdx_id": "AGPL-3.0",
      "raw_spdx": "AGPL-3.0",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.9.1",
          "kind": "patch",
          "published_at": "2026-07-21T02:41:11Z"
        },
        {
          "tag": "v0.9.0",
          "kind": "minor",
          "published_at": "2026-07-21T01:00:25Z"
        },
        {
          "tag": "v0.8.0",
          "kind": "minor",
          "published_at": "2026-07-18T20:37:11Z"
        },
        {
          "tag": "v0.7.0",
          "kind": "minor",
          "published_at": "2026-07-06T18:15:30Z"
        },
        {
          "tag": "v0.6.0",
          "kind": "minor",
          "published_at": "2026-07-04T23:00:17Z"
        },
        {
          "tag": "v0.5.0",
          "kind": "minor",
          "published_at": "2026-07-04T13:45:10Z"
        },
        {
          "tag": "v0.4.1",
          "kind": "patch",
          "published_at": "2026-07-03T03:49:45Z"
        },
        {
          "tag": "v0.4.0",
          "kind": "minor",
          "published_at": "2026-07-03T02:13:58Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "8d84b5002adf099b4ce0aa0d4e23152563a6f825",
          "body": "Va PRIMERO y por separado: si se renombra la rama antes de tocar esto, el\ndisparador `branches: [main, master]` deja de casar y los push a `estable` no\nlanzarían el CI. Un repositorio sin CI durante unos minutos es el hueco por el\nque se cuela lo que este proyecto lleva un mes cerrando.\n\n  ci.yml   \n[…]\nones para los\nenlaces antiguos y reapunta los PR abiertos (no hay).\n\nQueda escrito en RAMAS.md qué tiene que correr quien tenga un clon anterior.\n\nCo-authored-by: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(ramas): preparar el CI antes de renombrar main a estable (#108)",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-27T14:31:24Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "91e16051919fa3884078257d5be86052eaadbdb7",
          "body": "* docs: hoja de ruta exclusiva de Quipu, con el estado medido\n\nEl índice general de pendientes mezcla seis proyectos y 48 tareas abiertas: no\nsirve para trabajar aquí. Esta lista es solo de Quipu, vive DENTRO del\nrepositorio —así se versiona y se revisa en los PR— y sirve además de carta a\nquien eva\n[…]\nn número que ya vive en `Cargo.toml`. Se\nquita el número y se dice dónde mirar.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: hoja de ruta exclusiva de Quipu, con el estado medido (#107)",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-27T14:20:05Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "d0880ae9faca9dae3d497caba8d54fddafcc23fb",
          "body": "`examples/oprf_client.py` llamaba a `quipu.voprf_blind(...)`, una función que el\nmódulo de Python NO expone desde 0.8.0. Reventaba con AttributeError en su\nprimera línea útil, y llevaba así desde entonces sin que nadie lo notara: ningún\nworkflow ejecuta los ejemplos de Python.\n\nY estar roto era lo d\n[…]\nra el VOPRF, y el agujero estaba\nen quien lo documenta. Comprobado que discrimina: al revertir el ejemplo, rojo\nnombrando el archivo y el porqué.\n\nCo-authored-by: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(ejemplos): el cliente OPRF enseñaba a enlazar el núcleo AGPL (#106)",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-27T14:13:01Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "0c117e7d7a67f82f41d218ae79de329c3f8454e6",
          "body": "…#105)\n\nSe me pasó en el recorte anterior. Salió al preguntarme si el repositorio era\nrealmente todo Rust: quedaban 585 líneas de Go en 3 archivos versionados.\n\nNo era un binding sino una integración —el hermano en Go de\n`integrations/django`— y por eso no cayó con `bindings/go`. Se va por tres\nrazo\n[…]\nitoría local)\n\nVerificado: 244 pruebas 0 fallidas · verificar.py version en verde · el banco\ndel propio verificador, 41 comprobaciones correctas.\n\nCo-authored-by: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "refactor!: fuera `integrations/go`, que quedó roto y nadie vigilaba (…",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-27T14:08:33Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "21d5377dc1486f78701971e301fcf11676fad30c",
          "body": "Se van `bindings/c` (quipu-capi), `bindings/node` (quipu-crypto en npm),\n`bindings/go` e `integrations/express`, con sus jobs de CI y el workflow\n`npm-publish.yml`.\n\nPOR QUÉ. Nadie los usaba, y no es una corazonada: medido contra los índices el\n2026-07-27, npm acumulaba 486 descargas en cuatro meses\n[…]\nue no es mío: quedan sin rastrear `bindings/node/conversaciones`\n—tuyo—, `node_modules` y `prebuilds`. Son 30 MB de artefactos ignorados por git.\n\nCo-authored-by: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "refactor!: un solo binding, y es Python (#104)",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-27T13:52:06Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "d2879d53bc64560f7469dcc5baf1b5b7080644da",
          "body": "…103)\n\n`Cargo.toml`, `pyproject.toml` y `crates/quipu-nucleo/Cargo.toml` prometían en\nsu `description` un «canal visual de glifos» que los PR #93 y #99 eliminaron\nentero. Ese campo es lo que se publica en crates.io y en PyPI: es la portada,\nlo primero que lee quien evalúa la librería. Tres portadas \n[…]\n continuación, para que el porqué quede escrito antes que las ramas.\n\nVerificado: `verificar.py version`, `portada` y `local`, los tres en verde.\n\nCo-authored-by: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(portada): tres manifiestos seguían anunciando un canal borrado (#…",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-27T13:38:12Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "b140d134f355341e9b7aea689f44d532db933403",
          "body": "…a (#102)\n\nSe van a añadir características sobre este núcleo, así que hace falta saber que\naguanta REPETIDO, no que un caso funciona. Cinco simulaciones, 4 200 operaciones,\n26 segundos:\n\n  1 200 ciclos de ida y vuelta con tamaño y clave sorteados (0..2 KiB)\n    600 claves equivocadas que no pueden a\n[…]\ny solo desautentica la\ncabecera— para probar que ese banco mide lo que dice medir.\n\nsrc/api.rs quedó restaurado; el diff contra HEAD está limpio.\n\nCo-authored-by: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "test(simulacion): banco a escala del núcleo, antes de construir encim…",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-27T13:17:57Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "6566446598ec27434f3669518d33289bc95175cd",
          "body": "… lista decía (#101)\n\nEl CLAUDE.md decía «son DOCE archivos de versión», los enumeraba, y daba un\n`grep` para comprobarlos antes de etiquetar. Auditado hoy, tenía TRES agujeros,\ny los tres del mismo tipo: la defensa decía cosas que no eran.\n\n  1. El `grep` filtra por `--include=\"*.toml\"` y `Cargo.lo\n[…]\n y con el\norden de publicación completo (`quipu-nucleo` va PRIMERO y hoy bloquea), pero\nese archivo está en .gitignore y no viaja en este commit.\n\nCo-authored-by: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(release): la salvaguarda del error más repetido no veía lo que su…",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-27T12:57:22Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "d64c0fb8903d1045956e5f9f1b4c66a40f1ea1c1",
          "body": "…100)\n\nEl resumen ejecutivo decía «the library uses vetted primitives and contains no\nfirst-party `unsafe` code, so the focus of an audit would be the COMPOSITION»,\ny la sección 5 lo repetía. El detalle de la sección 1 sí acotaba —«first-party\n`src/`»— pero el resumen tiraba la salvedad.\n\n`bindings/\n[…]\ndo se midió, y\n    borrarla perdería el dato.\n\nVerificado: 93 es `grep -c \"unsafe\" bindings/c/src/lib.rs`; 0 en `src/` y en\ncada `crates/*/src/`.\n\nCo-authored-by: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs(preauditoria): apartaba al auditor del único sitio con unsafe (#…",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-27T12:48:11Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "8899474c4768c436b6078a12839535d052da0968",
          "body": "`encode_to_image`, `decode_from_image`, `encode_to_robust_image` y\n`decode_from_robust_image` ya no existen, ni el módulo `render` (retirado de\nquipu, quipu-cnsa y quipu-nucleo).\n\nNo es «código muerto»: corría y tenía sus propias pruebas. Se va por dos razones\ndistintas, y ninguna es esa.\n\nCUSTODIA.\n[…]\nprune` retiró las 12 exenciones huérfanas (164 -> 152 entradas). No\nrompían el CI, y por eso mismo se habrían quedado escondiendo a la siguiente.\n\nCo-authored-by: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "refactor!: fuera el canal PNG, y con él la dependencia `image` (#99)",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-27T12:38:31Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "59fc5cb9f159f6e166aa591b92be0ed61ff28c13",
          "body": "El chequeo de HEAD-contra-GET estaba clavado a `/healthz`. Contra un servicio\nque no tiene esa ruta, HEAD y GET devolvían 404 los dos, «coincidían», y la\nsonda se declaraba sana. Medido contra https://xiliux.com el 2026-07-27: decía\n«los monitores de disponibilidad no mienten» mientras `GET /` respo\n[…]\nllo nuevo es\n    real: «HEAD / NO coincide con GET  HEAD=405 vs GET=200».\n  - oprf.xiliux.com sigue en 9 comprobados · 0 fallidos, sin regresión.\n\nCo-authored-by: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(verificar): el auditor daba verde a una sonda que mentía (#98)",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-27T12:25:33Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "c71b17f1dac5050b1c77848ab7c9888947b3da91",
          "body": "… no operaba (#97)\n\nLa matriz de paridad entre bindings vivía escrita a mano en la lista de\npendientes y, al releerla una semana después, estaba mal en cuatro celdas: dos\nhuecos que ya no existían, uno que era una decisión deliberada apuntada como\nhueco, y uno real que no figuraba. Una matriz en pro\n[…]\n15 de Python contra la rueda instalada en venv\nlimpio, --all-features compila, clippy limpio. Las pruebas nuevas discriminan:\ncinco mutaciones inyectadas salieron rojas, cada una nombrando su binding.",
          "is_bot": false,
          "headline": "feat(bindings): el núcleo canónico se vuelve exigible, y fuera lo que…",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-27T12:06:54Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b7673412f9beee0bb918a611a4f065da9db13e8c",
          "body": "El campo `description` del Cargo.toml —el texto que se publica en crates.io— y el\ntitular del README decían «AES-256-GCM, HKDF-SHA-384 y ML-KEM-1024». Los tres\nprimeros están: Aes256Gcm en cipher.rs, Hkdf en kdf.rs, Sha384 en dictionary.rs.\nEl cuarto no aparece en ninguna parte del crate salvo en su\n[…]\nl CI: cargo test --workspace --all-targets (21\nbinarios, 255 pruebas, 0 en rojo) y cargo clippy --workspace --all-targets\n-D warnings (0 avisos).\n\nCo-authored-by: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(cnsa): el crate anunciaba ML-KEM-1024 y no lo implementa (#96)",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-27T05:22:07Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "f13966f4a1d2dede7e663ce9a67c8eb5f9849450",
          "body": "…nible (#95)\n\nREPLANTEAMIENTO PRIMERO. I6 —«el humano es parte del sistema»— nació justificado\nsobre la custodia en papel: alguien fotografía la hoja, alguien lee las palabras\npor teléfono. Ese canal se eliminó entero en el PR #93, así que la justificación\nse quedó sin sujeto. Un invariante defendid\n[…]\niseña.\n\nActualizados THREAT_MODEL.md (T8) y ATAQUES_TAXONOMIA.md (I6 y su justificación),\nque describían el escenario del canal que ya no existe.\n\nCo-authored-by: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(i6): cerrar no exige juzgar, y reabrir lo revocado no está dispo…",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-27T04:45:38Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "22239fd985e839858b04ead625ededaddbc0daf6",
          "body": "…ó (#94)\n\nI7 —«la superficie desplegada responde por sí misma»— era el único de los siete\ninvariantes sin ninguna herramienta, y cubre lo que está expuesto a internet\ncobrando suscripciones. La taxonomía lo añadió el 2026-07-26 al contrastarla con\ncasos reales: de los nueve capítulos de Hacking Étic\n[…]\nnarios, 250 pruebas, 0 en rojo) y cargo clippy --workspace --all-targets\n-D warnings (0 avisos). Banco propio del verificador: 41 comprobaciones.\n\nCo-authored-by: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(i7): auditar la superficie DESPLEGADA, y arreglar lo que encontr…",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-27T04:28:15Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "ca9a8742f809507d0dd6a8072590ecba9e01ca0c",
          "body": "BREAKING. Desaparecen encode_to_glyph_image, decode_from_glyph_image y\nhuella_del_portador; los módulos glyphfont, glyphopt y glyphscan; los enlaces de\nPython glyph_min_distance y select_separable; el codec por grupos que solo los\nalimentaba; los dos scripts de generación y la galería del README.\n\nP\n[…]\nerificado con los comandos del CI: cargo test --workspace --all-targets y\ncargo clippy --workspace --all-targets -- -D warnings, los dos en cero.\n\nCo-authored-by: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "refactor!: fuera el canal de glifos, entero (#93)",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-27T04:03:44Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "0f246b94188e4450f5c3683ecfb820df03829391",
          "body": "…o (#92)\n\nEl canal de glifos devolvía dos errores distintos: Container(TooShort) si no\nllegaba a leer los glifos, y Decrypt si el ECC no lograba corregir. Quien\nfabrica una hoja falsa aprendía así cuánto le faltaba para que fuera bien\nformada — un oráculo de CONSTRUCCIÓN, no de clave.\n\nImporta sobre\n[…]\nl CI: cargo test --workspace --all-targets\n(27 binarios, 291 pruebas, 0 en rojo) y cargo clippy --workspace --all-targets\n-D warnings (0 avisos).\n\nCo-authored-by: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(glifos): los errores del canal decían en qué capa falló el intent…",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-27T03:12:17Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "065f9e8af983bf6b9927123f54a971a28e8a055e",
          "body": "…tolerar 8 (#91)\n\n* fix(glifos): el canal analógico pasa de perderlo todo con un glifo a tolerar 8\n\nEl canal de glifos se anunciaba como analógico y no sobrevivía a nada que le\npase a una hoja. Medido antes de tocar nada:\n\n  ida y vuelta exacto        100 %\n  margen blanco de 20 px       0 %   <- si\n[…]\n la mañana.\n\n288 pruebas en verde con --workspace --all-targets. Clippy limpio.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(glifos): el canal analógico pasa de perderlo todo con un glifo a …",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-27T01:46:08Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "73027fa50873a4bc9ddd815575fe688cd693ccc2",
          "body": "…de seguridad desactualizados (#90)\n\n* chore: vaciar los alijos, y dos documentos de seguridad que se habían quedado atrás\n\nLimpieza de deuda acumulada. Nada de esto era visible desde `main`: vivía en\nalijos y en ramas que git marcaba como no mergeadas.\n\n=== 1. EL BINDING DE HONEY PARA PYTHON, QUE N\n[…]\n\nalgo se cumpla; una línea en .gitignore no depende de nadie (directiva 6).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: limpieza — alijos vaciados, 10 ramas muertas y dos documentos …",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-21T20:15:18Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "9ee679491d38be0d3cc6af2bdf682c242993a129",
          "body": "…n falso (#89)\n\nPreparando la publicación de `quipu-oprf-django` 0.1.1 salieron tres defectos.\nNinguno se veía leyendo el código: los tres aparecieron al CONSTRUIR el paquete\ne instalarlo en un entorno limpio.\n\n=== 1. LA CONSTRUCCIÓN FALLABA (PEP 639) ===\n\nEl clasificador «License :: OSI Approved ::\n[…]\n sdist.\n- Rueda instalada en venv limpio: expone `OprfArgon2PasswordHasher` y los 11\n  clasificadores sobreviven a los metadatos del artefacto.\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(django): el paquete no se podía construir y sus pruebas pasaban e…",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-21T18:10:32Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "fa795fd8e5f03ecc7bb0b845bc1383e9317f388c",
          "body": "…ificadores de PyPI (#88)\n\nDos huecos de descubribilidad, encontrados al preguntarse cómo llega alguien a\nesto desde fuera.\n\n=== 1. EL README NO MENCIONABA `quipu-nucleo` NI `quipu-cnsa` ===\n\nCero veces. Documentaba `crates/quipu-voprf` y `crates/quipu-oprf-server` y se\nquedó ahí; hoy el repositorio\n[…]\n.\n\n=== VERIFICADO ===\n\n`python3 herramientas/verificar.py local` — TODO VERIFICADO:\n267 pruebas, 2 doctests, clippy limpio, cargo-vet en verde.\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: el README describía un repositorio de hace dos versiones + clas…",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-21T17:23:06Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "1d60a63bac0cac7d0c7eaf5ff5c415684076712d",
          "body": "…(#87)\n\nLa librería hermana, construida SOBRE `quipu-nucleo` en lugar de copiando el\nrepositorio. Cifra y descifra: existe, compila y sus pruebas pasan.\n\n=== LO QUE DIVERGE, Y SE PRUEBA QUE DIVERGE ===\n\n              quipu                     quipu-cnsa\n  AEAD        XChaCha20-Poly1305        AES-25\n[…]\ngcm, cpubits, ctr, ghash, polyval):\nson la familia RustCrypto, la misma de chacha20poly1305 que ya se usa. Exentos\nen supply-chain/config.toml.\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(cnsa): quipu-cnsa, el perfil alineado con CNSA 2.0 (#92 paso 2) …",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-21T16:23:06Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "37458f86ab7cd497bcb841575d768b4c3b312052",
          "body": "…as (#86)\n\n* feat(herramientas): verificador de Quipu (primera versión, sin banco todavía)\n\nHerramienta propuesta por Juan: en vez de teclear los comandos de verificación\n—y equivocarme— se ejecuta una herramienta que se va puliendo. Un comando que\nhay que recordar es una directiva disfrazada; una h\n[…]\ns — entre ellas que\n`release.yml` no vuelva a repetir la lista de features.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(herramientas): verificador de publicación, con su banco de prueb…",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-21T15:41:08Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "a5ef4812687e19bb210357c11c3d5e5561040e2e",
          "body": "…a las ruedas (#85)\n\n* fix(lab): `lab-offline` no compilaba, ni aquí ni en el crate publicado\n\n`src/lab/timing.rs` desestructuraba `pqhybrid::generate_keypair()` y\n`encapsulate()` como si devolvieran tuplas. Desde el trabajo del RNG falible\ndevuelven `Result<_, SinEntropia>`. Cinco sitios.\n\n=== ALCA\n[…]\niona (directiva 18: comprobar el encuadre\nantes de imponer la restricción).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: lab-offline no compilaba + matriz de features + fuente única par…",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-21T15:21:56Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "130c60575f57efaaa513e65840bc80cf5cc25958",
          "body": "…92 paso 1) (#84)\n\n* refactor(nucleo): extraer el núcleo agnóstico de primitivas a su propio crate (#92)\n\nPrimer paso de #92. `quipu-cnsa` —la librería hermana comprometida con CNSA\n2.0— no puede nacer de copiar el repositorio: un fork sin frontera declarada se\npudre, y en criptografía se pudre con \n[…]\nl CI por primera vez pasan todas. Se comprobó ANTES\nde empujar, no después.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "refactor: extraer el núcleo agnóstico de primitivas a quipu-nucleo (#…",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-21T14:34:22Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "fc4bf0ab6e6351e8d31ab1b0571baa101e8194a8",
          "body": "* build(deps): subir las dependencias de cargo del servidor OPRF (#42, #79, #82)\n\nFusiona tres PR de dependabot que apuntan al mismo objetivo (directiva 13):\n\n- getrandom 0.2 -> 0.4 en quipu-oprf-server. El núcleo y quipu-voprf ya iban\n  por 0.4 desde 0.9.1; el servidor era el último 0.2 DIRECTO del\n[…]\nime Node 24 no toca la única parte\ndel CI que depende de una imagen fijada.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "build(deps): fusionar los 7 PR de dependabot en uno (directiva 13) (#83)",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-21T12:38:19Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "53b14d836b42ef667aee8e3c395331245c3368c6",
          "body": "Investigación para una versión futura (encargo de Juan): recorrer\nexhaustivamente los métodos de hacking de cifrado para crear herramientas de\nprotección y hallar factores COMUNES que permitan herramientas universales.\n\nDiez familias (criptoanálisis de la primitiva, canales laterales, fallo,\noráculo\n[…]\nancamiento (generaliza a I1+I4).\n\nEs el mapa, no la implementación. Ligado a #100 (las herramientas deben existir\nen todos los bindings) y #99.\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: taxonomía de ataques a cifrado y factores universales (#101) (#75)",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-21T11:28:32Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "a0f2938effdf1227951cd0efadcddd7fac70886d",
          "body": "La verificación post-publicación (instalar 0.9.0 de PyPI en limpio y buscar el\nsímbolo) destapó que la rueda 0.9.0 salió SIN CustodioHsm: release.yml la\nconstruía con `--features python,escrow`, mientras pyproject pedía además `hsm`.\nEl set de features estaba en DOS sitios y solo se actualizó uno. L\n[…]\n: tag v0.9.1 (reconstruye PyPI con hsm + npm), verificar\nla rueda instalando en limpio, publicar quipu 0.9.1 a crates.io, y yank de\nPyPI 0.9.0.\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "release: 0.9.1 — la rueda de PyPI ahora sí incluye la feature hsm (#76)",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-21T01:48:03Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "19638984e27317c8057ab190e7f1ed287d17f13e",
          "body": "… a publicar) (#74)\n\nLa auditoría interna antes del release destapó que las notas de 0.9.0 seguían\nbajo [Unreleased] → Planned, y con un dato ERRÓNEO (\"rand_core 0.9\" cuando fue\n0.10, toda la saga). Un release no puede etiquetarse así.\n\nSe escribe la sección [0.9.0] — 2026-07-20 con lo que la versió\n[…]\nnza a un receptor 0.9.0. Lo único que no funciona es cargar una\nclave nueva de 96 B en la lib vieja — esperado y documentado, no un bloqueador.\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs(changelog): finalizar la entrada 0.9.0 (auditoría interna previa…",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-21T00:09:57Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "e72782212ce7b6c4b02035ecff2d5e07b74e42c3",
          "body": "…#94) (#73)\n\nParte Quipu de #94. Añade al README lo que 0.9.0 trae de cara a quien compra:\n\n- **Fallo de entropía, no sustitución**: cuando el sistema no da aleatoriedad,\n  Quipu no cae a una fuente débil —ninguna clave nace de un RNG muerto—; informa\n  un error accionable en vez de un panic, y así \n[…]\n, Shamir, PKCS#11) y la mención al binding Python en la rueda.\n\nLa parte de portafolio (Xiliux) va aparte: ese repo se despliega a mano al VPS.\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs(readme): los dos argumentos de venta de 0.9.0 — entropía y HSM (…",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-20T23:21:55Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "838b2ea016dba13316c1b0ac56b50522d45ca165",
          "body": "…ntes (#72)\n\nCierra #98. El backend tenía 3 pruebas funcionales pero no la simulación que la\ndirectiva 8 exige antes de dar por terminado un mecanismo importante.\n\nDos pruebas nuevas en tests/hsm_pkcs11.rs (env-gated + feature hsm; el job de\nCI ya las recoge en fedora:43):\n\n- soak_directiva8_concurr\n[…]\no contra kryoptic: 5/5 pruebas, y el soak estable en 3 corridas\nseguidas (sin fragilidad por carrera sobre el sqlite del token). clippy limpio.\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "test(hsm): soak directiva 8 del backend PKCS#11 — 128 firmas concurre…",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-20T23:21:52Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "3839ee0552a521536f186a580f142d3782c694b7",
          "body": "* docs(ML): sección 4 — el distinguidor, con los números correctos (#97)\n\nCierra #97. El documento cerraba la investigación con tres «no aporta» pero le\nfaltaba la cuarta parte, que quedó partida entre dos ramas hasta que ambas\nmergearon. Y la frase «Distinguidores para el lab — sin medir, y es la s\n[…]\ntualizar el intro — cuatro sondas, y la del lab ya medida\n\nEl intro seguía diciendo «tres sondas» y «puede que sí en el laboratorio, y eso\nestá sin medir», incoherente con la sección 4 recién añadida.",
          "is_bot": false,
          "headline": "docs(ML): sección 4 — el distinguidor (#97) (#71)",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-20T23:11:05Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d0fca5d94e5a9fb15d3983f487af328cc689bd9c",
          "body": "Corta la versión 0.9.0 sobre main. NO incluye el tag: poner el tag es publicar,\ny eso va tras la auditoría (#93) y las simulaciones, con visto bueno aparte.\n\nLos doce archivos de versión del CLAUDE.md, subidos con cuidado —no un\nreemplazo global—: Cargo.toml, Cargo.lock (quipu + quipu-capi), binding\n[…]\n verde (158 exentos),\nárbol sin getrandom 0.2. El tag v0.9.0 y crates.io/PyPI quedan para la fase de\npublicación —voprf 0.2.2 ANTES que quipu—.\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "release: 0.9.0 (#70)",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-20T22:24:00Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "1fddfc11aebe5bcf10d8909286f8224ad6d00653",
          "body": "…ol (#69)\n\nquipu-voprf era la única dependencia que aún arrastraba getrandom 0.2.17 al\nárbol NORMAL de quipu (no dev). Medido antes: dos versiones en producción;\nahora `cargo tree -p quipu` solo muestra getrandom 0.4.3.\n\nLa API cambió: `getrandom::getrandom()` -> `getrandom::fill()`, en los dos\nsiti\n[…]\nitoría.\n\nVerificado: 7 pruebas de voprf en verde, cargo-vet en verde, árbol sin\ngetrandom 0.2. Cierra #95 y desbloquea el PR #42 de Dependabot.\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(voprf): subir getrandom a 0.4 — la última versión vieja del árb…",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-20T21:37:01Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "0e6e9799b46d0651b8e70f1ff5b2ec4920957810",
          "body": "… la raíz (#68)\n\nEl ancla /conversaciones solo cubre la raíz; una carpeta conversaciones/ se\nhabía colado en integrations/django/quipu_oprf_django/. Es la misma trampa que\nya documenta el CLAUDE.md (\"git add -A barrió 35 MB de conversaciones\"): ahora\nel patrón sin barra inicial la caza en subcarpetas también.\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(gitignore): ignorar conversaciones/ en cualquier nivel, no solo…",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-20T21:01:36Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "beaa77bcd44a18d7586986240268cb43aabf5645",
          "body": "…end PKCS#11 (#67)\n\n* feat(firmante): separar quién custodia la clave de cómo se arma la firma\n\nNúcleo de #30, con #35 dentro como su primer cliente. NO trae todavía el\nbackend PKCS#11: esto es la frontera sobre la que se apoya.\n\nEl trait `Custodio` pide OPERACIONES, nunca material. No hay\n`fn clave\n[…]\ns (#32)\na esta pieza, que ya es trabajo de ese proyecto, no de la librería.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(firmante): custodia de la clave de firma — trait Custodio + back…",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-20T21:01:20Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "e6f2a840a63b22067cd42569fbc34779932eae0e",
          "body": "… la rejilla (#63)\n\n* test(glifos): medir dónde se rompe el canal visual antes de arreglarlo\n\nLa tarea #26 daba por sentado que «una CNN pequeña supera a cualquier\nheurística» para leer una página impresa y fotografiada. Antes de aceptarlo hay\nque medir qué falla, porque puede que la heurística que \n[…]\nustez en papel\n  3. desenfocar el bitmap nativo — no es lo que hace una cámara\n\nLos tres los cazó una medición nueva, no una relectura. Vale más registrar el\npatrón que cualquiera de los tres números.",
          "is_bot": false,
          "headline": "test(glifos): cerrar la investigación de ML y arreglar el registro de…",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-20T19:57:51Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8a5c2dbe3f10c62c2dde3e0993e389c92ef96fca",
          "body": "…fuga (#66)\n\nLas dos pruebas del distinguidor que miden Quipu NO son reproducibles, aunque\nel PR #64 citara sus números como si lo fueran y `docs/ML.md` dijera «todas\ndeterministas». La semilla fija solo elige las contraseñas: la sal y el nonce\nsalen del sistema, así que cada corrida ve ciphertext n\n[…]\nras_frescas` (#[ignore], ~1,5 s)\ncomo instrumento permanente: si algún día la media se aleja de cero, hay que\nmirar el cifrador y no el umbral.\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(lab): el distinguidor sobre Quipu podía dar rojo sin que hubiera …",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-20T19:35:55Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "42f88be2288e321160d2551a2e932ea6a01ed554",
          "body": "…ben en bloque (#64)\n\n* feat!: el RNG informa en vez de entrar en pánico, y las primitivas suben en bloque\n\nBREAKING CHANGE: las funciones que necesitan aleatoriedad devuelven Result, y la\nclave secreta híbrida se serializa en 96 bytes en vez de 3200.\n\n=== LA PREMISA ESTABA INVERTIDA ===\n\nLa nota de\n[…]\n0/10), la integración en C, `go test ./...` y `npm test` (15 pass, 1 skip).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat!: el RNG informa en vez de entrar en pánico, y las primitivas su…",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-20T18:55:27Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "cd1cbb8c51368d5539081a8063d50827ae69574b",
          "body": "… plan (#62)\n\nEl servidor otorgaba `starter` 100 000 y `pro` 1 000 000 mientras la web vendía\n250 000 y 1 500 000. Un cliente de Starter habría recibido el 40 % de lo que\npagó, y como el SDK falla CERRADO, lo habría descubierto al chocar con el\nlímite real: con sus usuarios sin poder iniciar sesión.\n[…]\norta el cubo; y el endpoint publica exactamente lo que\nel servidor concede.\n\n153 pruebas del workspace en verde, clippy limpio con -D warnings.\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(oprf-server): conceder lo que se vende y escalar la ráfaga con el…",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-19T08:22:38Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "85f8ff177fc87a8ad8e198cea2d6bb88943d13e4",
          "body": "Sube la versión en los CINCO sitios de la lista de release —Cargo.toml,\npyproject.toml, bindings/c/Cargo.toml, bindings/node/package.json y\nsupply-chain/config.toml (la auto-exención de cargo-vet, que es la que se\nolvida)— y cierra el CHANGELOG con fecha.\n\nY SIETE MÁS que la lista no contemplaba, en\n[…]\n: contenedor simétrico, stream y firma generados\n  con quipu-crypto 0.7.0 REAL de PyPI se descifran y verifican con la nueva; y\n  `escrow` viaja dentro, comprobado llamando split/combine desde Python.",
          "is_bot": false,
          "headline": "release: 0.8.0 (#61)",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-18T20:32:02Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3c455fbc758240604ada65099d6a58bc81691f2f",
          "body": "… (#60)\n\nDos huecos del README, uno de posicionamiento y otro de omisión.\n\n1. LA SECCIÓN DE LICENCIA ERA CORRECTA PERO SECA. Una tabla y \"licencia\n   comercial para producto propietario cerrado\". No preemptaba la primera\n   objeción que hace cualquiera: \"¿por qué pago por software libre?\".\n\n   Se añ\n[…]\nmento con más aire, incluida la tabla de qué\nresuelve cada uno de los dos negocios (exención de publicar frente a no operar\nla infraestructura del OPRF).\n\nVerificado: clippy limpio, doctests en verde.",
          "is_bot": false,
          "headline": "docs: explicar qué se cobra exactamente, y documentar las autopruebas…",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-18T20:06:54Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6b00d63f000caed8cc8fb98c6ddf7b2bdf8197e2",
          "body": "…mercial (#55)\n\n* legal: declarar titularidad y publicar los términos de la licencia comercial\n\nQuipu se publicó bajo AGPL sin declarar en ninguna parte de quién es. El único\n\"Copyright\" del repo era el de la FSF sobre el texto de la licencia, no el del\ntitular sobre la obra; Cargo.toml no tenía `au\n[…]\nalcance de la exención —\n   que no es incumplir una prohibición, es ampararse en una exención que no\n   cubre ese acto.\n\nLICENSING.md alineado: es el documento que lee el público y decía lo mismo mal.",
          "is_bot": false,
          "headline": "legal: declarar titularidad y publicar los términos de la licencia co…",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-18T19:59:43Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "37f68621b12fdb9739e256dcbd59fa97743c0737",
          "body": "…rranque) (#59)\n\n* feat(shamir): compartición de secretos k-de-n para custodia de claves\n\nCierra el riesgo residual R2 del modelo de amenaza (\"perder la clave del\nservidor OPRF hace los secretos irrecuperables\"), cuya mitigación documentada\nera \"backup offline\": repartir la clave en k-de-n compartic\n[…]\nque la\ncabecera de dos del mismo reparto no comparte más bytes que la de dos ajenas.\n\nVerificado: 163 pruebas, 19 del módulo, clippy limpio con y sin features, 8\nvectores de formato en cable intactos.",
          "is_bot": false,
          "headline": "feat: endurecimiento del módulo para 0.8.0 (Shamir + autopruebas de a…",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-18T19:33:20Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "645f892c15bc3810aa016eb66d6184aa2aac8149",
          "body": "… post-cuántica (#58)\n\n* docs+lab: postura de canal lateral documentada y dudect sobre la ruta PQ\n\nSPEC.md §15 nueva. Dos hallazgos que merecen estar por escrito:\n\nXChaCha20-Poly1305 NO usa tablas de consulta. Es ARX, así que ningún acceso a\nmemoria depende de datos secretos y es constante en tiempo\n[…]\na un perfil conforme a CNSA si se construyera, que es justamente\n   por qué no sería una mejora automática.\n\nUna afirmación acotada que se sostiene entera vale más que una amplia que hay\nque defender.",
          "is_bot": false,
          "headline": "docs+lab: postura de canal lateral documentada y dudect sobre la ruta…",
          "author_name": "Juan Carlos Isaza",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-18T18:35:51Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "94df40b033e492b6c60b87202ea2f9a7a78f3b60",
          "body": "…2) (#54)\n\n* harden: overflow-checks+strip en release (Capa 5) y Zeroizing en pqhybrid (Capa 2)\n\nCapa 2 — higiene de secretos: pqhybrid::SecretKey::to_bytes() devolvía un\nVec<u8> plano, dejando la serialización de la clave secreta híbrida en RAM sin\nborrar. pqsign ya usaba Zeroizing; ahora pqhybrid \n[…]\nindgen no varía. Omisión mía: verifiqué python.rs y el core, no bindings/c.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "harden: overflow-checks+strip (Capa 5) y Zeroizing en pqhybrid (Capa …",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-18T05:38:34Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "78cc3c078eb853d9307feb0fc50874b248ef7ef6",
          "body": "… X-Wing (#53)\n\nEl pseudocódigo de la §7.2 (y la §7.3) del SPEC traía tamaños de ML-KEM-768\n(MLKEM768.Encaps, ct 1088, ek 1184, encapsulation 1120) — probablemente\ncopiados de una referencia de X-Wing, que sí es 768. La implementación y la\ntabla 7.1 usan ML-KEM-1024: ct 1568, ek 1568, encapsulation \n[…]\nque un lector asuma\ncompatibilidad de cable con draft-connolly-cfrg-xwing-kem.\n\nSolo documentación; no cambia el formato en cable ni el código.\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: corregir tamaños ML-KEM-1024 en SPEC y aclarar \"X-Wing style\" ≠…",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-18T05:28:15Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "9d7fbd53745976483d9f70c9b0be9396b6d3a664",
          "body": "… 0.13, ed25519 3, chacha 0.11, num-bigint 0.5) (#52)\n\n* build(deps): subir las primitivas acopladas (dalek 5, sha2 0.11, hkdf 0.13, ed25519 3, chacha 0.11, num-bigint 0.5)\n\nSustituye a los PRs #41, #35, #46, #38, #31 y #40 de dependabot. Van JUNTOS\nporque estan acoplados y NINGUNO compila solo:\n\n  \n[…]\n exemptions`, que es lo que este proyecto ya hace con el\nresto de su arbol.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "build(deps): subir las primitivas acopladas (dalek 5, sha2 0.11, hkdf…",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-17T06:19:09Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "30ca1e98445da70c0885accd81e8db063f45543e",
          "body": "Bumps [actions/setup-python](https://github.com/actions/setup-python) from 5 to 6.\n- [Release notes](https://github.com/actions/setup-python/releases)\n- [Commits](https://github.com/actions/setup-python/compare/v5...v6)\n\n---\nupdated-dependencies:\n- dependency-name: actions/setup-python\n  dependency-\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): Bump actions/setup-python from 5 to 6 (#34)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-17T06:04:59Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "0ad9a81a1e98973f1f68036b53b1c29a467fba62",
          "body": "Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4 to 8.\n- [Release notes](https://github.com/actions/download-artifact/releases)\n- [Commits](https://github.com/actions/download-artifact/compare/v4...v8)\n\n---\nupdated-dependencies:\n- dependency-name: actions/downlo\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): Bump actions/download-artifact from 4 to 8 (#36)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-17T05:33:52Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "fa5e19d7404caacc607ee2a938b0546c01e3078f",
          "body": "Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 7.\n- [Release notes](https://github.com/actions/upload-artifact/releases)\n- [Commits](https://github.com/actions/upload-artifact/compare/v4...v7)\n\n---\nupdated-dependencies:\n- dependency-name: actions/upload-artifac\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): Bump actions/upload-artifact from 4 to 7 (#37)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-17T05:33:49Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9b0cda67493afed1e0e9fcb077039891f2994f66",
          "body": "Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5 to 6.\n- [Release notes](https://github.com/actions/setup-go/releases)\n- [Commits](https://github.com/actions/setup-go/compare/v5...v6)\n\n---\nupdated-dependencies:\n- dependency-name: actions/setup-go\n  dependency-version: '6'\n  depen\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): Bump actions/setup-go from 5 to 6 (#32)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-17T05:33:45Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5513b167e3ceb4e296f94e6d7b70d681bb1cdd61",
          "body": "Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 7.\n- [Release notes](https://github.com/actions/checkout/releases)\n- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/actions/checkout/compare/v4...v7)\n\n---\nupdated-dependenc\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): Bump actions/checkout from 4 to 7 (#39)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-17T05:33:41Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f99fbf7c6595877d7cffa7d222f568ab4d246e73",
          "body": "Bumps the npm-minor group in /bindings/node with 1 update: [koffi](https://github.com/Koromix/koffi).\n\n\nUpdates `koffi` from 3.1.0 to 3.1.1\n- [Commits](https://github.com/Koromix/koffi/commits)\n\n---\nupdated-dependencies:\n- dependency-name: koffi\n  dependency-version: 3.1.1\n  dependency-type: direct:\n[…]\n: version-update:semver-patch\n  dependency-group: npm-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): Bump koffi in /bindings/node in the npm-minor group (#45)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-17T05:33:37Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "08dfeec282e37b3586903bbb8eeec4250c01c05a",
          "body": "Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.31.0 to 0.52.0.\n- [Commits](https://github.com/golang/crypto/compare/v0.31.0...v0.52.0)\n\n---\nupdated-dependencies:\n- dependency-name: golang.org/x/crypto\n  dependency-version: 0.52.0\n  dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "build(deps): Bump golang.org/x/crypto in /integrations/go (#47)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-17T05:28:37Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "58e906e159a04a02225adad9669c3caaf3070de9",
          "body": "El README no se toco en toda la migracion y decia tres cosas que ya no son\nciertas:\n\n1. \"AGPL-3.0-or-later para uso abierto\" a secas. Falso desde que existe\n   crates/quipu-voprf: NO todo el repo es AGPL, y lo que un cliente enlaza en su\n   servidor de auth es Apache-2.0. Es lo primero que mira el l\n[…]\ntas del repo estan. No queda ninguna\npromesa de VOPRF colgando de `pip install quipu-crypto`, que es la puerta con\nAGPL que acabamos de cerrar.\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs(readme): licencia real, RFC 9497 y el servicio OPRF (#51)",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-17T05:22:59Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "721b582873523fad33a5a254f1701cff90ec2b48",
          "body": "Habia dos puertas al mismo sitio y la de aqui era la equivocada.\n\n`quipu-voprf` (PyPI, Apache-2.0) existe justo para que un cliente del servicio\nOPRF no enlace el nucleo AGPL en su servidor de auth. Pero src/python.rs seguia\nexponiendo voprf_blind/voprf_finalize, asi que al publicar quipu-crypto 0.8\n[…]\nonstruyendo la rueda del nucleo e importandola: `quipu` ya no tiene\nvoprf_blind ni voprf_finalize, y encode/decode/generate_keypair siguen ahi.\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(python)!: no exponer VOPRF desde quipu-crypto (#50)",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-17T05:22:56Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "637aca8cfdd07c83df8ceba946f78a751ad18335",
          "body": "Tercer paquete, tercera cadencia:\n\n  v*        -> quipu-crypto       (nucleo, AGPL)\n  voprf-v*  -> quipu-voprf        (Apache-2.0)\n  django-v* -> quipu-oprf-django  (Apache-2.0)\n\nEl release.yml construia con maturin y por eso ni miraba a Django, que es Python\nPURO (setuptools): no hay Rust que compi\n[…]\ngo depende de\nquipu-voprf>=0.2.0, que YA esta en PyPI, asi que este paquete ya es publicable\nde verdad -- es el primero de la cadena que puede.\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "ci(release): publicar quipu-oprf-django en PyPI con su propio tag (#49)",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-17T04:57:52Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "840fb4df963d96cd13e2c480cd301b0e66b0a2b0",
          "body": "….1) (#48)\n\n* fix(voprf): declarar license-files para que PyPI acepte el sdist (0.2.1)\n\nLa 0.2.0 subio las 3 ruedas y murio en el sdist:\n\n  400 License-File LICENSE does not exist in distribution file\n      quipu_voprf-0.2.0.tar.gz at quipu_voprf-0.2.0/LICENSE\n\nmaturin escribia `License-File: LICENS\n[…]\nes,\ncargo vet --locked en verde, cbindgen sin diff, suite completa pasando.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(voprf): declarar license-files para que PyPI acepte el sdist (0.2…",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-17T04:38:29Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "644af2c6ae26e7a4d8730ec87ea645b34491d365",
          "body": "El glob `v*` TAMBIEN casa con `voprf-v0.2.0`: empieza por \"v\". Al empujar el\nprimer tag de quipu-voprf, npm-publish arranco e intento publicar el binding de\nNode, que no tiene nada que ver.\n\nSolo se salvo por suerte: package.json va por 0.7.0 y npm ya tiene 0.7.0, asi\nque el registro lo rechazo. Con\n[…]\nsto de workflows. Ahora `on:` excluye voprf-v* y el job de publish lo\ncomprueba otra vez, por si alguien lo lanza a mano desde un tag de voprf.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(ci): que un tag voprf-v* no dispare el publish de npm",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-17T04:09:51Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "8e9960296d85a3131c5a8d1943003e312545c562",
          "body": "Trae a main todo el trabajo del servicio VOPRF de pago:\n\n- quipu-oprf-server: el plano de datos, desplegado en oprf.xiliux.com.\n- crates/quipu-voprf (Apache-2.0): las primitivas que el cliente enlaza en su\n  servidor de auth. Separadas del nucleo AGPL a proposito -- etiquetar el SDK no\n  bastaba, po\n[…]\nidor si la omitias, lo que volvia\ndecorativa la prueba DLEQ. Ahora es obligatoria.\n\nPendiente: publicar (voprf-v0.2.0), el C ABI solo-VOPRF para desbloquear\nExpress y Go, y validar el flujo de PayPal.",
          "is_bot": false,
          "headline": "Merge: servicio OPRF completo, conforme a RFC 9497 y con SDK Apache-2.0",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-17T03:59:55Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c6115d9ec97d858974e66ebcd9dc926b00f4b30e",
          "body": "Se salta la 0.1.0 a proposito. Esa version nunca llego a PyPI: la construccion\npropia y la conforme a RFC 9497 convivieron dentro del mismo numero mientras se\ntrabajaba. Publicar una 0.1.0 cuyo README documenta una \"ruptura respecto de\n0.1.0\" obligaria a explicar esa rareza para siempre; saltarse el\n[…]\nzadas las tres referencias que se habrian quedado en 0.1.0: el Cargo.toml\ndel workspace, el pyproject de integrations/django y el propio crate.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(voprf): version 0.2.0 para la primera publicacion",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-17T03:57:33Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "079e5da1e8b8d239c3a0ed2923a4ed91843f3800",
          "body": "quipu-voprf se versiona aparte del nucleo y se publica aparte: sacar sus\nprimitivas no debe obligar a una version de quipu-crypto, ni al reves. Ademas\nun tag `v*` reconstruiria la version que diga el pyproject de la raiz -- hoy\n0.7.0, ya publicada -- y arrastrar eso solo para sacar otro paquete es p\n[…]\nas sdist. Sin eso la rueda queda atada a la glibc del runner y deja\nfuera a medio mundo -- y en PyPI una version no se re-sube, solo se retira.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "ci(release): publicar quipu-voprf en PyPI con su propio tag",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-17T03:53:47Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "b9191a4ee1b78ae69448258a6f272dc6f64ed430",
          "body": "…C 9497\n\nf84ef413... -> 88b623cc...\n\nLa misma semilla da otra clave porque ahora se deriva con DeriveKeyPair (RFC\n9497 §3.2) en vez del hash propio. La semilla NO se toco.\n\nVerificado contra el endpoint en vivo antes de escribirlo, no copiado de lo que\nreporto la consola del despliegue.\n\nSe hizo con\n[…]\n nota de ruptura: sin ella, un cambio de clave\npublica parece un error o una suplantacion, que es justo lo que el pinning\nexiste para detectar.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs(oprf): actualizar la clave publica tras migrar la instancia a RF…",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-17T03:22:17Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "bc14ff066cbe1fb330a9a2e8b7df30a90d0e068d",
          "body": "El codigo no necesitaba cambios: el C ABI escribe la longitud que devuelve\nfinalize y ambos bindings la leen de out_len, asi que ya daban 64 B. Lo que\nmentia era la documentacion, que seguia prometiendo 32.\n\nVerificado contra un servidor RFC real, los tres clientes dan el MISMO secreto\nbyte a byte (\n[…]\nra `go clean -cache`.\n\nEl prebuild linux-x64/libquipu_capi.so se regenero pero esta gitignorado, asi\nque quien clone y compile obtiene el suyo.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs(bindings)!: Node y Go devuelven 64 B tras la migracion a RFC 9497",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-17T02:03:06Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "fcba55df76542f4c5fe159ced709d3620f18589e",
          "body": "La construccion anterior decia \"estilo RFC 9497\" y era honesta al decirlo: NO\nera conforme. Dominio propio (quipu/v2/voprf), hash_to_curve con\nRistrettoPoint::hash_from_bytes y prefijo en vez de hash_to_ristretto255 con\nexpand_message_xmd, y transcripcion DLEQ propia. Consecuencias: no interoperaba\n\n[…]\nontra un servidor real -> 64 B.\n\nIgnora bindings/node/conversaciones/: son transcripciones con API keys dentro\nque se estaban colando al stage.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(voprf)!: implementar RFC 9497 y eliminar la construccion propia",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-17T01:57:29Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "e470c39405ceda4b2819e36942c70caed825cacc",
          "body": "Revierte la parte de propinas de #44 (Open Collective se queda fuera: OSC\nrechazo el fiscal host, y eso no cambia).\n\nQuipu vende licencia comercial y un SaaS a empresas. Un boton de 'invitame un\ncafe' al lado dice proyecto de fin de semana, un tipo solo -- y socava justo la\nseriedad que hace creible\n[…]\nradecia anadiendo un canal de propinas.\n\nGitHub Sponsors se queda: esta vivo, es 0% de comision y su diligencia es por\ncuenta, no por proyecto.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "revert(funding): quitar Buy Me a Coffee del boton Sponsor",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-17T01:24:52Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "a1c9056335c1eaa0bb464650eac769d254076c58",
          "body": "El SDK arrastraba la AGPL del nucleo al SaaS del cliente, y eso -- no el\ncodigo -- era lo que impedia vender el servicio OPRF: nadie enchufa un copyleft\nde red a su servidor de auth.\n\nPoner Apache al SDK y ya NO habria servido: la licencia de un envoltorio no\nrelicencia su dependencia. Habia que sep\n[…]\n es gratis; con uno, imposible. Documentado en el README\ndel crate.\n\nSuite completa en verde: 134 nucleo + 6 quipu-voprf + resto del workspace.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(licencia): separar quipu-voprf a un crate Apache-2.0",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-17T00:39:23Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "28294f34f8b2295fbba89a5d6208d4600def038a",
          "body": "Tercera integracion de la secuencia, tras Django y Express. Mismo diseno que\nExpress y por la misma razon: Go no trae autenticacion ni un registro de\nhashers donde engancharse, asi que oprfhash.Hash/Verify se llaman en registro\ny login. No es middleware -- endurecer ocurre en esos dos puntos, no en \n[…]\nte antes de publicar: bindings/go no tiene tag con VoprfBlind /\nVoprfFinalize (de ahi el `replace` en go.mod), y la licencia sigue sin decidir.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(integrations): endurecimiento OPRF de contrasenas para Go",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-16T22:57:54Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "242b4f67a1fbb66231f5c73fc450b7dd813efdfd",
          "body": "Segunda integracion de la secuencia, tras Django. Express no tiene punto de\nextension para hashers (no trae auth), asi que a diferencia del plugin de\nDjango esto no es invisible: es un hasher que llamas tu en signup y login. No\nes middleware a proposito -- endurecer ocurre en esos dos puntos, no en \n[…]\nnd /\nvoprfFinalize estan sin release), y la licencia sigue sin decidir -- la AGPL\ndel nucleo se propagaria a cualquier SaaS que instale el SDK.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(integrations): endurecimiento OPRF de contrasenas para Express",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-16T22:27:25Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "1407fc9661c812147eefbf1d493bf927ccefda42",
          "body": "Cambia una linea de PASSWORD_HASHERS y la tabla de usuarios deja de ser\ncrackeable offline: sin la clave del servidor OPRF, un volcado no permite\nderivar nada. Los usuarios existentes migran solos en su siguiente login\n(mecanica estandar de re-encode de Django).\n\nFalla CERRADO: si el servicio no res\n[…]\n\nNo publicable todavia: depende de voprf_blind/voprf_finalize, que no estan en\nquipu-crypto 0.7.0. Y la licencia esta sin decidir (ver README).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(integrations): endurecimiento OPRF de contrasenas para Django",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-16T17:24:33Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "fc81e03b662e4bd20372cea10e3d12365a5e0cb8",
          "body": "The DLEQ proof only binds the server to the public key the CLIENT pinned, so\nfetching it from /v1/public-key defeats verifiability. Publish it out-of-band.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs(oprf): publish beta instance endpoint + pinned public key",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-14T10:47:24Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "b2ab15e25e001a373cbdbb3298f800af8777886a",
          "body": "Add `quipu-oprf-server`, the deployable data-plane that exposes Quipu's\nVOPRF password-hardening as an authenticated, metered HTTP API, and port\nthe client flow to every binding.\n\nServer (crates/quipu-oprf-server, M1-M4):\n- SQLite store for customers/API keys/usage; keys stored as prefix +\n  SHA-256\n[…]\nd secret against a live server.\n\nBusiness phase: ships as beta; commercial GA waits for the external audit.\nSee docs/quipu-oprf-server-plan.md.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(oprf): add VOPRF hardening server + multi-language client",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-10T19:46:37Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "6f6911f4424be309f342b4fb46b1061cb8de516a",
          "body": "…ffee (#44)\n\nOpen Source Collective declined fiscal hosting (project too early-stage),\nso the open_collective slug would render a broken Sponsor link. Keep\nGitHub Sponsors (0% fee, no fiscal host) as the primary channel and add\nBuy Me a Coffee for low-friction tips. Revisit a fiscal host once there\nare active contributors or a corporate sponsor needs invoicing.\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(funding): drop Open Collective, keep Sponsors + add Buy Me a Co…",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-07T22:17:39Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "8a0ca1f9cd72024ca560a652d1d87315ddf3f511",
          "body": "The committed lockfile still self-reported 0.6.0 while package.json is\n0.7.0; npm rewrites it on install. Harmless to the published package\n(0.7.0 shipped fine) but keeps the repo in sync.\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(node): sync package-lock version to 0.7.0 (#43)",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-07T18:13:59Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "ce7aac411cfbb7fc5e411494056b8badbc8ed88f",
          "body": "Automated dependency + GitHub Actions updates for supply-chain hygiene.\nWhen actions/checkout ships a Node 24-native major, Dependabot will open\nthe bump PR automatically.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "ci: add Dependabot config (actions, cargo, npm, gomod)",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-07T16:48:58Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "6f7344fd1c1624d8133e7c5966e7c86116be7ac8",
          "body": "Keep the sponsorship-tier draft local like the other funding drafts\n(GRANT_NLNET.md, OTF_*). Not for the public repo.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: gitignore SPONSOR_TIERS.txt (internal funding draft)",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-07T16:36:43Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "6f17cff15905876c25361a43514b11f066b23c74",
          "body": "The release docs lagged the actual shipped state:\n\n- README: add \"Uso (Node.js)\" and \"Uso (Go)\" sections now that\n  quipu-crypto is live on npm (with prebuilds) and the Go module is\n  tagged. Refresh \"## Estado\": 106→207 Rust tests, 8→15 Python, and\n  note the C/Node/Go binding suites + streaming/ho\n[…]\nh live\n  outside the module, so a repo checkout + built staticlib is required.\n- SECURITY.md: correct the stale version string v0.1.0 → v0.7.0.\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: sync docs with v0.7.0 (npm publish, bindings, test counts) (#29)",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-07T16:31:35Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "4ff54440dad9417bf7813bee2c4bfd1549470a86",
          "body": "Enables the repo \"Sponsor\" button. Donations complement the primary\nrevenue (commercial license + VOPRF SaaS); tiers should favour corporate\nsponsorship over tips. open_collective slug `quipu` to be claimed with the\nOpen Source Collective fiscal host.\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: add FUNDING.yml (GitHub Sponsors + Open Collective) (#28)",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-06T23:04:59Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "5598e6e266dc76229207f3f4f7c8b361078d2e06",
          "body": "npm publish --provenance rejected the package with E422: the sigstore\nprovenance bundle records the source repo, and npm cross-checks it against\npackage.json `repository.url`, which was empty. Add the repository (with\n`directory: bindings/node` for the monorepo subpath), plus homepage/bugs.\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(npm): add repository metadata for provenance validation (#27)",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-06T22:44:15Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "69f3c9c4e0d2c5e6558775b4a7d2605a8f1a6f0d",
          "body": "npm OIDC trusted publishing cannot create a brand-new package (npm/cli\n#8544) — the npmjs.com UI needs the package to exist before a trusted\npublisher can be configured, so the initial publish returns a misleading\nE404 (\"could not be found or you do not have permission\"). Our OIDC\nhandshake itself w\n[…]\nit injected an empty _authToken line).\n\nOnce quipu-crypto exists on npm, delete NPM_TOKEN and all future releases\npublish token-free over OIDC.\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "ci(npm): hybrid token/OIDC publish to allow first-time bootstrap (#26)",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-06T22:00:05Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "8eed1f8b3cbfadf0862a9af272297714df6ff5fb",
          "body": "Intel macOS runners (macos-13) are scarce and repeatedly stalled the\nprebuild matrix in queue (2h40m+), blocking npm publish. Build the\ndarwin-x64 native lib by cross-compiling to x86_64-apple-darwin on the\narm64 macos-latest runner instead — Xcode's clang is a universal linker\nand quipu-capi is pur\n[…]\n with\n  rust_target=x86_64-apple-darwin; dtolnay/rust-toolchain adds the target;\n  the build step forwards --target/--arch only for cross rows.\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "ci(npm): cross-compile darwin-x64 prebuild on arm64 runner (#25)",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-06T21:43:54Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "e0affa589e1bc7997650d4972705ee25a08db87e",
          "body": "npmjs.com trusted publishing (OIDC) is now configured for quipu-crypto,\nso the token-gated publish path can never fire. Rewire the publish job:\n\n- Drop the `NPM_TOKEN` gate; auth comes from the OIDC id-token exchange.\n- Fix the job `if`: on workflow_dispatch github.ref is refs/heads/main, so\n  the p\n[…]\n\nKeeps `environment: npm` as the gate and the darwin-x64 prebuild on the\nIntel macos-13 runner (macos-14 is arm64 and would mislabel the arch).\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "ci(npm): switch to OIDC trusted publishing (no NPM_TOKEN) (#24)",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-06T21:30:24Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "cd865bcd06557724c5516d6de7242f3b5be3cd0b",
          "body": "Addresses a supply-chain review finding: the NPM_TOKEN must live behind a\nprotected environment so only vetted runs can publish. Combined with the\ngraceful skip, a missing token still no-ops rather than failing.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "ci(npm): scope publish token to a protected 'npm' environment",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-06T18:15:45Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "219237024fdee02bc0bddae2cea93bcb740de2d5",
          "body": "Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "ci(npm): skip publish gracefully when NPM_TOKEN is absent",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-06T18:12:07Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "622923ee00a29f302fa5f5cc4d052d4c6e9ea64d",
          "body": "chore(release): v0.7.0 — multi-language bindings",
          "is_bot": false,
          "headline": "Merge pull request #23 from isazajuancarlos/release/v0.7.0",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-06T18:09:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e0121ec1685e2f6c02b2a51ddaf1f0e716c1f478",
          "body": "Bumps quipu/quipu-capi to 0.7.0 (Cargo.toml, bindings/c, pyproject,\nCargo.lock, cargo-vet self-exemption, node package.json), moves the\nCHANGELOG [Unreleased] entries under [0.7.0], and adds an npm-publish\nworkflow that builds native prebuilds for Linux/macOS/Windows and\npublishes quipu-crypto on a v* tag.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(release): v0.7.0 — multi-language bindings + npm publish workflow",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-06T18:04:58Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "ba9926134a5b20a804a6111b4c62a081b1cb4fc5",
          "body": "feat(go): Go bindings over the C ABI (cgo)",
          "is_bot": false,
          "headline": "Merge pull request #22 from isazajuancarlos/feat/go-bindings",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-06T16:53:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a587b07f78c56b086deb5c58abb6c207a42e0b40",
          "body": "# Conflicts:\n#\t.github/workflows/ci.yml\n#\tCHANGELOG.md",
          "is_bot": false,
          "headline": "Merge remote-tracking branch 'origin/main' into feat/go-bindings",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-06T16:51:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ef8764a365e656bd515eab75f1677a2ed0678e45",
          "body": "feat(node): Node.js bindings over the C ABI (quipu-crypto)",
          "is_bot": false,
          "headline": "Merge pull request #21 from isazajuancarlos/feat/node-bindings",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-06T16:48:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "674caa69f9df984e5f57f9116945d0e4c00e343a",
          "body": null,
          "is_bot": false,
          "headline": "Merge remote-tracking branch 'origin/main' into feat/node-bindings",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-06T13:50:11Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "fa73ee16edb1d72b99e313f4147517ada646e616",
          "body": null,
          "is_bot": false,
          "headline": "Merge remote-tracking branch 'origin/main' into feat/go-bindings",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-06T13:45:48Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "de1511e5e0fe845c1c39910cf107a1871f4cf68b",
          "body": "feat(capi): stable C ABI bindings (quipu-capi)",
          "is_bot": false,
          "headline": "Merge pull request #20 from isazajuancarlos/feat/c-abi-bindings",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-06T12:48:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b28bdfd884e938e9e897292b3e458dc4a2038289",
          "body": "Adding a [workspace] table to the root manifest (for the C ABI binding)\nmade the cargo-fuzz crate believe it was a workspace member, breaking the\nnightly fuzz smoke CI job (\"believes it's in a workspace when it's not\").\nDeclare fuzz/ its own workspace root, the standard cargo-fuzz layout.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(fuzz): keep fuzz crate as standalone workspace",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-06T12:44:10Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "9a7ee059aaf43d74cf8ccc2c15f21bda79dba52d",
          "body": "Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "ci(go): Go bindings job + changelog",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-06T12:18:18Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "62bfab455fb6d646c28996c7fc5bbff5cc07594b",
          "body": "Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "test(go): cross-language interop vectors + README",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-06T12:10:32Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "14e04ca5c566cc8cae0f677575fc7eebcf32760e",
          "body": "Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(go): hybrid signature keypair/sign/verify",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-06T12:01:16Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "00c3faf3ecbd635e000fd28f541e2ea4003e072c",
          "body": "Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(go): post-quantum recipient keypair/encrypt/decrypt",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-06T11:54:08Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "bf9c9444560f115fb3bcec8d9df92a2313f5c7b7",
          "body": "Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(go): symmetric glyph codec Encode/Decode",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-05T23:52:08Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "84b0c42ac18003ce09a471ff906768ac96607d7c",
          "body": "Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(go): streaming AEAD encrypt/decrypt",
          "author_name": "isazajuancarlos",
          "author_login": "isazajuancarlos",
          "committed_at": "2026-07-05T23:46:55Z",
          "body_truncated": false,
          "is_coding_agent": true
        }
      ],
      "releases_count": 8,
      "commits_last_year": 211,
      "latest_release_at": "2026-07-21T02:41:11Z",
      "latest_release_tag": "v0.9.1",
      "releases_from_tags": false,
      "days_since_last_push": 0,
      "active_weeks_last_year": 4,
      "days_since_latest_release": 7,
      "mean_days_between_releases": 2.6
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": true,
      "health_percentage": 71,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "quipu",
          "exists": true,
          "license": "AGPL-3.0-or-later",
          "keywords": [
            "aead",
            "cryptography",
            "encoding",
            "oprf",
            "post-quantum",
            "cryptography"
          ],
          "ecosystem": "crates",
          "matches_repo": true,
          "registry_url": "https://crates.io/crates/quipu",
          "is_deprecated": false,
          "latest_version": "0.9.1",
          "repository_url": "https://github.com/isazajuancarlos/quipu",
          "versions_count": 10,
          "total_downloads": 310,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": 103,
          "first_published_at": "2026-07-01T15:31:59.527066Z",
          "latest_published_at": "2026-07-21T02:44:55.609523Z",
          "latest_version_yanked": false,
          "days_since_latest_publish": 7
        },
        {
          "name": "quipu-crypto",
          "exists": true,
          "license": "AGPL-3.0-or-later",
          "keywords": [
            "cryptography",
            "post-quantum",
            "encoding",
            "oprf",
            "aead",
            "Development Status :: 3 - Alpha",
            "License :: OSI Approved :: GNU Affero General Public License v3 or later (AGPLv3+)",
            "Operating System :: OS Independent",
            "Programming Language :: Python :: 3",
            "Programming Language :: Rust",
            "Topic :: Security :: Cryptography"
          ],
          "ecosystem": "pypi",
          "matches_repo": true,
          "registry_url": "https://pypi.org/project/quipu-crypto/",
          "is_deprecated": false,
          "latest_version": "0.9.1",
          "repository_url": "https://github.com/isazajuancarlos/quipu",
          "versions_count": 11,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": 2561,
          "first_published_at": "2026-07-01T16:28:36.597084Z",
          "latest_published_at": "2026-07-21T02:41:18.030070Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 7
        }
      ]
    },
    "popularity": {
      "forks": 0,
      "stars": 0,
      "watchers": 0,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 0
      },
      "star_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_stars": 0,
        "collected_at": null
      },
      "open_issues_and_prs": 1
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [
        "examples"
      ],
      "has_llms_txt": false,
      "has_dockerfile": true,
      "has_mcp_signal": false,
      "bootstrap_files": [],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [
        "Cargo.toml",
        "crates/quipu-cnsa/Cargo.toml",
        "crates/quipu-nucleo/Cargo.toml",
        "crates/quipu-oprf-server/Cargo.toml",
        "crates/quipu-voprf/Cargo.toml",
        "fuzz/Cargo.toml"
      ],
      "largest_source_bytes": 43424,
      "source_files_sampled": 92,
      "oversized_source_files": 0,
      "agent_instruction_files": [],
      "agent_instruction_max_bytes": null
    },
    "dependencies": {
      "manifests": [
        "Cargo.toml",
        "fuzz/Cargo.toml",
        "pyproject.toml"
      ],
      "advisories": {
        "error": null,
        "scope": "repository_graph",
        "source": "osv",
        "findings": [],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {},
        "advisory_count": 0,
        "affected_count": 0,
        "assessed_count": 151,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 24,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "crates",
        "pypi"
      ],
      "dependencies": [
        {
          "name": "cryptoki",
          "manifest": "Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.12"
        },
        {
          "name": "pyo3",
          "manifest": "Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.29"
        },
        {
          "name": "quipu-nucleo",
          "manifest": "Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.1.0"
        },
        {
          "name": "chacha20poly1305",
          "manifest": "Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.11"
        },
        {
          "name": "argon2",
          "manifest": "Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.5"
        },
        {
          "name": "hkdf",
          "manifest": "Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.13"
        },
        {
          "name": "sha2",
          "manifest": "Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.11"
        },
        {
          "name": "unicode-normalization",
          "manifest": "Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.1"
        },
        {
          "name": "getrandom",
          "manifest": "Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.4"
        },
        {
          "name": "zeroize",
          "manifest": "Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "1"
        },
        {
          "name": "subtle",
          "manifest": "Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "2"
        },
        {
          "name": "ml-kem",
          "manifest": "Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.3"
        },
        {
          "name": "ml-dsa",
          "manifest": "Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.1.1"
        },
        {
          "name": "ed25519-dalek",
          "manifest": "Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "3"
        },
        {
          "name": "x25519-dalek",
          "manifest": "Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "3"
        },
        {
          "name": "rand_core",
          "manifest": "Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.10"
        },
        {
          "name": "rand_chacha",
          "manifest": "Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.10"
        },
        {
          "name": "curve25519-dalek",
          "manifest": "Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "5"
        },
        {
          "name": "quipu-voprf",
          "manifest": "Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.2.2"
        },
        {
          "name": "fips205",
          "manifest": "Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.4.1"
        }
      ],
      "all_dependencies": {
        "error": null,
        "source": "github-sbom",
        "packages": [
          {
            "name": "argon2",
            "direct": true,
            "version": null,
            "ecosystem": "crates"
          },
          {
            "name": "argon2",
            "direct": true,
            "version": "0.5.3",
            "ecosystem": "crates"
          },
          {
            "name": "chacha20poly1305",
            "direct": true,
            "version": "0.11.0",
            "ecosystem": "crates"
          },
          {
            "name": "cryptoki",
            "direct": true,
            "version": "0.12.0",
            "ecosystem": "crates"
          },
          {
            "name": "curve25519-dalek",
            "direct": true,
            "version": null,
            "ecosystem": "crates"
          },
          {
            "name": "curve25519-dalek",
            "direct": true,
            "version": "5.0.0",
            "ecosystem": "crates"
          },
          {
            "name": "ed25519-dalek",
            "direct": true,
            "version": "3.0.0",
            "ecosystem": "crates"
          },
          {
            "name": "fips205",
            "direct": true,
            "version": "0.4.1",
            "ecosystem": "crates"
          },
          {
            "name": "getrandom",
            "direct": true,
            "version": null,
            "ecosystem": "crates"
          },
          {
            "name": "getrandom",
            "direct": true,
            "version": "0.2.17",
            "ecosystem": "crates"
          },
          {
            "name": "getrandom",
            "direct": true,
            "version": "0.3.4",
            "ecosystem": "crates"
          },
          {
            "name": "getrandom",
            "direct": true,
            "version": "0.4.3",
            "ecosystem": "crates"
          },
          {
            "name": "hkdf",
            "direct": true,
            "version": null,
            "ecosystem": "crates"
          },
          {
            "name": "hkdf",
            "direct": true,
            "version": "0.13.0",
            "ecosystem": "crates"
          },
          {
            "name": "ml-dsa",
            "direct": true,
            "version": "0.1.1",
            "ecosystem": "crates"
          },
          {
            "name": "ml-kem",
            "direct": true,
            "version": "0.3.2",
            "ecosystem": "crates"
          },
          {
            "name": "pyo3",
            "direct": true,
            "version": null,
            "ecosystem": "crates"
          },
          {
            "name": "pyo3",
            "direct": true,
            "version": "0.29.0",
            "ecosystem": "crates"
          },
          {
            "name": "quipu-nucleo",
            "direct": true,
            "version": null,
            "ecosystem": "crates"
          },
          {
            "name": "rand_chacha",
            "direct": true,
            "version": "0.10.0",
            "ecosystem": "crates"
          },
          {
            "name": "rand_chacha",
            "direct": true,
            "version": "0.9.0",
            "ecosystem": "crates"
          },
          {
            "name": "rand_core",
            "direct": true,
            "version": "0.10.1",
            "ecosystem": "crates"
          },
          {
            "name": "rand_core",
            "direct": true,
            "version": "0.6.4",
            "ecosystem": "crates"
          },
          {
            "name": "rand_core",
            "direct": true,
            "version": "0.9.5",
            "ecosystem": "crates"
          },
          {
            "name": "sha2",
            "direct": true,
            "version": null,
            "ecosystem": "crates"
          },
          {
            "name": "sha2",
            "direct": true,
            "version": "0.10.9",
            "ecosystem": "crates"
          },
          {
            "name": "sha2",
            "direct": true,
            "version": "0.11.0",
            "ecosystem": "crates"
          },
          {
            "name": "subtle",
            "direct": true,
            "version": null,
            "ecosystem": "crates"
          },
          {
            "name": "subtle",
            "direct": true,
            "version": "2.6.1",
            "ecosystem": "crates"
          },
          {
            "name": "unicode-normalization",
            "direct": true,
            "version": null,
            "ecosystem": "crates"
          },
          {
            "name": "unicode-normalization",
            "direct": true,
            "version": "0.1.25",
            "ecosystem": "crates"
          },
          {
            "name": "x25519-dalek",
            "direct": true,
            "version": "3.0.0",
            "ecosystem": "crates"
          },
          {
            "name": "zeroize",
            "direct": true,
            "version": null,
            "ecosystem": "crates"
          },
          {
            "name": "zeroize",
            "direct": true,
            "version": "1.9.0",
            "ecosystem": "crates"
          },
          {
            "name": "aead",
            "direct": false,
            "version": "0.6.1",
            "ecosystem": "crates"
          },
          {
            "name": "aes",
            "direct": false,
            "version": "0.9.1",
            "ecosystem": "crates"
          },
          {
            "name": "aes-gcm",
            "direct": false,
            "version": null,
            "ecosystem": "crates"
          },
          {
            "name": "aes-gcm",
            "direct": false,
            "version": "0.11.0",
            "ecosystem": "crates"
          },
          {
            "name": "ascii",
            "direct": false,
            "version": "1.1.0",
            "ecosystem": "crates"
          },
          {
            "name": "autocfg",
            "direct": false,
            "version": "1.5.1",
            "ecosystem": "crates"
          },
          {
            "name": "base64ct",
            "direct": false,
            "version": "1.8.3",
            "ecosystem": "crates"
          },
          {
            "name": "bit-set",
            "direct": false,
            "version": "0.8.0",
            "ecosystem": "crates"
          },
          {
            "name": "bit-vec",
            "direct": false,
            "version": "0.8.0",
            "ecosystem": "crates"
          },
          {
            "name": "bitflags",
            "direct": false,
            "version": "2.13.0",
            "ecosystem": "crates"
          },
          {
            "name": "blake2",
            "direct": false,
            "version": "0.10.6",
            "ecosystem": "crates"
          },
          {
            "name": "block-buffer",
            "direct": false,
            "version": "0.10.4",
            "ecosystem": "crates"
          },
          {
            "name": "block-buffer",
            "direct": false,
            "version": "0.12.1",
            "ecosystem": "crates"
          },
          {
            "name": "cc",
            "direct": false,
            "version": "1.2.66",
            "ecosystem": "crates"
          },
          {
            "name": "cfg-if",
            "direct": false,
            "version": "1.0.4",
            "ecosystem": "crates"
          },
          {
            "name": "chacha20",
            "direct": false,
            "version": "0.10.1",
            "ecosystem": "crates"
          },
          {
            "name": "chunked_transfer",
            "direct": false,
            "version": "1.5.0",
            "ecosystem": "crates"
          },
          {
            "name": "cipher",
            "direct": false,
            "version": "0.5.2",
            "ecosystem": "crates"
          },
          {
            "name": "cmov",
            "direct": false,
            "version": "0.5.4",
            "ecosystem": "crates"
          },
          {
            "name": "const-oid",
            "direct": false,
            "version": "0.10.2",
            "ecosystem": "crates"
          },
          {
            "name": "cpubits",
            "direct": false,
            "version": "0.1.1",
            "ecosystem": "crates"
          },
          {
            "name": "cpufeatures",
            "direct": false,
            "version": "0.2.17",
            "ecosystem": "crates"
          },
          {
            "name": "cpufeatures",
            "direct": false,
            "version": "0.3.0",
            "ecosystem": "crates"
          },
          {
            "name": "crypto-common",
            "direct": false,
            "version": "0.1.7",
            "ecosystem": "crates"
          },
          {
            "name": "crypto-common",
            "direct": false,
            "version": "0.2.2",
            "ecosystem": "crates"
          },
          {
            "name": "cryptoki-sys",
            "direct": false,
            "version": "0.5.0",
            "ecosystem": "crates"
          },
          {
            "name": "ctr",
            "direct": false,
            "version": "0.10.1",
            "ecosystem": "crates"
          },
          {
            "name": "ctutils",
            "direct": false,
            "version": "0.4.2",
            "ecosystem": "crates"
          },
          {
            "name": "curve25519-dalek-derive",
            "direct": false,
            "version": "0.1.1",
            "ecosystem": "crates"
          },
          {
            "name": "data-encoding",
            "direct": false,
            "version": "2.11.0",
            "ecosystem": "crates"
          },
          {
            "name": "der",
            "direct": false,
            "version": "0.8.0",
            "ecosystem": "crates"
          },
          {
            "name": "digest",
            "direct": false,
            "version": "0.10.7",
            "ecosystem": "crates"
          },
          {
            "name": "digest",
            "direct": false,
            "version": "0.11.3",
            "ecosystem": "crates"
          },
          {
            "name": "ed25519",
            "direct": false,
            "version": "3.0.0",
            "ecosystem": "crates"
          },
          {
            "name": "errno",
            "direct": false,
            "version": "0.3.14",
            "ecosystem": "crates"
          },
          {
            "name": "fallible-iterator",
            "direct": false,
            "version": "0.3.0",
            "ecosystem": "crates"
          },
          {
            "name": "fallible-streaming-iterator",
            "direct": false,
            "version": "0.1.9",
            "ecosystem": "crates"
          },
          {
            "name": "fastrand",
            "direct": false,
            "version": "2.4.1",
            "ecosystem": "crates"
          },
          {
            "name": "fiat-crypto",
            "direct": false,
            "version": "0.3.0",
            "ecosystem": "crates"
          },
          {
            "name": "find-msvc-tools",
            "direct": false,
            "version": "0.1.9",
            "ecosystem": "crates"
          },
          {
            "name": "fnv",
            "direct": false,
            "version": "1.0.7",
            "ecosystem": "crates"
          },
          {
            "name": "foldhash",
            "direct": false,
            "version": "0.2.0",
            "ecosystem": "crates"
          },
          {
            "name": "generic-array",
            "direct": false,
            "version": "0.14.7",
            "ecosystem": "crates"
          },
          {
            "name": "ghash",
            "direct": false,
            "version": "0.6.0",
            "ecosystem": "crates"
          },
          {
            "name": "hashbrown",
            "direct": false,
            "version": "0.17.1",
            "ecosystem": "crates"
          },
          {
            "name": "hashlink",
            "direct": false,
            "version": "0.12.1",
            "ecosystem": "crates"
          },
          {
            "name": "heck",
            "direct": false,
            "version": "0.5.0",
            "ecosystem": "crates"
          },
          {
            "name": "hmac",
            "direct": false,
            "version": "0.13.0",
            "ecosystem": "crates"
          },
          {
            "name": "httpdate",
            "direct": false,
            "version": "1.0.3",
            "ecosystem": "crates"
          },
          {
            "name": "hybrid-array",
            "direct": false,
            "version": "0.4.13",
            "ecosystem": "crates"
          },
          {
            "name": "inout",
            "direct": false,
            "version": "0.2.2",
            "ecosystem": "crates"
          },
          {
            "name": "itoa",
            "direct": false,
            "version": "1.0.18",
            "ecosystem": "crates"
          },
          {
            "name": "keccak",
            "direct": false,
            "version": "0.1.6",
            "ecosystem": "crates"
          },
          {
            "name": "keccak",
            "direct": false,
            "version": "0.2.0",
            "ecosystem": "crates"
          },
          {
            "name": "kem",
            "direct": false,
            "version": "0.3.0",
            "ecosystem": "crates"
          },
          {
            "name": "libc",
            "direct": false,
            "version": "0.2.186",
            "ecosystem": "crates"
          },
          {
            "name": "libfuzzer-sys",
            "direct": false,
            "version": null,
            "ecosystem": "crates"
          },
          {
            "name": "libloading",
            "direct": false,
            "version": "0.8.9",
            "ecosystem": "crates"
          },
          {
            "name": "libsqlite3-sys",
            "direct": false,
            "version": "0.38.1",
            "ecosystem": "crates"
          },
          {
            "name": "linux-raw-sys",
            "direct": false,
            "version": "0.12.1",
            "ecosystem": "crates"
          },
          {
            "name": "log",
            "direct": false,
            "version": "0.4.33",
            "ecosystem": "crates"
          },
          {
            "name": "memchr",
            "direct": false,
            "version": "2.8.2",
            "ecosystem": "crates"
          },
          {
            "name": "module-lattice",
            "direct": false,
            "version": "0.2.3",
            "ecosystem": "crates"
          },
          {
            "name": "num-bigint",
            "direct": false,
            "version": null,
            "ecosystem": "crates"
          },
          {
            "name": "num-bigint",
            "direct": false,
            "version": "0.5.1",
            "ecosystem": "crates"
          },
          {
            "name": "num-integer",
            "direct": false,
            "version": "0.1.46",
            "ecosystem": "crates"
          },
          {
            "name": "num-traits",
            "direct": false,
            "version": null,
            "ecosystem": "crates"
          },
          {
            "name": "num-traits",
            "direct": false,
            "version": "0.2.19",
            "ecosystem": "crates"
          },
          {
            "name": "once_cell",
            "direct": false,
            "version": "1.21.4",
            "ecosystem": "crates"
          },
          {
            "name": "password-hash",
            "direct": false,
            "version": "0.5.0",
            "ecosystem": "crates"
          },
          {
            "name": "pkcs8",
            "direct": false,
            "version": "0.11.0",
            "ecosystem": "crates"
          },
          {
            "name": "pkg-config",
            "direct": false,
            "version": "0.3.33",
            "ecosystem": "crates"
          },
          {
            "name": "poly1305",
            "direct": false,
            "version": "0.9.1",
            "ecosystem": "crates"
          },
          {
            "name": "polyval",
            "direct": false,
            "version": "0.7.3",
            "ecosystem": "crates"
          },
          {
            "name": "portable-atomic",
            "direct": false,
            "version": "1.13.1",
            "ecosystem": "crates"
          },
          {
            "name": "ppv-lite86",
            "direct": false,
            "version": "0.2.21",
            "ecosystem": "crates"
          },
          {
            "name": "proc-macro2",
            "direct": false,
            "version": "1.0.106",
            "ecosystem": "crates"
          },
          {
            "name": "proptest",
            "direct": false,
            "version": null,
            "ecosystem": "crates"
          },
          {
            "name": "proptest",
            "direct": false,
            "version": "1.11.0",
            "ecosystem": "crates"
          },
          {
            "name": "pyo3-build-config",
            "direct": false,
            "version": "0.29.0",
            "ecosystem": "crates"
          },
          {
            "name": "pyo3-ffi",
            "direct": false,
            "version": "0.29.0",
            "ecosystem": "crates"
          },
          {
            "name": "pyo3-macros",
            "direct": false,
            "version": "0.29.0",
            "ecosystem": "crates"
          },
          {
            "name": "pyo3-macros-backend",
            "direct": false,
            "version": "0.29.0",
            "ecosystem": "crates"
          },
          {
            "name": "quick-error",
            "direct": false,
            "version": "1.2.3",
            "ecosystem": "crates"
          },
          {
            "name": "quote",
            "direct": false,
            "version": "1.0.46",
            "ecosystem": "crates"
          },
          {
            "name": "r-efi",
            "direct": false,
            "version": "5.3.0",
            "ecosystem": "crates"
          },
          {
            "name": "r-efi",
            "direct": false,
            "version": "6.0.0",
            "ecosystem": "crates"
          },
          {
            "name": "rand",
            "direct": false,
            "version": "0.9.4",
            "ecosystem": "crates"
          },
          {
            "name": "rand_xorshift",
            "direct": false,
            "version": "0.4.0",
            "ecosystem": "crates"
          },
          {
            "name": "reed-solomon",
            "direct": false,
            "version": null,
            "ecosystem": "crates"
          },
          {
            "name": "reed-solomon",
            "direct": false,
            "version": "0.2.1",
            "ecosystem": "crates"
          },
          {
            "name": "regex-syntax",
            "direct": false,
            "version": "0.8.11",
            "ecosystem": "crates"
          },
          {
            "name": "rusqlite",
            "direct": false,
            "version": null,
            "ecosystem": "crates"
          },
          {
            "name": "rusqlite",
            "direct": false,
            "version": "0.40.1",
            "ecosystem": "crates"
          },
          {
            "name": "rustc_version",
            "direct": false,
            "version": "0.4.1",
            "ecosystem": "crates"
          },
          {
            "name": "rustix",
            "direct": false,
            "version": "1.1.4",
            "ecosystem": "crates"
          },
          {
            "name": "rusty-fork",
            "direct": false,
            "version": "0.3.1",
            "ecosystem": "crates"
          },
          {
            "name": "secrecy",
            "direct": false,
            "version": "0.10.3",
            "ecosystem": "crates"
          },
          {
            "name": "semver",
            "direct": false,
            "version": "1.0.28",
            "ecosystem": "crates"
          },
          {
            "name": "serde",
            "direct": false,
            "version": "1.0.228",
            "ecosystem": "crates"
          },
          {
            "name": "serde_core",
            "direct": false,
            "version": "1.0.228",
            "ecosystem": "crates"
          },
          {
            "name": "serde_derive",
            "direct": false,
            "version": "1.0.228",
            "ecosystem": "crates"
          },
          {
            "name": "serde_json",
            "direct": false,
            "version": "1.0.151",
            "ecosystem": "crates"
          },
          {
            "name": "sha3",
            "direct": false,
            "version": "0.10.9",
            "ecosystem": "crates"
          },
          {
            "name": "sha3",
            "direct": false,
            "version": "0.11.0",
            "ecosystem": "crates"
          },
          {
            "name": "shake",
            "direct": false,
            "version": "0.1.0",
            "ecosystem": "crates"
          },
          {
            "name": "shlex",
            "direct": false,
            "version": "2.0.1",
            "ecosystem": "crates"
          },
          {
            "name": "signature",
            "direct": false,
            "version": "3.0.0",
            "ecosystem": "crates"
          },
          {
            "name": "smallvec",
            "direct": false,
            "version": "1.15.2",
            "ecosystem": "crates"
          },
          {
            "name": "spki",
            "direct": false,
            "version": "0.8.0",
            "ecosystem": "crates"
          },
          {
            "name": "sponge-cursor",
            "direct": false,
            "version": "0.1.0",
            "ecosystem": "crates"
          },
          {
            "name": "syn",
            "direct": false,
            "version": "2.0.118",
            "ecosystem": "crates"
          },
          {
            "name": "target-lexicon",
            "direct": false,
            "version": "0.13.5",
            "ecosystem": "crates"
          },
          {
            "name": "tempfile",
            "direct": false,
            "version": "3.27.0",
            "ecosystem": "crates"
          },
          {
            "name": "tiny_http",
            "direct": false,
            "version": null,
            "ecosystem": "crates"
          },
          {
            "name": "tiny_http",
            "direct": false,
            "version": "0.12.0",
            "ecosystem": "crates"
          },
          {
            "name": "tinyvec",
            "direct": false,
            "version": "1.11.0",
            "ecosystem": "crates"
          },
          {
            "name": "tinyvec_macros",
            "direct": false,
            "version": "0.1.1",
            "ecosystem": "crates"
          },
          {
            "name": "typenum",
            "direct": false,
            "version": "1.20.1",
            "ecosystem": "crates"
          },
          {
            "name": "unarray",
            "direct": false,
            "version": "0.1.4",
            "ecosystem": "crates"
          },
          {
            "name": "unicode-ident",
            "direct": false,
            "version": "1.0.24",
            "ecosystem": "crates"
          },
          {
            "name": "universal-hash",
            "direct": false,
            "version": "0.6.1",
            "ecosystem": "crates"
          },
          {
            "name": "vcpkg",
            "direct": false,
            "version": "0.2.15",
            "ecosystem": "crates"
          },
          {
            "name": "version_check",
            "direct": false,
            "version": "0.9.5",
            "ecosystem": "crates"
          },
          {
            "name": "wait-timeout",
            "direct": false,
            "version": "0.2.1",
            "ecosystem": "crates"
          },
          {
            "name": "wasi",
            "direct": false,
            "version": "0.11.1+wasi-snapshot-preview1",
            "ecosystem": "crates"
          },
          {
            "name": "wasip2",
            "direct": false,
            "version": "1.0.4+wasi-0.2.12",
            "ecosystem": "crates"
          },
          {
            "name": "windows-link",
            "direct": false,
            "version": "0.2.1",
            "ecosystem": "crates"
          },
          {
            "name": "windows-sys",
            "direct": false,
            "version": "0.61.2",
            "ecosystem": "crates"
          },
          {
            "name": "wit-bindgen",
            "direct": false,
            "version": "0.57.1",
            "ecosystem": "crates"
          },
          {
            "name": "wycheproof",
            "direct": false,
            "version": "0.6.0",
            "ecosystem": "crates"
          },
          {
            "name": "zerocopy",
            "direct": false,
            "version": "0.8.52",
            "ecosystem": "crates"
          },
          {
            "name": "zerocopy-derive",
            "direct": false,
            "version": "0.8.52",
            "ecosystem": "crates"
          },
          {
            "name": "zeroize_derive",
            "direct": false,
            "version": "1.5.0",
            "ecosystem": "crates"
          },
          {
            "name": "zmij",
            "direct": false,
            "version": "1.0.21",
            "ecosystem": "crates"
          },
          {
            "name": "argon2-cffi",
            "direct": false,
            "version": null,
            "ecosystem": "pypi"
          },
          {
            "name": "django",
            "direct": false,
            "version": null,
            "ecosystem": "pypi"
          },
          {
            "name": "maturin",
            "direct": false,
            "version": null,
            "ecosystem": "pypi"
          },
          {
            "name": "pytest",
            "direct": false,
            "version": null,
            "ecosystem": "pypi"
          },
          {
            "name": "quipu-voprf",
            "direct": false,
            "version": null,
            "ecosystem": "pypi"
          },
          {
            "name": "setuptools",
            "direct": false,
            "version": null,
            "ecosystem": "pypi"
          }
        ],
        "collected": true,
        "truncated": false,
        "total_count": 175,
        "direct_count": 34,
        "indirect_count": 141
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 1,
        "merged_prs": 101,
        "open_issues": 0,
        "closed_ratio": null,
        "closed_issues": 0,
        "closed_unmerged_prs": 18
      },
      "bus_factor": 1,
      "bot_contributors": 1,
      "top_contributors": [
        {
          "type": "User",
          "login": "isazajuancarlos",
          "commits": 204,
          "avatar_url": "https://avatars.githubusercontent.com/u/54165021?v=4"
        }
      ],
      "contributors_sampled": 1,
      "top_contributor_share": 1
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "ci.yml",
        "release.yml"
      ],
      "has_docs_dir": true,
      "linter_configs": [],
      "has_editorconfig": false,
      "has_linter_config": false,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "Cargo.lock"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": null,
            "reason": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 10,
            "reason": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/30 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 3,
            "reason": "project has 1 contributing companies or organizations -- score normalized to 3",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 10,
            "reason": "update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 10,
            "reason": "project is fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 0,
            "reason": "project was created within the last 90 days. Please review its contents carefully",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": 10,
            "reason": "packaging workflow detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 0,
            "reason": "dependency not pinned by hash detected -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "SAST tool is not run on all commits -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 10,
            "reason": "security policy file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": 8,
            "reason": "5 out of the last 5 releases have a total of 5 signed artifacts.",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 10,
            "reason": "0 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "8d84b5002adf099b4ce0aa0d4e23152563a6f825",
        "ran_at": "2026-07-28T09:51:44Z",
        "aggregate_score": 6.1,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": true,
      "has_dependabot_config": true
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-28T06:24:29Z",
      "oldest_open_prs": [
        {
          "number": 118,
          "created_at": "2026-07-27T22:02:17Z",
          "last_comment_at": null,
          "last_comment_author": null
        }
      ],
      "last_merged_pr_at": "2026-07-27T23:54:41Z",
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": []
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/isazajuancarlos/quipu",
    "host": "github.com",
    "name": "quipu",
    "owner": "isazajuancarlos"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "moderate",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 62,
      "inputs": {
        "security": 69,
        "vitality": 73,
        "community": 39,
        "governance": 48,
        "engineering": 81
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "good",
        "name": "Vitality",
        "value": 73,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "moderate",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 57,
            "inputs": {
              "commits_last_year": 211,
              "human_commit_share": 0.93,
              "days_since_last_push": 0,
              "active_weeks_last_year": 4
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 0 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 0
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "4/52 weeks with commits",
                "points": 2.8,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 4
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "211 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 211
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": null,
            "notes": [],
            "value": 98,
            "inputs": {
              "releases_count": 8,
              "latest_release_tag": "v0.9.1",
              "releases_from_tags": false,
              "days_since_latest_release": 7,
              "mean_days_between_releases": 2.6
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "8 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 8
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 7 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 7
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~2.6 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 2.6
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "5 out of the last 5 releases have a total of 5 signed artifacts.",
                "points": 8,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "at_risk",
        "name": "Community & Adoption",
        "value": 39,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 1,
            "inputs": {
              "forks": 0,
              "stars": 0,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "0 stars",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "0 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "good",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 70,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": true,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (AGPL-3.0)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "AGPL-3.0"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 18,
                "status": "met",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          },
          {
            "key": "ecosystem_adoption",
            "band": "moderate",
            "name": "Ecosystem adoption (downloads)",
            "note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "registry_dependents"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 57,
            "inputs": {
              "packages": [
                "quipu",
                "quipu-crypto"
              ],
              "dependents": null,
              "ecosystems": "crates, pypi",
              "total_downloads": 310,
              "monthly_downloads": 2664
            },
            "components": [
              {
                "key": "monthly_downloads",
                "name": "Monthly downloads",
                "detail": "2,664 downloads/month across crates, pypi",
                "points": 45.7,
                "status": "partial",
                "details": [
                  {
                    "code": "downloads_monthly",
                    "params": {
                      "count": 2664,
                      "ecosystems": "crates, pypi"
                    }
                  }
                ],
                "max_points": 80
              },
              {
                "key": "registry_dependents",
                "name": "Registry dependents",
                "detail": "not reported by this ecosystem",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_reported_by_this_ecosystem",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "at_risk",
        "name": "Sustainability & Governance",
        "value": 48,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 13,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 1,
              "top_contributor_share": 1
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 100% of commits",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 100
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "1 contributors",
                "points": 1.4,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 1 contributing companies or organizations -- score normalized to 3",
                "points": 3,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "moderate",
            "name": "Issue & PR responsiveness",
            "note": "Excluded from scoring (no data or not applicable): Issue resolution. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "issue_resolution"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 61,
            "inputs": {
              "merged_prs": 101,
              "open_issues": 0,
              "closed_issues": 0,
              "issue_closed_ratio": null,
              "closed_unmerged_prs": 18
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "no issues or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_issues_or_data",
                    "params": {}
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "101/119 decided PRs merged",
                "points": 32.5,
                "status": "partial",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 101,
                      "decided": 119
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "at_risk",
            "name": "Ownership & stewardship",
            "note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "verified_domain"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 37,
            "inputs": {
              "followers": 0,
              "owner_type": "User",
              "is_verified": null,
              "owner_login": "isazajuancarlos",
              "public_repos": 10,
              "account_age_days": 2538
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "personal (user) account",
                "points": 10,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_personal",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": "not applicable to user accounts",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_applicable_to_user_accounts",
                    "params": {}
                  }
                ],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "0 followers of isazajuancarlos",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 0,
                      "login": "isazajuancarlos"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "10 public repos, account ~6 yr old",
                "points": 19.6,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 10
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 6
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "quipu",
                "quipu-crypto"
              ],
              "ecosystems": "crates, pypi",
              "any_deprecated": false,
              "min_days_since_publish": 7
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "2 package(s) on crates, pypi",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 2,
                      "ecosystems": "crates, pypi"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 7 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 7
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "11 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 11
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "good",
        "name": "Engineering Quality",
        "value": 81,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "moderate",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 68,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": false,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "2 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
                "points": 20,
                "status": "met",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "excellent",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "topics": [
                "agpl",
                "argon2",
                "cryptography",
                "encryption",
                "ml-dsa",
                "ml-kem",
                "post-quantum-cryptography",
                "rust",
                "voprf",
                "xchacha20"
              ],
              "has_wiki": true,
              "homepage": "https://crates.io/crates/quipu",
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": "https://crates.io/crates/quipu",
                "points": 15,
                "status": "met",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": "10 topics",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "topics_count",
                    "params": {
                      "count": 10
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "moderate",
        "name": "Security",
        "value": 69,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "moderate",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): Branch-Protection. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "branch_protection"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 61,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 17,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 1,
              "scorecard_aggregate": 6.1
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 1 contributing companies or organizations -- score normalized to 3",
                "points": 0.8,
                "status": "partial",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "update tool detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is fuzzed",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool is not run on all commits -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "5 out of the last 5 releases have a total of 5 signed artifacts.",
                "points": 6,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "0 existing vulnerabilities detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "excellent",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 151 resolved dependencies against OSV; 24 could not be assessed (no resolved version, an unsupported ecosystem, or beyond the reported package list). This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "indirect_dependencies_free_of_known_advisories",
                    "no_advisories_left_outstanding"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_repository",
                "params": {
                  "assessed": 151
                }
              },
              {
                "code": "advisories_unassessed",
                "params": {
                  "count": 24
                }
              },
              {
                "code": "advisories_repo_graph_caveat",
                "params": {}
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "source": "osv",
              "advisories": 0,
              "affected_packages": 0,
              "assessed_packages": 151,
              "unassessed_packages": 24,
              "affected_by_severity": "none",
              "direct_affected_packages": 0
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "no direct dependency carries a known advisory",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "no_direct_advisories",
                    "params": {}
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "transitive set not separable from development and test dependencies in this scope",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_scope_not_separable",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory carries a publication date",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_no_publication_date",
                    "params": {}
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 151,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "moderate",
        "name": "AI Readiness",
        "value": 63,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "at_risk",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 0.968,
              "agent_instruction_files": [],
              "agent_instruction_max_bytes": null
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "no CLAUDE.md / AGENTS.md / editor rules",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_instructions",
                    "params": {}
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "90 of 93 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 90,
                      "sampled": 93
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "good",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 74,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "Cargo.lock"
              ],
              "has_dockerfile": true,
              "typed_language": true,
              "bootstrap_files": [],
              "has_devcontainer": false,
              "has_linter_config": false,
              "typecheck_configs": [],
              "agent_commit_share": 0.77,
              "toolchain_manifests": [
                "Cargo.toml",
                "crates/quipu-cnsa/Cargo.toml",
                "crates/quipu-nucleo/Cargo.toml",
                "crates/quipu-oprf-server/Cargo.toml",
                "crates/quipu-voprf/Cargo.toml",
                "fuzz/Cargo.toml"
              ],
              "dependency_bot_commit_share": 0.07
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "Cargo.toml, crates/quipu-cnsa/Cargo.toml, crates/quipu-nucleo/Cargo.toml (toolchain convention, no task runner)",
                "points": 12.6,
                "status": "partial",
                "details": [
                  {
                    "code": "toolchain_convention",
                    "params": {
                      "files": "Cargo.toml, crates/quipu-cnsa/Cargo.toml, crates/quipu-nucleo/Cargo.toml"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "Rust (statically typed)",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Rust"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "Dockerfile, lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Dockerfile, lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "77 of the last 100 commits agent-authored or agent-credited",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "agent_authored_commits",
                    "params": {
                      "count": 77,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "7 of the last 100 commits are automated dependency updates",
                "points": 8,
                "status": "met",
                "details": [
                  {
                    "code": "dependency_bot_commits",
                    "params": {
                      "count": 7,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "Rust",
              "largest_source_bytes": 43424,
              "source_files_sampled": 92,
              "oversized_source_files": 0
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Rust (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Rust"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "0/92 source files over 60KB",
                "points": 55,
                "status": "met",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 92,
                      "oversized": 0
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "at_risk",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "example_dirs": [
                "examples"
              ],
              "has_mcp_signal": false,
              "api_schema_files": []
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": "examples",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "examples"
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [],
  "report_type": "repository",
  "generated_at": "2026-07-28T09:52:00.784422Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/i/isazajuancarlos/quipu.svg",
  "full_name": "isazajuancarlos/quipu",
  "license_state": "standard",
  "license_spdx": "AGPL-3.0"
}