kenn-io/kata erreicht einen Gesundheitsindex von 66 von 100 und liegt damit im Bereich Mittel. Am stärksten schneidet es bei Engineering Quality (82/100) ab, am schwächsten bei Community & Adoption (52/100). Zuletzt heute aktualisiert. Ein einzelner Mitwirkender trägt den Großteil der jüngsten Arbeit.
66
gesamt / 100
Mittel
Software-Gesundheitsindex
Metriken werden auf einer Skala von 1–100 in gewichtete Kategorien gruppiert. Der Gesamtwert beginnt als ihr Mittel; sobald öffentliche Evidenz die Richtlinie für Hochrisikojurisdiktionen auslöst, wird die Bewertung angepasst und erhält die Obergrenze 49 (Gefährdet). AI Readiness liegt außerhalb.
66
Exzellent85-100Vorbildlich; erfüllt im Wesentlichen alle geprüften Kriterien
Gut70-84Gesund; geringfügige Lücken
Mittel50-69Akzeptabel mit deutlichen Lücken; Überprüfung empfohlen
Gefährdet30-49Erhebliche Schwächen; eine Übernahme erfordert Vorsicht
Kritisch1-29Schwerwiegende Probleme (aufgegeben, nur ein Maintainer, keine Hygiene)
Bewertungsprofil
Jede Achse ist eine Kategorie. Die Form zählt mehr als der Durchschnitt — ein gesundes Projekt füllt die gesamte Fläche, während ein Profil aus Spitzen und Kratern bedeutet, dass Stärke in einer Dimension Risiken in einer anderen verdeckt.
Dieses Repository wird von einer Organisation getragen — geteilte, rechenschaftspflichtige Trägerschaft, die jeden einzelnen Maintainer überdauern kann.
Direkte Abhängigkeiten ohne bekannte Advisories — 1 betroffen: golang.org/x/text v0.38.0 (unknown)
0/25
Indirekte Abhängigkeiten ohne bekannte Advisories — transitive Menge in diesem Bereich nicht von Entwicklungs- und Test-Abhängigkeiten trennbar
40/40
Keine offenen Advisories — kein Advisory ist länger als 90 Tage öffentlich
Verwendete Eingangsdaten
source
osv
advisories
3
affected_packages
3
assessed_packages
138
unassessed_packages
0
affected_by_severity
unknown 3
direct_affected_packages
1
Von der Bewertung ausgeschlossen (keine Daten oder nicht anwendbar): Indirekte Abhängigkeiten ohne bekannte Advisories. Die verbleibenden Gewichte wurden renormalisiert. 138 aufgelöste Abhängigkeiten wurden mit OSV abgeglichen. Dieses Repository veröffentlicht kein Paket, das der Index auflöst; bewertet wurde daher der Abhängigkeitsgraph des Repositorys. Dieser Graph vermischt Entwicklungs- und Test-Pins mit ausgelieferten Abhängigkeiten, daher werden nur die deklarierten Laufzeit-Abhängigkeiten bewertet; transitive Befunde werden als Kontext ausgewiesen und fließen nicht in die Bewertung ein. Erreichbarkeit wird nicht analysiert.
Wie gut ist das Repository dafür ausgestattet, mit KI-Coding-Agenten entwickelt und gepflegt zu werden? Ein unabhängiges, experimentelles Badge — Gewicht 0,0, es wird eigenständig ausgewiesen und verändert den Gesamt-Gesundheitswert nicht.
Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
Weitere Details
Stern- und Fork-Verlauf 0 ★ / 24 ⇿
0Sterne
24Forks
7Releases
Wann jeder Stern und Fork hinzugefügt wurde, von GitHub erfasst und nach Tagen gruppiert. Das kumulierte Wachstum steht direkt über den täglichen Zugängen, aus denen es besteht, sodass beide gegeneinander lesbar sind: stetiger organischer Zuwachs sieht ganz anders aus als ein abrupter, kurzlebiger Ausschlag. Wo dieser Unterschied messbar ist, wird er als Wachstumsauthentizität ausgewiesen.
Major 0Minor 6Patch 1
OpenSSF Scorecard 4.5 / 10
4.5Gesamtwert
Unabhängige, werkzeugneutrale Sicherheitsbewertung durch das quelloffene OpenSSF Scorecard. Jede Prüfung honoriert eine Sicherheits-Praxis, nicht das Werkzeug eines bestimmten Anbieters. Prüfungen, die Scorecard nicht ermitteln konnte, sind mit k. A. markiert und vom Sicherheitswert ausgeschlossen (nie als null gezählt).Scorecard v5.5.0 · 2026-07-24 13:25 UTC
Vollständig aufgelöster Abhängigkeitssatz aus dem GitHub-Abhängigkeitsgraphen: 31 direkte und 107 indirekte (transitive) Pakete. Die transitive Hülle ist vollständig, wenn das Repository eine Lockfile eincheckt.
Dieses Repository veröffentlicht kein vom Index auflösbares Paket, daher wurde sein eigener Abhängigkeitsgraph bewertet – 138 Pakete, darunter auch Entwicklungs- und Test-Pins, die nie ausgeliefert werden: 3 tragen bekannte Advisories, davon 1 direkte.
Paket
Version
Beziehung
Schweregrad
Advisories
Behoben in
golang.org/x/text
v0.38.0
direkt
unbekannt
1
0.39.0
github.com/yuin/goldmark
v1.7.13
indirekt
unbekannt
1
1.7.17
golang.org/x/crypto
v0.53.0
indirekt
unbekannt
1
—
Ein Advisory bedeutet, dass die im Abhängigkeitsgraphen erfasste Version in den betroffenen Bereich eines Advisories fällt. Erreichbarkeit wird nicht analysiert, und der Graph enthält Entwicklungs- und Test-Pins — ein Fund kann das Werkzeug betreffen und nicht die ausgelieferte Software.
JSON-Rohbericht maschinenlesbar
{
"data": {
"repo": {
"topics": [],
"is_fork": false,
"size_kb": 5058,
"has_wiki": false,
"homepage": "https://www.katatracker.com",
"languages": {
"Go": 9119490,
"Shell": 49785,
"PLpgSQL": 33019,
"Makefile": 4654,
"Dockerfile": 490,
"PowerShell": 14333,
"Go Template": 18719
},
"pushed_at": "2026-07-23T16:00:47Z",
"created_at": "2026-04-30T01:44:15Z",
"owner_type": "Organization",
"updated_at": "2026-07-23T16:01:28Z",
"description": "Local-first issue tracking for AI-assisted software work, with an agent-friendly CLI and human-facing TUI",
"is_archived": false,
"is_disabled": false,
"license_spdx": "MIT",
"default_branch": "main",
"license_spdx_raw": "MIT",
"primary_language": "Go",
"significant_languages": [
"Go"
]
},
"owner": {
"blog": "https://kenn.io",
"name": "Kenn Software",
"type": "Organization",
"login": "kenn-io",
"company": null,
"location": null,
"followers": 133,
"avatar_url": "https://avatars.githubusercontent.com/u/259885253?v=4",
"created_at": "2026-02-06T14:36:48Z",
"is_verified": null,
"public_repos": 12,
"account_age_days": 167
},
"license": {
"state": "standard",
"spdx_id": "MIT",
"raw_spdx": "MIT",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v0.12.1",
"kind": "patch",
"published_at": "2026-07-21T21:08:47Z"
},
{
"tag": "v0.12.0",
"kind": "minor",
"published_at": "2026-07-21T01:49:16Z"
},
{
"tag": "v0.11.1",
"kind": "patch",
"published_at": "2026-07-19T13:06:48Z"
},
{
"tag": "v0.11.0",
"kind": "minor",
"published_at": "2026-07-19T00:41:28Z"
},
{
"tag": "v0.10.0",
"kind": "minor",
"published_at": "2026-07-12T15:21:13Z"
},
{
"tag": "v0.9.0",
"kind": "minor",
"published_at": "2026-07-09T14:42:47Z"
},
{
"tag": "v0.8.0",
"kind": "minor",
"published_at": "2026-07-04T22:17:28Z"
},
{
"tag": "v0.7.1",
"kind": "patch",
"published_at": "2026-06-29T18:36:22Z"
},
{
"tag": "v0.7.0",
"kind": "minor",
"published_at": "2026-06-29T17:59:13Z"
},
{
"tag": "v0.6.0",
"kind": "minor",
"published_at": "2026-06-24T20:12:07Z"
},
{
"tag": "v0.5.0",
"kind": "minor",
"published_at": "2026-06-23T01:15:31Z"
}
],
"recent_commits": [
{
"oid": "61a3d8c516e1dfde085938dc6c68ceedf20b0a40",
"body": "Federating a spoke currently requires an operator to coordinate enrollment and join steps or use the TUI for every project. This adds declarative `[[federation.project]]` mappings to `config.toml`, with a catalog hub, spoke and hub project names, and actor.\n\n```toml\n[[daemon]]\nname = \"team-hub\"\nurl \n[…]\n, configuration reference, and federation operations guide describe the resulting 0.7 contract; persisted database schemas are unchanged.\n\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Automate federation enrollment from daemon config (#202)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-07-23T16:00:45Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8f4b42df09ff81f2c15a678c99f89003d7e3b265",
"body": "Extends `kata init` so Codex CLI workspaces can participate in kata's\n`work.attention` lifecycle. The new `--with-codex-hooks` flag installs the\nCodex start hook while remaining independent from `--with-agents` and the\nexisting Claude Code `--with-hooks` option.\n\n## Behavior\n\n- Adds a `SessionStart`\n[…]\nrchestration guide, and changelog describe\nthe new flag and the native-start/launcher-end workflow.\n\nExtends #174 and advances #162.\n\n\nCo-authored-by: Matthew Jacobs <mjacobs@users.noreply.github.com>",
"is_bot": false,
"headline": "Add kata init --with-codex-hooks: Codex CLI attention-hook target (#191)",
"author_name": "Matthew Jacobs",
"author_login": "mjacobs",
"committed_at": "2026-07-23T14:51:30Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b7a5d77618ed07c39e27a9077faa72ffb6763d27",
"body": "Mounted services may need to recover after credential creation committed but the caller did not receive the result. The existing list API requires loading all retained enrollment history, so recovery cost grows with every revoked credential.\n\nThis adds a narrow, project-scoped lookup by the enrollme\n[…]\nreSQL query only active rows and return no plaintext secret or stored hash. The standalone HTTP surface and database schema are unchanged.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Add exact active federation enrollment lookup (#201)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-07-23T10:21:24Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "59a5ac8de6e5590cf5d9fcee023e8f3bd419b4ce",
"body": "Large federation ingest bodies are authenticated before decoding, but an embedding host still needs to bound how many authenticated uploads enter the shared process at once. Without a typed admission result, hosts must either duplicate Kata credential validation or report saturation as an unrelated \n[…]\nthorization, before the request body is read. Existing standalone and embedded behavior is unchanged unless a host returns the new signal.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Expose bounded federation ingest admission (#200)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-07-23T02:38:09Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "5ceaa265efd786e0d40d43d8c9790d57393af4d0",
"body": "Federation ingest accepts large event batches. Previously, an invalid bearer credential was rejected only after the HTTP framework had buffered and decoded the body, allowing unauthenticated requests to consume far more memory than authentication itself requires.\n\nThe raw HTTP boundary now performs \n[…]\nnal federation fence. This preserves the ordinary-host-then-federation order and gives revocation a deterministic ordering against ingest.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Authenticate federation ingest before body decoding (#199)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-07-22T23:23:57Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f660948bc6560579aac81e935cddbde5dd970604",
"body": "Mounted services may revoke the outside authority behind a Kata federation enrollment while the Kata credential itself is still valid. Kata's native token checks cannot observe that lifecycle, so mounts need a narrow way to deny an otherwise valid credential without replacing Kata authentication.\n\nT\n[…]\nreturned as bounded 403 or 503 responses without exposing host details. Standalone behavior is unchanged when no controller is configured.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Add host validation for federation credentials (#197)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-07-22T15:50:15Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "bff7552117bd325e73f4104fca28d7f565af47db",
"body": "The PostgreSQL 18 main-branch run completed every lease recovery and reconciliation step, but failed because one cycle took 360.7 ms against a hard 350 ms ceiling. That assertion measured shared-runner scheduling and database latency rather than the backoff-reset behavior it was intended to protect.\n[…]\nhe deterministic schedule check completed 1,000 consecutive runs, and the real PostgreSQL recovery scenario completed 10 consecutive runs.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Make reconciler lease recovery test deterministic (#198)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-07-22T15:31:25Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8e2dd5e22b4d130dad8e668659e96ae67a7ae1df",
"body": "Restricted embedding deliberately removes native federation-administration routes so the mounting application can own authorization and operator workflow. Until now, that also removed the only supported way to issue transport credentials, leaving embedders to reopen those routes or reach into Kata-o\n[…]\ne after archival, while archived projects cannot receive new credentials.\n\nThe standalone HTTP surface and persisted schema are unchanged.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Expose federation enrollment lifecycle to mounted services (#196)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-07-22T13:53:31Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "0c470cb35c3d9a0fe2a47c0c3cd1d6da2c9a360d",
"body": "…d token misrouting (#193)\n\n## Problem\r\n\r\n`.kata.local.toml` is a per-developer, gitignored file that can point the CLI's daemon `[server].url` at a remote daemon. The runtime never verified that the discovered file was actually untracked, so a hostile contributor could `git add -f .kata.local.toml`\n[…]\nthe reported hole at the source; a naive pin risked regressing the documented `.kata.local.toml` remote workflow, so it was deferred.\n\nCo-authored-by: Matthew Jacobs <mjacobs@users.noreply.github.com>",
"is_bot": false,
"headline": "Refuse git-tracked .kata.local.toml to prevent daemon-URL redirect an…",
"author_name": "Matthew Jacobs",
"author_login": "mjacobs",
"committed_at": "2026-07-21T20:04:37Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "d9675aeabad9b7217e29f2447f1194b22960180a",
"body": "Repeatable list and ready filters were accepted and emitted as repeated query parameters, but daemon decoding discarded every occurrence after the first. That made the documented AND and exclusion semantics unreliable, including through `next`, and affected repeatable digest actor selection built on\n[…]\n filters. This preserves values verbatim instead of joining them, which matters for metadata filters that may contain commas.\n\nCloses #189\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Honor repeated query filter values (#195)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-07-21T20:02:37Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b59924b0df27e4a85b66b45759268f6ad481c26b",
"body": "Applications that mount Kata inside a larger service often already own identity, authorization, and administrative lifecycle. Before this change, each host had to infer permissions from route names, and authorization happened only before dispatch. That made new routes easy to overlook and left a rac\n[…]\nck behavior, operation registration is checked for complete policy metadata, and the standard Go, lint, vet, and documentation gates pass.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Add restricted embedding policy and transaction fences (#194)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-07-21T13:24:30Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2dd6b91c0423032c75e1b051c2f1add4f55ee683",
"body": "v0.12.0 is published, but the public changelog still leaves the TUI work under Unreleased and has no entry for host-controlled access or project lifecycle APIs. That makes the release history incomplete for embedding hosts evaluating the new policy and provisioning boundaries.\n\nThis finalizes the ta\n[…]\ntion focused on the versioned release record.\n\nAfter merge, the production documentation still requires the normal manual deployment flow.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Finalize 0.12.0 release documentation (#192)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-07-21T11:44:49Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8e5f34cccb0f02cf30b651915177ba29004cbe9c",
"body": "Applications that embed Kata may already own user identity and project permissions. The existing choices—a shared bearer token or an all-or-nothing trusted-caller mode—do not let those applications authorize individual Kata operations safely. They also need a retry-safe way to provision projects wit\n[…]\ny. Existing bearer-token, trusted-caller, standalone daemon, SQLite, and PostgreSQL behavior is unchanged. This requires no schema change.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Add host-controlled access and project lifecycle APIs (#190)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-07-21T01:35:40Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "eda226377a6ae3d28acd2407f7c64b53958b5a01",
"body": "Routine TUI work was too easy to derail: terminal flow control could swallow the only save key, Esc could erase a draft, and live search required an extra focus-confirm step before navigation.\n\nThis makes Ctrl-O the canonical save/apply chord while retaining Ctrl-S compatibility, introduces reversib\n[…]\nthe TUI, with no API or persisted-schema changes. Command mode, configurable bindings, and comment editing remain separate follow-on work.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Make TUI input safer and easier to navigate (#188)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-07-20T11:23:34Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "0abb14f783ed25161714f552006120c16d3f73a4",
"body": "v0.11.1 is published, but the public changelog still stops at v0.11.0. Operators relying on managed PostgreSQL need the release history to make clear that pgvector is required only for semantic search; otherwise they may assume core task, federation, and lexical-search storage cannot run without ext\n[…]\nhe same contract and credits the contributor.\n\nAfter merge, the production documentation still requires the normal manual deployment flow.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Finalize 0.11.1 release documentation (#187)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-07-19T13:23:00Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "09a67437d96e137574fc41a34a753f38f9f49380",
"body": "PostgreSQL task and federation storage should not depend on an optional semantic-search extension. A database without pgvector—or a managed database that offers pgvector but does not allow the schema owner to install it—must still be able to start Kata.\n\nThis change keeps the core PostgreSQL schema \n[…]\nigration. Schema validation accepts either a complete vector schema or no vector schema and continues to reject partial or drifted state.\n\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Make pgvector optional for PostgreSQL storage (#186)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-07-19T13:05:31Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "fc38a46c068d91b2b4f2e9124e066a25735846c6",
"body": "v0.11.0 is published, but the changelog still classified the PostgreSQL work as unreleased and the public guide did not explain the new in-process Go service boundary. That left the release history incomplete and made the security and lifecycle responsibilities of embedded deployments difficult for \n[…]\nalone-daemon and mounted-service deployments.\n\nAfter merge, the production documentation still requires the normal manual deployment flow.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Finalize 0.11.0 release documentation (#185)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-07-19T01:35:13Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b02c627a60b4dbfa83465e1c836a69102235935f",
"body": "Configured remote daemons are pinged before every command, but that preflight request used a hard-coded one-second timeout independent of `KATA_HTTP_TIMEOUT`. Healthy WAN or reverse-proxied deployments could therefore be rejected as unavailable before the command reached its normally configured requ\n[…]\nreference now documents that tradeoff. Authentication failure diagnostics remain intentionally separate from this timeout fix.\n\nFixes #181\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Honor HTTP timeout for configured remote probes (#184)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-07-18T18:13:16Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e84864130822540cf68bd63af8e6cbd734a70fc8",
"body": "Kata currently exposes its application server only through internal packages and the standalone daemon. Go applications that want Kata in-process therefore have no supported lifecycle boundary and must either depend on internals or supervise a separate process.\n\nThis establishes the module root as t\n[…]\ncontract. The standalone daemon remains unchanged in this slice; it can adopt the same service boundary after the public contract settles.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Expose Kata as a mountable Go service (#183)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-07-17T21:48:29Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f7bb57f5359b011516009befa29b64c611f129a8",
"body": "Kata's PostgreSQL backend had schema groundwork but not a complete storage contract or safe production lifecycle. This PR makes PostgreSQL a supported shared-daemon backend while keeping SQLite as the default local store.\n\nWhat changes:\n\n- Completes `db.Storage` parity across issue, project, claim, \n[…]\nThat preserves a DML-only runtime role when models change dimensions; dimension-specific ANN tables remain a measured future optimization.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Complete PostgreSQL storage, operations, and semantic search (#182)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-07-17T13:50:54Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "277a0f06d7b3dcb1657b27c91a21b6dc3b30e318",
"body": "Embedding endpoints can return dimensionally valid output that is still unusable for cosine search, and the client accepted it silently: `encoding/json` leaves a `float32` untouched for a JSON `null`, so a null component became 0, and `normalize()` returned zero-norm vectors unchanged. Either way th\n[…]\nreaches kata with the next kit bump. Tracked as kata#astp.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-authored-by: Marius van Niekerk <mariusvniekerk@users.noreply.github.com>",
"is_bot": false,
"headline": "Reject null and zero-norm embedding vectors (#180)",
"author_name": "Marius van Niekerk",
"author_login": "mariusvniekerk",
"committed_at": "2026-07-14T20:01:13Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "0ab63479433ee820127b1d5ed0c4d746a631ac1f",
"body": "CLI docs deployments were inheriting the repository root, so unrelated source, generated output, and machine-local files could enter Vercel source manifests. This made deployment latency depend on repository growth and expanded the transfer boundary beyond the self-contained docs build.\n\nThis makes \n[…]\nfiguration has been aligned with this contract by disabling outside-root source inclusion and clearing the obsolete ignored-build command.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Limit Vercel docs deployment inputs (#179)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-07-12T19:19:42Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "02094d800e68b6f17a4f27a1d73d0e31ae07eed1",
"body": "Finalizes the public docs for the 0.10.0 release using the tagged changelog and verified pull-request authorship. It brings priority-aware work selection, list trees, daemon operations, federation convergence and recovery, embedding progress, agent hooks, and the shipped fixes into the release histo\n[…]\ny published on the dedicated docs-assets branch.\n\nAfter merge, the production documentation still needs the normal manual deployment flow.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Finalize 0.10.0 release documentation (#178)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-07-12T17:33:56Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "518635b571e09ec4003502bc2f7671fb3fd9e156",
"body": "Automation and integration consumers need a stable way to identify the kata binary without parsing human-readable output or requiring workspace or daemon access.\n\nThis adds the canonical `name: kata` identity to the existing versioned JSON envelope, documents the complete field contract and additive\n[…]\na version --json` form from an unbound directory with an unavailable configured server.\n\n<sup>generated by a clanker</sup>\n\nCo-authored-by: Marius van Niekerk <mariusvniekerk@users.noreply.github.com>",
"is_bot": false,
"headline": "Add stable JSON version identity (#177)",
"author_name": "Marius van Niekerk",
"author_login": "mariusvniekerk",
"committed_at": "2026-07-12T15:28:36Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "96d023505419ab00db965bd3ad5713b79f177960",
"body": "Supersedes the script half of #172 (whose commits this branch includes — the diff on top is the rework), responding to the review finding that a repo-committed hook script is a code-execution vector: Claude Code re-prompts when a settings.json hook *command* changes, but the command string `.claude/\n[…]\nvior that was previously verified by hand is now pinned by parser unit tests and live-daemon e2e tests fed real hook JSON over stdin.\n\nCo-authored-by: Matthew Jacobs <mjacobs@users.noreply.github.com>",
"is_bot": false,
"headline": "Move the attention hook into the kata binary (#174)",
"author_name": "Matthew Jacobs",
"author_login": "mjacobs",
"committed_at": "2026-07-12T03:05:02Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "fedcc173cb39b955ce6543c34c187262bdadf769",
"body": "Embedding health currently snapshots the pending count before a long fill and does not change it until the whole corpus finishes, making a healthy backfill look stalled.\n\nThis advances `backlog` and `embedded` after each task is successfully persisted, so health reflects the vector coverage already \n[…]\n generated Go client, and semantic-search documentation describe the new health fields.\n\n<sup>generated by a clanker</sup>\n\nCo-authored-by: Marius van Niekerk <mariusvniekerk@users.noreply.github.com>",
"is_bot": false,
"headline": "Report live embedding progress and ETA (#176)",
"author_name": "Marius van Niekerk",
"author_login": "mariusvniekerk",
"committed_at": "2026-07-11T17:35:30Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "10b0c4498997f6eeb785c45533ca70eb2777f137",
"body": "Routine daemon maintenance currently requires operators to compose stop and start themselves. That leaves a shutdown race and makes configuration-driven restarts unnecessarily awkward.\n\nRestart validates listener, authentication, storage backend, hooks, and embedding settings before stopping the cur\n[…]\n. Human status output shows the endpoint, PID, version, and uptime while the established JSON and agent status contracts remain unchanged.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Add daemon restart and improve status output (#175)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-07-11T12:13:49Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "36e82e18d913397fe5581d87fc42b062a6c0a5d2",
"body": "…#169)\n\nFixes #168.\n\n## Problem\n\nGitHub's REST API returns pagination `Link` headers whose `rel=\"next\"` URLs use the numeric `/repositories/{id}/...` form. The credential egress guard only allows `/repos/{owner}/{repo}/...` paths, so any repository with more than one page of issues or comments (>100\n[…]\ns, 534 comments), `rstudio/promises` (106 issues), and `rstudio/reactlog` (58 issues); v0.9.0 failed at page 2 on the first two.\n\n\nCo-authored-by: Barret Schloerke <schloerke@users.noreply.github.com>",
"is_bot": false,
"headline": "fix(githubsync): canonicalize numeric /repositories pagination URLs (…",
"author_name": "Barret Schloerke",
"author_login": "schloerke",
"committed_at": "2026-07-10T22:22:29Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "433e08e931a5e40cc5035ed7a823ceeec98febf2",
"body": "…#173)\n\nThe managed `<!-- BEGIN KATA … END KATA -->` block that `kata init --with-agents` writes covered ledger hygiene only. This adds a short, reference-grade `work.*` conventions section — claim/start marks `work.attention ok`, branch stamping, live stuck/needs-human signaling, and the never-stop\n[…]\n172 (the hook installer for the same conventions); textual overlap with #172 in `init.go`/docs is minor if they land in either order.\n\nCo-authored-by: Matthew Jacobs <mjacobs@users.noreply.github.com>",
"is_bot": false,
"headline": "Extend the init --with-agents managed block with work.* conventions (…",
"author_name": "Matthew Jacobs",
"author_login": "mjacobs",
"committed_at": "2026-07-10T22:18:11Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ac623768571d76090f0702d628fa2f5473c28e2a",
"body": "Adds a closing **Adopting in your repo** section to `docs/operations/agent-orchestration.md`: a copy-paste-ready `AGENTS.md`/`CLAUDE.md` snippet of the `work.*` contract covering the two situations (working a tracked issue; delegating fan-out/join with `kata wait`), plus a note that the same snippet\n[…]\nier in the chapter as the reliability floor (instructions produce tendency, not contract — the compliance gradient reported in #162).\n\nCo-authored-by: Matthew Jacobs <mjacobs@users.noreply.github.com>",
"is_bot": false,
"headline": "docs: add 'Adopting in your repo' section to agent-orchestration (#171)",
"author_name": "Matthew Jacobs",
"author_login": "mjacobs",
"committed_at": "2026-07-10T22:17:37Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c37bc63b40e98f7d011446e24277a5a8af1897c6",
"body": "A corrected hub cannot reconsider a batch that an older validator already quarantined because the spoke stops before making a network request. This PR makes those valid cross-project batches recover through the existing durable retry transition without editing event history or advancing a cursor ear\n[…]\nublic documentation. No database migration or compatibility storage path is introduced.\n\n<sup>generated by a clanker</sup>\n\nCo-authored-by: Marius van Niekerk <mariusvniekerk@users.noreply.github.com>",
"is_bot": false,
"headline": "Recover quarantined federation batches automatically (#170)",
"author_name": "Marius van Niekerk",
"author_login": "mariusvniekerk",
"committed_at": "2026-07-10T21:59:15Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1f0c4450286f14ef055940c429bcc9a620ad464f",
"body": "The existing instruction can be read as restricting the roborev CLI generally. Clarify that only the `roborev review` subcommand requires an explicit user request and encourage normal use of every other roborev CLI command; roborev skills remain opt-in.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "docs: clarify roborev review restriction (#167)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-07-10T15:03:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0825f966197d636dd9ce22bf1dd4c21d61f9166f",
"body": "Automated review runs can consume resources and create persistent review state even when review was not part of the requested task. Make both direct `roborev review` invocation and roborev skill activation explicitly user-directed so agents do not treat either as an automatic completion step.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "docs: require explicit roborev requests (#166)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-07-10T13:19:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cdade937f1135a957aea60323b896b40fed9f47f",
"body": "Closes the ready/list output parity gap from the human-output polish epic: `kata ready` rows now carry labels (and the other list-parity fields), so the shared row renderer can show `[epic]`/`[bug]` chips on ready output.\n\n- **Daemon**: `ReadyResponse` rows are hydrated `api.IssueOut` instead of bar\n[…]\nGlobalIssueOut`, `[]Issue` → `[]IssueOut`); accepted pre-1.0, same precedent as the earlier `ListIssuesResponse` move to `IssueOut`.\n\n\nCo-authored-by: Matthew Jacobs <mjacobs@users.noreply.github.com>",
"is_bot": false,
"headline": "Hydrate ready responses to IssueOut so ready rows carry labels (#160)",
"author_name": "Matthew Jacobs",
"author_login": "mjacobs",
"committed_at": "2026-07-10T13:06:22Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "62e693752fd7cfad976eca3fbc2d9ac0c020439c",
"body": "## Why\n\nFederation currently quarantines a valid batch whenever a link peer has not reached the hub yet. If two independently synchronized projects create cross-references in their first pending batches, each waits for an issue that only the other quarantined batch can create, permanently blocking b\n[…]\n, lint, API compatibility check, workflow validation, documentation checks, and push hooks passed on the committed branch.\n\nCo-authored-by: Marius van Niekerk <mariusvniekerk@users.noreply.github.com>",
"is_bot": false,
"headline": "Converge federated cross-project links (#164)",
"author_name": "Marius van Niekerk",
"author_login": "mariusvniekerk",
"committed_at": "2026-07-10T12:59:25Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "32118ebf0bd09ac46c81e951c7c2a5d0719b1c28",
"body": "Humans and agents currently have to fetch and interpret the entire ready queue merely to choose one actionable issue. This centralizes that decision in `kata next`: explicitly prioritized, unblocked work wins, numeric priority determines precedence, and the existing ready order breaks ties without c\n[…]\ntput, workflow, and embedded quickstart documentation now distinguish choosing one issue with `next` from inspecting a queue with `ready`.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Add priority-aware kata next command (#165)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-07-10T10:46:39Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "d5beb886bcc9370e1dffae7ac2f87bc05cffd94f",
"body": "## Summary\n\nFixes #159 (option 2, per the precedent survey there): duration flags keep the units-required grammar, but a bare number now fails with a suggestion of the seconds spelling instead of Go's stock parse error, and non-numeric input gets example spellings.\n\n```\n$ kata wait abc4 --timeout 18\n[…]\n reusable if you want them switched — happy to follow up either way.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\n\nCo-authored-by: Matthew Jacobs <mjacobs@users.noreply.github.com>",
"is_bot": false,
"headline": "Suggest the unit when a duration flag gets a bare number (#161)",
"author_name": "Matthew Jacobs",
"author_login": "mjacobs",
"committed_at": "2026-07-10T10:45:06Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "52e07e366cf2a0ac2c576405040db10b41b02b01",
"body": "…163)\n\nDirectly follows the human-mode output polish in #156, adding bd-style tree rendering to human-mode `kata list`: children indent beneath their parent with `├─` / `└─` connectors and `│` rail continuation for deeper nesting, building the parent→children index client-side from the parent peer t\n[…]\n list after: tree-rendered rows](https://raw.githubusercontent.com/mjacobs/kata/ad41429a2293ce23902ef5ddef647805f1a462ae/after.png)\n\n\n\nCo-authored-by: Matthew Jacobs <mjacobs@users.noreply.github.com>",
"is_bot": false,
"headline": "kata list: parent/child tree rendering with box-drawing connectors (#…",
"author_name": "Matthew Jacobs",
"author_login": "mjacobs",
"committed_at": "2026-07-10T10:44:41Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "12e56b4e4f7ff610a973c7eacb9d0e636c453794",
"body": "* Document 0.9.0 release\n\nFinalizes the public docs for the 0.9.0 release using the tagged source, provided changelog, and verified PR authorship. Without this pass, the release history would leave the metadata, wait, work orchestration, output polish, gzip, vector storage, and TUI updates stranded \n[…]\nepository checkout isolates each project and branch from stale paths owned by another workspace.\n\nThe cache directory is ignored so local analysis artifacts do not enter commits.\n\nGenerated with Codex",
"is_bot": false,
"headline": "Document 0.9.0 release (#158)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-07-09T15:00:37Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "902ff62ec6a7d69ae94f592c3caabbb8625d2991",
"body": "Replaces the v1 charm modules with charm.land/bubbletea/v2 v2.0.8, bubbles/v2 v2.1.1, lipgloss/v2 v2.0.5, glamour/v2 v2.0.1, and teatest/v2. This removes the v1-era out-of-band terminal probes: the boot-time lipgloss OSC background-color query is replaced by `tea.RequestBackgroundColor` flowing thro\n[…]\nrame restyle at startup; explicit `KATA_COLOR_MODE` values are unaffected.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Upgrade charm stack to v2 (bubbletea, bubbles, lipgloss, glamour) (#157)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-07-09T14:39:47Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "de19d256e5d9974c89ca9e5cf0193b1d22c7359e",
"body": "…footer (#156)\n\nPolishes the human-mode output of `kata list` and `kata ready` with status\nglyphs, colored priority chips, label tags, and a summary footer — closes the\ngap with comparable issue-tracker CLIs. Implements `kata#4ymf` (child of epic\n`kata#mdq8`).\n\n## Before / after\n\n| `kata list --stat\n[…]\nlink peers.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nhttps://claude.ai/code/session_01HCgmCKRYa89PLe8ywWznU3\n\n\nCo-authored-by: Matthew Jacobs <mjacobs@users.noreply.github.com>",
"is_bot": false,
"headline": "Polish human-mode list/ready output: glyphs, priority chips, summary …",
"author_name": "Matthew Jacobs",
"author_login": "mjacobs",
"committed_at": "2026-07-09T01:40:59Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e6cdab7366efa02c38a1de65dcaa5a53f5919e4f",
"body": "Replaces kata's in-house vector embedding management (single-vector-per-issue BLOB storage in `issue_embeddings`, brute-force cosine search with an in-memory cache, hand-rolled fingerprint and reconcile loop) with `go.kenn.io/kit/vector` + `go.kenn.io/kit/vector/sqlitevec` at tagged v0.3.0, the shar\n[…]\ntn/go-sqlite3` v1.14.47 (cgo builds only).\n\nTracked as kata issue `8cqc`.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Adopt kit's vector layer for semantic search storage (#155)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-07-08T19:48:47Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "645442e5aa7edbe796013f7dd2a86f0a6d4dc0a1",
"body": "…tions, kata wait (#153)\n\n## Summary\n\nBuilds the branch-orchestration primitives sketched in #150 — Layer 0, Layer 1, and the `kata wait` fan-out/join primitive. Three adjustments I proposed in our Discord discussion are folded into the design doc in this branch (the doc commit from #150 is included\n[…]\ndiff form. Leaving #150 open for you to close or land as you prefer.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\n\nCo-authored-by: Matthew Jacobs <mjacobs@users.noreply.github.com>",
"is_bot": false,
"headline": "Add branch-orchestration primitives: metadata plumbing, work.* conven…",
"author_name": "Matthew Jacobs",
"author_login": "mjacobs",
"committed_at": "2026-07-08T14:34:47Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "a86a9f3cbfaac42a61011549a0b44bc372dd3f15",
"body": "The daemon now compresses responses with gzip when the client sends `Accept-Encoding: gzip`. Compression is limited to the JSON API surface and the OpenAPI YAML document; `text/event-stream` is excluded so SSE frames keep flushing to the client unbuffered, and responses under the minimum-size thresh\n[…]\ner` passthrough, which the events handler requires.\n\nTracked as kata#5vdd.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Add gzip response compression to daemon HTTP API (#154)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-07-07T19:57:43Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "d3ca1cfd0362ecaadc587a9be5019dc38b5374a0",
"body": "Release operators currently have to review agent-generated notes that can arrive as a flat list, and the fallback path always uses a generic Changes section. That makes the release gate less predictable at the moment they decide whether to create a tag.\n\nThis PR gives both the agent prompt and fallb\n[…]\nmmands against temporary repositories and keeps the agent test at the command boundary rather than asserting script source or prompt text.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Improve release changelog output (#152)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-07-04T22:39:02Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "cc54ee3df21d0de1d24e27c78ff71519765759e1",
"body": "Finalizes the public docs for the 0.8.0 release using the tagged source and commit history. The release adds a reachable issue graph API, name-only daemon project creation, and testing guidance for behavior-based validation; without this pass the public release history and reference docs would stop \n[…]\nnse semantics clients need to render relationships consistently. After merge, the docs site still needs the normal manual deployment flow.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Document 0.8.0 release (#151)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-07-04T22:38:08Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "5852aa226c7ab639f17fab13812f6e20ce5a40f5",
"body": "Middleman currently has to reconstruct canonical kata relationship semantics in frontend TypeScript before it can render the reachable graph. That puts backend concerns like relationship direction, reciprocal dedupe, missing endpoint preservation, stable ordering, and layout-only transitive block pr\n[…]\nuffle=on ./internal/api ./internal/daemon`; `make lint`; push hooks also ran `make api-check`, `make lint`, and `nilaway`.\n\nCo-authored-by: Marius van Niekerk <mariusvniekerk@users.noreply.github.com>",
"is_bot": false,
"headline": "Add reachable issue graph API (#147)",
"author_name": "Marius van Niekerk",
"author_login": "mariusvniekerk",
"committed_at": "2026-07-04T14:48:33Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "cac5fdd550ea620cab4a6b6e6f7f1a93bc4d301d",
"body": "Agents working in this repo write and modify tests constantly, and the recurring failure mode is tests that cannot fail for any real reason: mirror assertions that recompute expected values with production logic, goldens regenerated to silence failures, fakes of layers the repo already provides real\n[…]\n runtime surface. Pre-push hooks (api-check, lint) passed.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-authored-by: Marius van Niekerk <mariusvniekerk@users.noreply.github.com>",
"is_bot": false,
"headline": "Add testing-without-tautologies skill (#149)",
"author_name": "Marius van Niekerk",
"author_login": "mariusvniekerk",
"committed_at": "2026-07-03T15:46:59Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "02b671cce7c3fa1b13150e94175fcd32fe909a92",
"body": "kata projects currently lets users create a project only as a side effect of `kata init`, which assumes there is a workspace binding to write. That is limiting for daemon projects that are not tied one-to-one with repositories or local checkout paths.\n\nThis adds `kata projects create <name>` as an i\n[…]\n introducing a second creation path. The docs now call out the distinction between creating a daemon project and initializing a workspace.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Add name-only project creation command (#148)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-07-01T02:02:57Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "fd3d8cb745c6d6e5058a7f3b1be02b46f969105e",
"body": "Release operators could see generated notes appear without any indication that the script had invoked an external changelog agent. That made the default Codex path opaque at the point where the operator needs to decide whether to trust and accept the preview.\n\nDescribe the release sequence before ch\n[…]\ne any tag is created.\n\nValidation: manual dry-run with a fake codex command confirmed the Codex handoff is described before the preview.\n\nGenerated with Codex\n\nCo-authored-by: Codex <codex@openai.com>",
"is_bot": false,
"headline": "Explain release script agent handoff (#144)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-06-29T18:34:48Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8892395422083335cdd9c081c3ff0878795e5aa5",
"body": "* Document 0.7.0 release\n\nThe 0.7.0 tag has shipped, so the public docs need to describe the release state instead of leaving the release history at 0.6.0. The changelog now captures the feature, reliability, and release-maintenance work that landed after 0.6.0, with wording checked against the fina\n[…]\ned features. Adding the acknowledgement keeps the public release notes aligned with the actual authorship metadata without inventing identities beyond the recorded GitHub handle.\n\nGenerated with Codex",
"is_bot": false,
"headline": "Document 0.7.0 release (#145)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-06-29T18:34:33Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "6c5a8ebfb1bb31d55b4bc0a2ad91e4bb9558d761",
"body": "Shared CI and NAT egress can exhaust unauthenticated GitHub API quota, and kit's self-update client only authenticates its API fallback when callers pass a token. Kata already depends on the kit version with web-first discovery, so the remaining parity gap is forwarding the standard GH_TOKEN/GITHUB_\n[…]\nshared client.\n\nThis keeps tokenless behavior unchanged while allowing hosted or CI update checks to use authenticated fallback discovery if web release discovery is unavailable.\n\nGenerated with Codex",
"is_bot": false,
"headline": "Wire updater GitHub token fallback (#146)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-06-29T18:34:09Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "252b815f9bed806a821e82b14ef09431244bde18",
"body": "… (#139)\n\n## Summary\n\n- Adds daemon-side GitHub sync credentials for shared deployments: exact `(host, owner)` GitHub App entries, a host-scoped explicit token environment variable, then `gh auth token --hostname <host>` as the local fallback.\n- Replaces command-backed repository reads with a scoped\n[…]\nwritable GitHub sync or broad sync-mode policy. Local kata parent links still win when they conflict with a GitHub-sourced parent insert.\n\n\nCo-authored-by: andy-vdg <andy-vdg@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(githubsync): add scoped service credentials and parent-link sync…",
"author_name": "andy-vdg",
"author_login": "andy-vdg",
"committed_at": "2026-06-29T12:12:25Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "fcbe590b492fabc606ad1311f37aed85a57094a4",
"body": "Adds opt-in hybrid (lexical + vector) semantic search. By default `kata search`\nis lexical, so it misses issues that describe the same problem in different\nwords — the case that matters most when an agent searches before creating a\nduplicate. With an embedding endpoint configured, a query like \"auth\n[…]\ntoday.\n\nDesign rationale and internals: `docs/design/semantic-search.md`.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Add opt-in semantic search (Phase 1, SQLite) (#122)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-06-29T03:00:06Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "28c3224df1f90ce797df49e95d7d7dad280f3420",
"body": "Push-enabled adoption baselines were still the important gap after oversized normal pushes were split: a baseline with many snapshots could remain one multi-megabyte ingest request, which common reverse proxies reject before the hub can validate, quarantine, or advance the push cursor. That leaves t\n[…]\nrnal server bookkeeping and is preserved through JSONL cutover with version gating; emitted federation event JSONL records are unchanged.\n\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Chunk federation adoption baseline pushes (#143)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-06-29T02:53:35Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8e0bba9f54c4024a086dd189ebbce344734bea01",
"body": "Push-enabled federation could strand a spoke when baseline adoption generated a request that was valid by event count but too large for the hub mutation body limit. The hub rejects that payload before the ingest handler can apply or quarantine it, so retries keep sending the same oversized request a\n[…]\nproject data only, so the real operator project, hub host, and actor details from the original incident are not encoded in the repository.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Split oversized federation push batches (#142)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-06-28T14:37:20Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b92db6f9343188e3fa27173af30b32ba95d2debc",
"body": "Adds a narrow project-scoped author identity rewrite command:\n\n```sh\nkata projects rewrite-author [project] --from <old-author> --to <new-author>\n```\n\nThe immediate use case is pre-sharing cleanup: federation baseline snapshots, exports, and other project-sharing paths read current issue/comment/lin\n[…]\ntext, and it still refuses already-federated projects because local current-row rewrites after enrollment would diverge from shared state.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Add project author identity rewrite (#141)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-06-28T02:08:20Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "291b176a8ab4cb149acf5af2f2a7f55a559dee2e",
"body": "Operators need to scrub private data from comments before enrolling a project in federation, but kata only allowed issue bodies to be overwritten in place. Appending a replacement comment or purging an entire issue either leaves the original comment content in current state or destroys useful engine\n[…]\ndy updates, including a schema version bump so existing SQLite databases receive the new FTS trigger through the established cutover path.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Add comment edit redaction support (#140)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-06-27T22:34:46Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f752f9bb8b56c4674bc334d83112200a05af6f75",
"body": "Agents that request a public docs .md URL need the source document for the rendered page, not a redirect to the HTML route or a different ref on GitHub. Copy the nav-listed Markdown sources into the generated site so the source and rendered page come from the same deployment.\n\nThe Vercel redirect contract now rejects .md redirects, keeping source-style docs URLs as static files while preserving the installer redirects.\n\nGenerated with Codex",
"is_bot": false,
"headline": "Serve docs Markdown sources from builds (#138)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-06-26T00:43:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "20ab1c038e9a1272515a0ce162da2d7791093aa4",
"body": "Users can reasonably try the public docs source path for quickstart after seeing the markdown filename in repo and documentation contexts. The generated site serves the canonical directory URL, so that path currently falls through to Vercel's 404 page even though the page exists.\n\nAdd the redirect t\n[…]\ns deploy config changes keep the compatibility URL working.\n\nValidation: confirmed the live .md URL returns Vercel 404 before the fix and the canonical directory URL returns 200.\n\nGenerated with Codex",
"is_bot": false,
"headline": "Redirect source-style quickstart docs URL (#137)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-06-25T20:32:26Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "cc6a14044f275e1271de8816b27459e102e70924",
"body": "Implements `kata projects purge <project>` — a supported, gated permanent delete for archived projects. `kata projects remove` only archives a project (sets `deleted_at`) and keeps its name reserved, so `kata init` returns `project_archived` and the name can only be freed by hand-editing SQLite. Pur\n[…]\nd.\n- Documentation in the projects guide and CLI reference.\n\nCloses #116.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Add kata projects purge for archived projects (#136)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-06-25T03:29:17Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "c577282822a624db92d5f5d58efe34770b931c95",
"body": "Release operators expect the local release script to hand off to CI once it pushes an annotated semver tag. The existing tag-triggered workflow only validated that tag, while the actual GitHub release and GoReleaser upload lived behind a separate manual dispatch workflow, making artifact publication\n[…]\n workflow regression test now locks in that the tag-triggered workflow has write permissions, creates the release, and invokes GoReleaser.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Publish release artifacts from tag pushes (#134)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-06-24T21:40:06Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e61a7feed3a2c8d3d5465fd8ef5515c76704f6bd",
"body": "Dev builds could reuse cached release data and tell users they were up to date, even when an official release was available. That made the update path confusing because it did not show the latest production version, did not explain that replacing a dev build requires --force, and did not show the re\n[…]\nhe user explicitly passes --force. JSON and agent modes keep their structured update result so automation can still decide how to proceed.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Improve dev-build update prompts (#135)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-06-24T20:45:24Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e55dc0d87dc560aab5fef7052d8097e94a3522d3",
"body": "Finalizes the public docs for the 0.6.0 release after the tag was confirmed available. This uses the tagged changelog as the release source of truth, adds the 0.6.0 changelog entry, and keeps the overview/navigation paths aligned with the shipped GitHub sync, Windows installer, private-network daemo\n[…]\n convention in `AGENTS.md`: update docs as behavior lands when practical, then do a normal post-release changelog-based finalization pass.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Document 0.6.0 release (#133)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-06-24T20:25:11Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "cf994f5f1376b961425c2633e1019509b7dee2ca",
"body": "* Preserve local-first spoke links before push\n\nPush-enabled spokes can return a freshly created issue ref before the hub has ingested the corresponding local event. Relationship mutations then refresh hub claim status for the linked issue, and the hub can legitimately return issue_not_found during \n[…]\n broader federation misconfiguration. This also tightens the agent privacy rule to keep private project details out of planning notes, bug reports, review responses, and PR text.\n\nGenerated with Codex",
"is_bot": false,
"headline": "Preserve local-first federation links across push lag (#132)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-06-24T19:56:25Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c3828312062d6e303324054ed014832db6ae2dcc",
"body": "GitHub issue import was previously a manual one-off workflow, which made mirrored projects drift unless an operator remembered to re-run imports. This PR turns GitHub Issues into a durable one-way source: the daemon owns `gh api` access, stores source bindings/cursors/status in the database, and fee\n[…]\nthe runtime record. `kata daemon start --foreground` preserves the attached process behavior for service managers and hosted deployments.\n\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Add one-way GitHub issue sync (#128)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-06-24T15:38:52Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e65e2cefcaeb62280c142e9dba2d74e6fb359fde",
"body": "Switching from the daemon selector to a daemon with no registered projects left the TUI on the onboarding screen, where non-quit keys are intentionally absorbed. That made Escape unable to recover even though the user had arrived from a navigable selector.\n\nThis keeps the empty-state behavior unchan\n[…]\n specific switch path. Escape can then return to the daemon list without opening up the rest of the empty screen to accidental navigation.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Restore daemon selector from empty switch (#131)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-06-24T12:53:05Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a9c2c39247adda94019d86ad169c1861aa235f60",
"body": "Private single-user deployments can already run kata tokenless through loopback or Unix sockets, but direct private-network access forced operators to provision and distribute a bearer token even when the private network itself was the intended access boundary. That made Tailscale-style personal dae\n[…]\n writes with client-supplied actors, so the feature is appropriate only when private-network membership is the operator's chosen boundary.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Allow tokenless private-network daemon writes (#130)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-06-24T00:19:52Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "0033a430e6cd693e69f739dfd769b1fb16f57c09",
"body": "Reworks the documentation front page (`docs/index.md`, which is also the\nkatatracker.com homepage) and `README.md` into a marketing pitch plus quickstart,\nand adds the install commands that were previously missing.\n\n## docs/index.md\n\n- Agent-first hero: a tagline, a short pitch, and Install/Quicksta\n[…]\nocs/superpowers/`, which the docs build excludes from the published site.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Revamp docs front page and README into a landing page (#129)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-06-23T16:27:13Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "73f5ecee7dcc58b2929b090539c61d9c0c1b92ed",
"body": "Windows users currently have release archives but no short hosted installer URL matching the Unix `https://katatracker.com/install.sh` path. That leaves the normal install story asymmetric and makes the docs less useful for anyone starting from PowerShell.\n\nThis adds a kata-adapted PowerShell instal\n[…]\n installer without starting a real install, and the mocked PowerShell tests cover asset naming plus checksum match and mismatch behavior.\n\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Add Windows release installer (#126)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-06-23T12:44:25Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "3294c8ecae6569416c444a9a425b0b91d4e7a449",
"body": "## Summary\n\n- replace the default CLI workspace fixture with a local `.kata.toml` and DB-seeded project binding, avoiding git and daemon init for generic command tests\n- add equivalent local project fixtures for daemon handler tests while preserving git-backed helpers for project/init coverage\n- mov\n[…]\n path\n\nThis cuts the local Windows full test command from about 10m31s before the refactor to about 1m57s with an uncached `-count=1` run.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Speed up Windows test fixtures (#127)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-06-23T12:43:01Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a2cf0ce8eafab12a33708b15f9a8cf6221d112f8",
"body": "* Use kit daemon starter for autostart\n\n* Use tagged kit v0.1.8",
"is_bot": false,
"headline": "Use kit daemon starter for autostart (#125)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-06-23T02:51:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c5d3f7389c02000bd8fd6f38d69107fb7ace12c4",
"body": "The first versioned release needs a changelog that is easy to find and useful as release history, not just a buried reference page with a weekly summary. Moving the page into the top-level docs navigation and linking it from the README gives readers a direct path from install/release context into th\n[…]\ny-week project history. The acknowledgements call out non-maintainer contributors from the tagged history while avoiding self-attribution.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Expand the 0.5.0 changelog (#124)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-06-23T02:17:42Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "cffb8094dd7bafd3a10ad41955ff8597b4dd32c4",
"body": "The release script should produce the same annotated-tag notes that the rest of the release pipeline publishes. The previous default silently used deterministic git-log output unless an operator explicitly opted into an agent, which made the normal release path easy to run without the expected gener\n[…]\n checks, aligning the suite with the project rule that shell tests should exercise observable behavior rather than implementation strings.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Use codex for release changelogs (#123)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-06-23T01:12:01Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "94785b398a0ce30d27a36cce49c17101767a2671",
"body": "Agents are already treating kata like other CLIs they know: `comment -m` comes from git muscle memory, and relationship flags on `comment` come from over-generalizing kata's `edit --comment` composition. The status quo made both failures recoverable only after a generic flag error, which is noisy fo\n[…]\nnot create practice or scratchpad issues in the active project.\n\nRoutine repository tests and pre-push hooks passed before opening the PR.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Improve agent recovery for kata comment (#121)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-06-22T13:18:39Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "09832d05e95224e0be9fd20fb322b659e09debfe",
"body": "kata now has enough release identity plumbing that leaving distribution unversioned makes installs, updates, and changelog history harder to reason about. This PR introduces a repeatable v0.5.0 release path: local release scripts, a documented changelog flow, GitHub release assets, a hosted `https:/\n[…]\n and execution artifacts were removed from the branch so repository docs describe shipped behavior rather than agent-local planning notes.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Add versioned release workflow (#120)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-06-22T13:13:38Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "02dd68d7b5f5b75f5c93e256d797ac9a1382cbff",
"body": "* Relax default close throttling for agents\n\nAgent workflows can legitimately close several sibling issues in quick succession when each close has its own evidence. Make that the default by turning sibling-burst and repeated-message throttles into an explicit opt-in policy, while keeping duplicate-e\n[…]\ntion remains parseable and non-mutating commands do not look like successful closes.\n\nGenerated with Codex\nCo-authored-by: Codex <codex@openai.com>\n\n---------\n\nCo-authored-by: Codex <codex@openai.com>",
"is_bot": false,
"headline": "Relax close throttling and remind agents on close (#119)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-06-20T00:32:44Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "5778af7fcf70273f37201dfff5664bbc67cdbb5e",
"body": "## Summary\n- Add global `--daemon <name>` support for selecting a named daemon catalog entry per invocation.\n- Resolve named local and remote targets ahead of ambient remote configuration, including catalog token/token_env auth.\n- Update CLI, quickstart, and remote-daemon docs for the new resolution order.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Add global daemon selection flag (#117)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-06-19T17:38:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a058220773f6013ccb656dc16a4f8cd8053d4777",
"body": "* docs: design for federation quarantine retry + transient classify\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\n\n* fix: retry transient federation quarantines\n\n* fix: distinguish invalid federation schema\n\n* fix: define push-only quarantine retry\n\n* docs: document federation retry compatibility\n\n* fix: auto-retry legacy schema quarantines\n\n---------\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Fix federation schema-skew quarantine recovery (#118)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-06-18T21:50:28Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "c78d3ea3c7d84976d2f7b7993984dbce16557519",
"body": "Supersedes #111. That PR made the same-project limitation honest; this one removes the limitation. It builds on #111's branch — joi's commit ships in this history unsquashed — so the error-message work lands here too, rewritten for the new behavior.\n\n## What changes\n\nA link (`parent`, `blocks`, `rel\n[…]\n`docs/operations/federation.md`, and `docs/operations/backup-restore.md`.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "feat: links may span projects and survive kata move (#112)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-06-16T00:00:09Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "aed88a31480c221e8c023e68e097aef84125049b",
"body": "Fixes #110.\n\nThis updates `kata init --with-agents` so projects that already use Claude Code guidance get the managed kata block in `CLAUDE.md` without manual copy/paste. Existing real `AGENTS.md` and `CLAUDE.md` files are both refreshed when present; a fresh workspace still gets `AGENTS.md` by defa\n[…]\nsed before reading, and only real `CLAUDE.md` files are managed. The docs and CLI help now describe the broader target-selection behavior.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Support CLAUDE.md in kata init --with-agents (#115)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-06-13T20:55:45Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7fbf9a2608b2bfee11446bff4bef0550d6a5cc14",
"body": "Extracted from #112.\\n\\nThis changes only the OpenAPI 3.0 generator input flavor so response schemas leave additionalProperties unset while the published schema remains explicitly permissive. That keeps oapi-codegen-dd from modeling optional object-valued response fields as always-present values.\\n\\nAdds a generated-client regression for empty link changes so absent parent peers validate and do not round-trip as empty objects.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "fix(client): model optional response objects as pointers (#113)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-06-13T19:14:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1da9be7c0bcba9851d9d9151bbc5713085082ebb",
"body": "Extracted from #112.\\n\\nAdds a focused make api-check target for the committed OpenAPI schema, client schema, and generated client drift tests. Wires that target into the existing prek pre-push configuration so generated API drift is caught before pushing.\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "build: check generated api artifacts before push (#114)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-06-13T17:56:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3ac7870815f6e85bb21c6ac96c4873ace1eeeb65",
"body": "… + TUI) (#109)\n\n## Summary\n\n`kata federation join` had no inverse: an accidental enrollment (for example, adopting the wrong local project into a hub) could only be undone by wiping the local daemon state. This PR makes spoke enrollment fully reversible — and re-doable:\n\n- **`kata federation leave \n[…]\nated in `docs/operations/federation.md` and `docs/design/federation.md`.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\n\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(federation): spoke leave and rejoin — reversible enrollment (CLI…",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-06-11T15:47:08Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "cb98442d07e095e0e6d8e7ce5796a6441c9d73a0",
"body": "…patibility (#103)\n\n## What\n\nCloses the two follow-ups left open by #99: surface the API schema version in\n`/api/v1/health`, and document the compatibility contract for the published\nOpenAPI schema.\n\n- **`api_schema_version` in `/api/v1/health`** — the value stamped into the\n OpenAPI document's `in\n[…]\nanged.\n\nThe committed `api/openapi.yaml` is regenerated; the existing golden test keeps\nit in lockstep with the routes.\n\nPart of #97.\n\nCo-authored-by: Matthew Jacobs <mjacobs@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(daemon): report api_schema_version in /health + document API com…",
"author_name": "Matthew Jacobs",
"author_login": "mjacobs",
"committed_at": "2026-06-10T19:29:25Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "40f0007e1007e404c2f63a41cca5641a1a434f7f",
"body": "## What Changed\n\nCLI daemon discovery now honors `active_daemon` entries from\n`<KATA_HOME>/config.toml` after the existing higher-priority\n`KATA_SERVER` and `.kata.local.toml [server].url` paths.\n\nWhen the active daemon catalog entry points at a remote daemon, the CLI\nuses that target's configured `\n[…]\nr auth is not read from `.kata.toml` or\n`.kata.local.toml`.\n\nPrimary files to review are `internal/client/remote.go`,\n`internal/client/client.go`, and the new resolver/auth tests in\n`internal/client`.",
"is_bot": false,
"headline": "fix(client): honor active daemon config (#108)",
"author_name": "Phillip Cloud",
"author_login": "cpcloud",
"committed_at": "2026-06-09T19:10:01Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "432f1653609e45c48895b03db7287ad72b9801bc",
"body": "## Why\n\nA user-facing write can currently fail immediately with `SQLITE_BUSY` when another process or daemon request holds SQLite's write lock long enough to exceed the driver's busy timeout. The original symptom showed up on `kata create`, but the same failure mode exists anywhere sqlitestore opens\n[…]\ne write lock and verifies representative non-`CreateIssue` write paths wait and retry instead of surfacing `SQLITE_BUSY`.\n\n\nCo-authored-by: Marius van Niekerk <mariusvniekerk@users.noreply.github.com>",
"is_bot": false,
"headline": "fix(sqlite): retry transient write contention (#105)",
"author_name": "Marius van Niekerk",
"author_login": "mariusvniekerk",
"committed_at": "2026-06-09T12:58:15Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "5c183cd961a4016307a01e62117276b25055f012",
"body": "Issue #104 is blocked at the user-facing layer: the daemon already has the single-issue project move primitive, but CLI users still have to avoid or work around misfiled issues because there is no command that calls it.\n\nThis adds `kata move <issue-ref> <project>` as the CLI surface for that existin\n[…]\nference now documents the command, target short-id assignment, and the preview-only nature of `--dry-run`.\n\nPart of #104.\n\n\nCo-authored-by: Marius van Niekerk <mariusvniekerk@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(cli): add issue project move command (#106)",
"author_name": "Marius van Niekerk",
"author_login": "mariusvniekerk",
"committed_at": "2026-06-09T12:36:21Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8756c40e81141f066d335c4db95c6bf57195281d",
"body": "## Summary\n- add a public pkg/client wrapper around a generated Huma OpenAPI client\n- generate the client with DoorDash oapi-codegen-dd v3 using the multi-file pkg/client/generated layout\n- commit YAML OpenAPI artifacts for the public schema and client codegen input\n- serve /openapi.yaml explicitly \n[…]\nay create it as a side effect\n- the generated config intentionally enables both classic and response-aware client methods\n\n\nCo-authored-by: Marius van Niekerk <mariusvniekerk@users.noreply.github.com>",
"is_bot": false,
"headline": "Add generated OpenAPI client (#100)",
"author_name": "Marius van Niekerk",
"author_login": "mariusvniekerk",
"committed_at": "2026-06-08T21:40:55Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "33cfc4b0d4592ed0026c42741ec44e58e29b29d2",
"body": "Fix local daemon runtime discovery interop by publishing URL-shaped Unix\nsocket addresses in daemon runtime records.\n\nKata already uses `go.kenn.io/kit/daemon.Endpoint.ConfigAddress()` as\nthe stable config/runtime address form. The startup path passed the\nbound endpoint into `NewRuntimeRecord`, whic\n[…]\nCP records continue to\npublish `127.0.0.1:<port>`.\n\nThe new daemon-start coverage reads the raw runtime JSON before shutdown\nand asserts both the Unix URL form and the existing TCP host:port\ncontract.",
"is_bot": false,
"headline": "fix(daemon): publish unix runtime addresses as URLs (#101)",
"author_name": "Phillip Cloud",
"author_login": "cpcloud",
"committed_at": "2026-06-05T16:37:03Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "50378b68397fa68710446a7676f2ac4507c62c47",
"body": "## What\n\nAdds a `kata openapi` command that prints the daemon's OpenAPI 3.1 schema, and\ncommits the generated artifact at `api/openapi.yaml` with a golden test that\nkeeps it from drifting.\n\nThis is a **reviewable first slice of #97** — a generated *snapshot of the\ncurrent daemon API*, useful for cli\n[…]\n (incl. `-short` across `internal/...`/`cmd/...`),\n `go vet`, `golangci-lint` (0 issues), `nilaway` (clean), `gofmt`.\n\nPart of #97.\n\n\nCo-authored-by: Matthew Jacobs <mjacobs@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(daemon): add kata openapi command + committed OpenAPI schema (#99)",
"author_name": "Matthew Jacobs",
"author_login": "mjacobs",
"committed_at": "2026-06-05T12:24:53Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "cc3909e57e567bd126a771735e592bd54783c0d2",
"body": "## Summary\n- Add a flat issue-list mode in the TUI and a `v` toggle between flat\nand nested views.\n- Add nested expansion controls, including collapsed reset when\nreturning to nested view and `E` expand/collapse-all behavior.\n- Improve local daemon error recovery and TUI transport logging for\ndiagnosis.\n- Make PgUp/PgDn page by the visible issue-list window with intuitive\nboundary behavior.\n- Update README, quickstart, and CLI reference docs for the new TUI\nbehavior.",
"is_bot": false,
"headline": "Add flat TUI issue list view (#98)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-06-05T01:08:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7205f12ab7dee43946ac11b2eb5c2e360f0f467b",
"body": "## Summary\n\n- clear ignored local screenshot assets before hydrating from `docs-assets`\n- add docs validation that enforces the refresh step before hydration\n- keep the docs update helper building against freshly regenerated screenshot assets\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Refresh docs screenshots before hydration (#96)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-06-04T13:53:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3ec9d2546e380cab8cde08c1815599d290ab9154",
"body": "## Summary\n\n- add `scripts/update-docs.sh` as the one-command screenshot/docs deploy helper\n- document the helper in the docs deployment guide\n- extend docs validation to require the helper and prevent accidental commit behavior\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Add docs update helper (#95)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-06-04T03:13:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6af8c303476663de37a23cd64e0b50642f65f66c",
"body": "## Summary\n- Adds README and CLI reference coverage for `kata init --with-agents`.\n- Documents Beads sidecar handling and symlinked `AGENTS.md` refusal in\nthe public docs.\n- Pins the docs-check guard so the user-facing references stay present.",
"is_bot": false,
"headline": "docs: document init agent guidance (#94)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-06-04T03:04:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5de182129ed1f8b95e368fc9effbe2cff9baea83",
"body": "…#86)\n\n## Summary\n\n`kata init` writes only `.kata.toml` and a `.gitignore` line, so a\nfreshly bound workspace gives coding agents no in-repo hint that kata is\nthe issue ledger — agents have to be told to run `kata quickstart` out\nof band. Beads, by contrast, writes/updates `AGENTS.md` on `bd init` b\n[…]\non whether an opt-in\nAGENTS.md writer fits kata's direction before polishing.\n\n---------\n\nCo-authored-by: Claude Opus 4.7 <noreply@anthropic.com>\nCo-authored-by: Wes McKinney <wesmckinn+git@gmail.com>",
"is_bot": false,
"headline": "feat(init): add --with-agents to write kata guidance into AGENTS.md (…",
"author_name": "Matthew Jacobs",
"author_login": "mjacobs",
"committed_at": "2026-06-04T02:51:30Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "9105662ade334978014b00cb09e06e87bce12183",
"body": "## Summary\n- add anonymous PostHog telemetry using the existing kata database instance UID as the distinct ID\n- emit daemon_started at daemon startup plus daemon_active immediately and every 24 hours while the daemon stays running\n- keep telemetry payloads limited to aggregate project_count and buil\n[…]\nuplicate active events\n\n## Validation\n- go test ./internal/telemetry ./cmd/kata\n- scripts/check-docs.sh\n- git diff --check\n\nCo-authored-by: Marius van Niekerk <mariusvniekerk@users.noreply.github.com>",
"is_bot": false,
"headline": "Add anonymous daemon telemetry (#93)",
"author_name": "Marius van Niekerk",
"author_login": "mariusvniekerk",
"committed_at": "2026-06-03T16:31:23Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e0501e7c4419112a8a8d780f84ee73e67f2c5e9e",
"body": "## Summary\n\n- Adds an active-daemon federation TUI with spoke status, binding detail, catalog hub browsing, and guided enrollment for adopting local projects or creating local replicas from hub projects.\n- Separates federation roles and auth: catalog hub admin calls, temporary enrollment-token metad\n[…]\nay out of the main branch; local preview uses ignored `docs/assets/screenshots`, and production hydrates from `docs-assets`.\n\nCloses #90.\n\n\nCo-authored-by: Wes McKinney <wesm@users.noreply.github.com>",
"is_bot": false,
"headline": "Add federation enrollment UX and actor-bound hub support (#85)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-06-03T15:22:35Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "242ea65df6bf1a7a037093c2750f53477b6341eb",
"body": "## Summary\n- run the Vercel docs deploy target from the repository root so the\nconfigured docs root is not applied twice\n- update the CLI deployment guide to link/deploy from the repo root\n- keep local Vercel/env artifacts out of generated docs output and add\ndocs-check guards\n\n## Verification\n- make docs-check\n- make test-short\n- git diff --check",
"is_bot": false,
"headline": "Fix Vercel docs deploy root (#92)",
"author_name": "Wes McKinney",
"author_login": "wesm",
"committed_at": "2026-06-02T14:54:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "765cb3fb76d31188dc165e396f67a8d4c94e1f32",
"body": "## Summary\n- Replace kata-local daemon runtime records, endpoint structs, runtime discovery, and process liveness with `go.kenn.io/kit/daemon` primitives.\n- Keep kata-specific daemon responsibilities in kata: namespace selection, auth/listen policy, stop/reload signaling, and HTTP handlers.\n- Update\n[…]\nthe kit runtime-record shape and isolate local daemon e2e auth environment.\n\n## Validation\n- `go test -timeout 180s ./...`\n\nCo-authored-by: Marius van Niekerk <mariusvniekerk@users.noreply.github.com>",
"is_bot": false,
"headline": "Adopt kit daemon lifecycle (#88)",
"author_name": "Marius van Niekerk",
"author_login": "mariusvniekerk",
"committed_at": "2026-06-02T13:40:15Z",
"body_truncated": true,
"is_coding_agent": false
}
],
"releases_count": 11,
"commits_last_year": 522,
"latest_release_at": "2026-07-21T21:08:47Z",
"latest_release_tag": "v0.12.1",
"releases_from_tags": false,
"days_since_last_push": 0,
"active_weeks_last_year": 13,
"days_since_latest_release": 2,
"mean_days_between_releases": 3
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": false,
"health_percentage": 37,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "go.kenn.io/kata",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "go",
"matches_repo": null,
"registry_url": "https://pkg.go.dev/go.kenn.io/kata",
"is_deprecated": false,
"latest_version": "v0.12.1",
"repository_url": null,
"versions_count": 11,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-07-21T20:04:37Z",
"latest_version_yanked": null,
"days_since_latest_publish": 2
}
]
},
"popularity": {
"forks": 24,
"stars": 318,
"watchers": 3,
"fork_history": {
"days": [
{
"date": "2026-05-03",
"count": 3
},
{
"date": "2026-05-06",
"count": 2
},
{
"date": "2026-05-07",
"count": 2
},
{
"date": "2026-05-08",
"count": 4
},
{
"date": "2026-05-09",
"count": 1
},
{
"date": "2026-05-25",
"count": 1
},
{
"date": "2026-06-01",
"count": 2
},
{
"date": "2026-06-05",
"count": 1
},
{
"date": "2026-06-10",
"count": 1
},
{
"date": "2026-06-15",
"count": 1
},
{
"date": "2026-06-27",
"count": 1
},
{
"date": "2026-06-29",
"count": 1
},
{
"date": "2026-07-08",
"count": 1
},
{
"date": "2026-07-10",
"count": 1
},
{
"date": "2026-07-13",
"count": 1
},
{
"date": "2026-07-14",
"count": 1
}
],
"complete": true,
"collected": 24,
"total_forks": 24
},
"star_history": null,
"open_issues_and_prs": 10
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": true,
"has_mcp_signal": false,
"bootstrap_files": [
"Makefile"
],
"api_schema_files": [
"api/openapi.yaml",
"pkg/client/openapi.yaml"
],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [
"go.mod"
],
"largest_source_bytes": 220359,
"source_files_sampled": 774,
"oversized_source_files": 20,
"agent_instruction_files": [
"AGENTS.md",
"CLAUDE.md",
"docs/workflows/agents.md"
],
"agent_instruction_max_bytes": 10653
},
"dependencies": {
"manifests": [
"docs/pyproject.toml",
"go.mod"
],
"advisories": {
"error": null,
"scope": "repository_graph",
"source": "osv",
"findings": [
{
"name": "golang.org/x/text",
"direct": true,
"version": "v0.38.0",
"severity": "unknown",
"ecosystem": "go",
"cvss_score": null,
"advisory_ids": [
"GO-2026-5970"
],
"fixed_version": "0.39.0",
"advisory_count": 1,
"oldest_advisory_days": 9
},
{
"name": "github.com/yuin/goldmark",
"direct": false,
"version": "v1.7.13",
"severity": "unknown",
"ecosystem": "go",
"cvss_score": null,
"advisory_ids": [
"GO-2026-5320"
],
"fixed_version": "1.7.17",
"advisory_count": 1,
"oldest_advisory_days": 16
},
{
"name": "golang.org/x/crypto",
"direct": false,
"version": "v0.53.0",
"severity": "unknown",
"ecosystem": "go",
"cvss_score": null,
"advisory_ids": [
"GO-2026-5932"
],
"fixed_version": null,
"advisory_count": 1,
"oldest_advisory_days": 16
}
],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {
"unknown": 3
},
"advisory_count": 3,
"affected_count": 3,
"assessed_count": 138,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 1
},
"ecosystems": [
"go",
"pypi"
],
"dependencies": [
{
"name": "charm.land/bubbles/v2",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v2.1.1"
},
{
"name": "charm.land/bubbletea/v2",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v2.0.8"
},
{
"name": "charm.land/glamour/v2",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v2.0.1"
},
{
"name": "charm.land/lipgloss/v2",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v2.0.5"
},
{
"name": "github.com/BurntSushi/toml",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.6.0"
},
{
"name": "github.com/bradleyfalzon/ghinstallation/v2",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v2.19.0"
},
{
"name": "github.com/cenkalti/backoff/v5",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v5.0.3"
},
{
"name": "github.com/charmbracelet/colorprofile",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.4.3"
},
{
"name": "github.com/charmbracelet/x/ansi",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.11.7"
},
{
"name": "github.com/charmbracelet/x/exp/teatest/v2",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v2.0.0-20260705004817-2cc9a8fe1146"
},
{
"name": "github.com/danielgtaylor/huma/v2",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v2.37.3"
},
{
"name": "github.com/doordash-oss/oapi-codegen-dd/v3",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v3.75.5"
},
{
"name": "github.com/go-playground/validator/v10",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v10.30.1"
},
{
"name": "github.com/jackc/pgx/v5",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v5.9.2"
},
{
"name": "github.com/klauspost/compress",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.18.6"
},
{
"name": "github.com/mattn/go-runewidth",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.0.24"
},
{
"name": "github.com/mattn/go-sqlite3",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.14.47"
},
{
"name": "github.com/oklog/ulid/v2",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v2.1.1"
},
{
"name": "github.com/posthog/posthog-go",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.12.6"
},
{
"name": "github.com/spf13/cobra",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.10.2"
},
{
"name": "github.com/spf13/pflag",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.0.10"
},
{
"name": "github.com/stretchr/testify",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.11.1"
},
{
"name": "github.com/teambition/rrule-go",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.8.2"
},
{
"name": "github.com/testcontainers/testcontainers-go",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.42.0"
},
{
"name": "github.com/testcontainers/testcontainers-go/modules/postgres",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.42.0"
},
{
"name": "go.kenn.io/kit",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.9.3"
},
{
"name": "golang.org/x/sys",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.46.0"
},
{
"name": "golang.org/x/term",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.44.0"
},
{
"name": "golang.org/x/text",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.38.0"
},
{
"name": "modernc.org/sqlite",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.53.0"
},
{
"name": "pgregory.net/rapid",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.3.0"
}
],
"all_dependencies": {
"error": null,
"source": "github-sbom",
"packages": [
{
"name": "charm.land/bubbles/v2",
"direct": true,
"version": "v2.1.1",
"ecosystem": "go"
},
{
"name": "charm.land/bubbletea/v2",
"direct": true,
"version": "v2.0.8",
"ecosystem": "go"
},
{
"name": "charm.land/glamour/v2",
"direct": true,
"version": "v2.0.1",
"ecosystem": "go"
},
{
"name": "charm.land/lipgloss/v2",
"direct": true,
"version": "v2.0.5",
"ecosystem": "go"
},
{
"name": "github.com/bradleyfalzon/ghinstallation/v2",
"direct": true,
"version": "v2.19.0",
"ecosystem": "go"
},
{
"name": "github.com/burntsushi/toml",
"direct": true,
"version": "v1.6.0",
"ecosystem": "go"
},
{
"name": "github.com/cenkalti/backoff/v5",
"direct": true,
"version": "v5.0.3",
"ecosystem": "go"
},
{
"name": "github.com/charmbracelet/colorprofile",
"direct": true,
"version": "v0.4.3",
"ecosystem": "go"
},
{
"name": "github.com/charmbracelet/x/ansi",
"direct": true,
"version": "v0.11.7",
"ecosystem": "go"
},
{
"name": "github.com/charmbracelet/x/exp/teatest/v2",
"direct": true,
"version": "v2.0.0-20260705004817-2cc9a8fe1146",
"ecosystem": "go"
},
{
"name": "github.com/danielgtaylor/huma/v2",
"direct": true,
"version": "v2.37.3",
"ecosystem": "go"
},
{
"name": "github.com/doordash-oss/oapi-codegen-dd/v3",
"direct": true,
"version": "v3.75.5",
"ecosystem": "go"
},
{
"name": "github.com/go-playground/validator/v10",
"direct": true,
"version": "v10.30.1",
"ecosystem": "go"
},
{
"name": "github.com/jackc/pgx/v5",
"direct": true,
"version": "v5.9.2",
"ecosystem": "go"
},
{
"name": "github.com/klauspost/compress",
"direct": true,
"version": "v1.18.6",
"ecosystem": "go"
},
{
"name": "github.com/mattn/go-runewidth",
"direct": true,
"version": "v0.0.24",
"ecosystem": "go"
},
{
"name": "github.com/mattn/go-sqlite3",
"direct": true,
"version": "v1.14.47",
"ecosystem": "go"
},
{
"name": "github.com/oklog/ulid/v2",
"direct": true,
"version": "v2.1.1",
"ecosystem": "go"
},
{
"name": "github.com/posthog/posthog-go",
"direct": true,
"version": "v1.12.6",
"ecosystem": "go"
},
{
"name": "github.com/spf13/cobra",
"direct": true,
"version": "v1.10.2",
"ecosystem": "go"
},
{
"name": "github.com/spf13/pflag",
"direct": true,
"version": "v1.0.10",
"ecosystem": "go"
},
{
"name": "github.com/stretchr/testify",
"direct": true,
"version": "v1.11.1",
"ecosystem": "go"
},
{
"name": "github.com/teambition/rrule-go",
"direct": true,
"version": "v1.8.2",
"ecosystem": "go"
},
{
"name": "github.com/testcontainers/testcontainers-go",
"direct": true,
"version": "v0.42.0",
"ecosystem": "go"
},
{
"name": "github.com/testcontainers/testcontainers-go/modules/postgres",
"direct": true,
"version": "v0.42.0",
"ecosystem": "go"
},
{
"name": "go.kenn.io/kit",
"direct": true,
"version": "v0.9.3",
"ecosystem": "go"
},
{
"name": "golang.org/x/sys",
"direct": true,
"version": "v0.46.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/term",
"direct": true,
"version": "v0.44.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/text",
"direct": true,
"version": "v0.38.0",
"ecosystem": "go"
},
{
"name": "modernc.org/sqlite",
"direct": true,
"version": "v1.53.0",
"ecosystem": "go"
},
{
"name": "pgregory.net/rapid",
"direct": true,
"version": "v1.3.0",
"ecosystem": "go"
},
{
"name": "dario.cat/mergo",
"direct": false,
"version": "v1.0.2",
"ecosystem": "go"
},
{
"name": "github.com/alecthomas/chroma/v2",
"direct": false,
"version": "v2.20.0",
"ecosystem": "go"
},
{
"name": "github.com/asg017/sqlite-vec-go-bindings",
"direct": false,
"version": "v0.1.6",
"ecosystem": "go"
},
{
"name": "github.com/atotto/clipboard",
"direct": false,
"version": "v0.1.4",
"ecosystem": "go"
},
{
"name": "github.com/aymanbagabas/go-udiff",
"direct": false,
"version": "v0.4.1",
"ecosystem": "go"
},
{
"name": "github.com/aymerick/douceur",
"direct": false,
"version": "v0.2.0",
"ecosystem": "go"
},
{
"name": "github.com/azure/go-ansiterm",
"direct": false,
"version": "v0.0.0-20250102033503-faa5f7b0171c",
"ecosystem": "go"
},
{
"name": "github.com/cenkalti/backoff/v4",
"direct": false,
"version": "v4.3.0",
"ecosystem": "go"
},
{
"name": "github.com/cespare/xxhash/v2",
"direct": false,
"version": "v2.3.0",
"ecosystem": "go"
},
{
"name": "github.com/charmbracelet/ultraviolet",
"direct": false,
"version": "v0.0.0-20260703014108-f5a850f9c2b7",
"ecosystem": "go"
},
{
"name": "github.com/charmbracelet/x/exp/golden",
"direct": false,
"version": "v0.0.0-20251109135125-8916d276318f",
"ecosystem": "go"
},
{
"name": "github.com/charmbracelet/x/exp/slice",
"direct": false,
"version": "v0.0.0-20250327172914-2fdc97757edf",
"ecosystem": "go"
},
{
"name": "github.com/charmbracelet/x/term",
"direct": false,
"version": "v0.2.2",
"ecosystem": "go"
},
{
"name": "github.com/charmbracelet/x/termios",
"direct": false,
"version": "v0.1.1",
"ecosystem": "go"
},
{
"name": "github.com/charmbracelet/x/windows",
"direct": false,
"version": "v0.2.2",
"ecosystem": "go"
},
{
"name": "github.com/clipperhouse/displaywidth",
"direct": false,
"version": "v0.11.0",
"ecosystem": "go"
},
{
"name": "github.com/clipperhouse/uax29/v2",
"direct": false,
"version": "v2.7.0",
"ecosystem": "go"
},
{
"name": "github.com/containerd/errdefs",
"direct": false,
"version": "v1.0.0",
"ecosystem": "go"
},
{
"name": "github.com/containerd/errdefs/pkg",
"direct": false,
"version": "v0.3.0",
"ecosystem": "go"
},
{
"name": "github.com/containerd/log",
"direct": false,
"version": "v0.1.0",
"ecosystem": "go"
},
{
"name": "github.com/containerd/platforms",
"direct": false,
"version": "v0.2.1",
"ecosystem": "go"
},
{
"name": "github.com/cpuguy83/dockercfg",
"direct": false,
"version": "v0.3.2",
"ecosystem": "go"
},
{
"name": "github.com/davecgh/go-spew",
"direct": false,
"version": "v1.1.1",
"ecosystem": "go"
},
{
"name": "github.com/distribution/reference",
"direct": false,
"version": "v0.6.0",
"ecosystem": "go"
},
{
"name": "github.com/dlclark/regexp2",
"direct": false,
"version": "v1.11.5",
"ecosystem": "go"
},
{
"name": "github.com/docker/go-connections",
"direct": false,
"version": "v0.6.0",
"ecosystem": "go"
},
{
"name": "github.com/docker/go-units",
"direct": false,
"version": "v0.5.0",
"ecosystem": "go"
},
{
"name": "github.com/dustin/go-humanize",
"direct": false,
"version": "v1.0.1",
"ecosystem": "go"
},
{
"name": "github.com/ebitengine/purego",
"direct": false,
"version": "v0.10.0",
"ecosystem": "go"
},
{
"name": "github.com/felixge/httpsnoop",
"direct": false,
"version": "v1.0.4",
"ecosystem": "go"
},
{
"name": "github.com/gabriel-vasile/mimetype",
"direct": false,
"version": "v1.4.13",
"ecosystem": "go"
},
{
"name": "github.com/go-logr/logr",
"direct": false,
"version": "v1.4.3",
"ecosystem": "go"
},
{
"name": "github.com/go-logr/stdr",
"direct": false,
"version": "v1.2.2",
"ecosystem": "go"
},
{
"name": "github.com/go-ole/go-ole",
"direct": false,
"version": "v1.2.6",
"ecosystem": "go"
},
{
"name": "github.com/go-playground/locales",
"direct": false,
"version": "v0.14.1",
"ecosystem": "go"
},
{
"name": "github.com/go-playground/universal-translator",
"direct": false,
"version": "v0.18.1",
"ecosystem": "go"
},
{
"name": "github.com/goccy/go-json",
"direct": false,
"version": "v0.10.5",
"ecosystem": "go"
},
{
"name": "github.com/gofrs/flock",
"direct": false,
"version": "v0.13.0",
"ecosystem": "go"
},
{
"name": "github.com/golang-jwt/jwt/v4",
"direct": false,
"version": "v4.5.2",
"ecosystem": "go"
},
{
"name": "github.com/google/go-github/v88",
"direct": false,
"version": "v88.0.0",
"ecosystem": "go"
},
{
"name": "github.com/google/go-querystring",
"direct": false,
"version": "v1.2.0",
"ecosystem": "go"
},
{
"name": "github.com/google/uuid",
"direct": false,
"version": "v1.6.0",
"ecosystem": "go"
},
{
"name": "github.com/gorilla/css",
"direct": false,
"version": "v1.0.1",
"ecosystem": "go"
},
{
"name": "github.com/hashicorp/golang-lru/v2",
"direct": false,
"version": "v2.0.7",
"ecosystem": "go"
},
{
"name": "github.com/inconshreveable/mousetrap",
"direct": false,
"version": "v1.1.0",
"ecosystem": "go"
},
{
"name": "github.com/jackc/pgpassfile",
"direct": false,
"version": "v1.0.0",
"ecosystem": "go"
},
{
"name": "github.com/jackc/pgservicefile",
"direct": false,
"version": "v0.0.0-20240606120523-5a60cdf6a761",
"ecosystem": "go"
},
{
"name": "github.com/jackc/puddle/v2",
"direct": false,
"version": "v2.2.2",
"ecosystem": "go"
},
{
"name": "github.com/leodido/go-urn",
"direct": false,
"version": "v1.4.0",
"ecosystem": "go"
},
{
"name": "github.com/lucasb-eyer/go-colorful",
"direct": false,
"version": "v1.4.0",
"ecosystem": "go"
},
{
"name": "github.com/lufia/plan9stats",
"direct": false,
"version": "v0.0.0-20211012122336-39d0f177ccd0",
"ecosystem": "go"
},
{
"name": "github.com/magiconair/properties",
"direct": false,
"version": "v1.8.10",
"ecosystem": "go"
},
{
"name": "github.com/mattn/go-isatty",
"direct": false,
"version": "v0.0.20",
"ecosystem": "go"
},
{
"name": "github.com/microcosm-cc/bluemonday",
"direct": false,
"version": "v1.0.27",
"ecosystem": "go"
},
{
"name": "github.com/microsoft/go-winio",
"direct": false,
"version": "v0.6.2",
"ecosystem": "go"
},
{
"name": "github.com/moby/docker-image-spec",
"direct": false,
"version": "v1.3.1",
"ecosystem": "go"
},
{
"name": "github.com/moby/go-archive",
"direct": false,
"version": "v0.2.0",
"ecosystem": "go"
},
{
"name": "github.com/moby/moby/api",
"direct": false,
"version": "v1.54.1",
"ecosystem": "go"
},
{
"name": "github.com/moby/moby/client",
"direct": false,
"version": "v0.4.0",
"ecosystem": "go"
},
{
"name": "github.com/moby/patternmatcher",
"direct": false,
"version": "v0.6.1",
"ecosystem": "go"
},
{
"name": "github.com/moby/sys/sequential",
"direct": false,
"version": "v0.6.0",
"ecosystem": "go"
},
{
"name": "github.com/moby/sys/user",
"direct": false,
"version": "v0.4.0",
"ecosystem": "go"
},
{
"name": "github.com/moby/sys/userns",
"direct": false,
"version": "v0.1.0",
"ecosystem": "go"
},
{
"name": "github.com/moby/term",
"direct": false,
"version": "v0.5.2",
"ecosystem": "go"
},
{
"name": "github.com/muesli/cancelreader",
"direct": false,
"version": "v0.2.2",
"ecosystem": "go"
},
{
"name": "github.com/ncruces/go-strftime",
"direct": false,
"version": "v1.0.0",
"ecosystem": "go"
},
{
"name": "github.com/opencontainers/go-digest",
"direct": false,
"version": "v1.0.0",
"ecosystem": "go"
},
{
"name": "github.com/opencontainers/image-spec",
"direct": false,
"version": "v1.1.1",
"ecosystem": "go"
},
{
"name": "github.com/pmezard/go-difflib",
"direct": false,
"version": "v1.0.0",
"ecosystem": "go"
},
{
"name": "github.com/power-devops/perfstat",
"direct": false,
"version": "v0.0.0-20240221224432-82ca36839d55",
"ecosystem": "go"
},
{
"name": "github.com/remyoudompheng/bigfft",
"direct": false,
"version": "v0.0.0-20230129092748-24d4a6f8daec",
"ecosystem": "go"
},
{
"name": "github.com/rivo/uniseg",
"direct": false,
"version": "v0.4.7",
"ecosystem": "go"
},
{
"name": "github.com/shirou/gopsutil/v4",
"direct": false,
"version": "v4.26.3",
"ecosystem": "go"
},
{
"name": "github.com/sirupsen/logrus",
"direct": false,
"version": "v1.9.4",
"ecosystem": "go"
},
{
"name": "github.com/tklauser/go-sysconf",
"direct": false,
"version": "v0.3.16",
"ecosystem": "go"
},
{
"name": "github.com/tklauser/numcpus",
"direct": false,
"version": "v0.11.0",
"ecosystem": "go"
},
{
"name": "github.com/xo/terminfo",
"direct": false,
"version": "v0.0.0-20220910002029-abceb7e1c41e",
"ecosystem": "go"
},
{
"name": "github.com/yuin/goldmark",
"direct": false,
"version": "v1.7.13",
"ecosystem": "go"
},
{
"name": "github.com/yuin/goldmark-emoji",
"direct": false,
"version": "v1.0.6",
"ecosystem": "go"
},
{
"name": "github.com/yusufpapurcu/wmi",
"direct": false,
"version": "v1.2.4",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/auto/sdk",
"direct": false,
"version": "v1.2.1",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp",
"direct": false,
"version": "v0.60.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/otel",
"direct": false,
"version": "v1.44.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/otel/metric",
"direct": false,
"version": "v1.44.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/otel/trace",
"direct": false,
"version": "v1.44.0",
"ecosystem": "go"
},
{
"name": "go.yaml.in/yaml/v4",
"direct": false,
"version": "v4.0.0-rc.4",
"ecosystem": "go"
},
{
"name": "golang.org/x/crypto",
"direct": false,
"version": "v0.53.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/exp",
"direct": false,
"version": "v0.0.0-20240404231335-c0f41cb1a7a0",
"ecosystem": "go"
},
{
"name": "golang.org/x/mod",
"direct": false,
"version": "v0.36.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/net",
"direct": false,
"version": "v0.56.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/sync",
"direct": false,
"version": "v0.21.0",
"ecosystem": "go"
},
{
"name": "gopkg.in/yaml.v3",
"direct": false,
"version": "v3.0.1",
"ecosystem": "go"
},
{
"name": "modernc.org/libc",
"direct": false,
"version": "v1.73.4",
"ecosystem": "go"
},
{
"name": "modernc.org/mathutil",
"direct": false,
"version": "v1.7.1",
"ecosystem": "go"
},
{
"name": "modernc.org/memory",
"direct": false,
"version": "v1.11.0",
"ecosystem": "go"
},
{
"name": "click",
"direct": false,
"version": "8.4.1",
"ecosystem": "pypi"
},
{
"name": "colorama",
"direct": false,
"version": "0.4.6",
"ecosystem": "pypi"
},
{
"name": "deepmerge",
"direct": false,
"version": "2.0",
"ecosystem": "pypi"
},
{
"name": "jinja2",
"direct": false,
"version": "3.1.6",
"ecosystem": "pypi"
},
{
"name": "kata-docs",
"direct": false,
"version": "0.0.0",
"ecosystem": "pypi"
},
{
"name": "markdown",
"direct": false,
"version": "3.10.2",
"ecosystem": "pypi"
},
{
"name": "markupsafe",
"direct": false,
"version": "3.0.3",
"ecosystem": "pypi"
},
{
"name": "pygments",
"direct": false,
"version": "2.20.0",
"ecosystem": "pypi"
},
{
"name": "pymdown-extensions",
"direct": false,
"version": "10.21.3",
"ecosystem": "pypi"
},
{
"name": "pyyaml",
"direct": false,
"version": "6.0.3",
"ecosystem": "pypi"
},
{
"name": "tomli",
"direct": false,
"version": "2.4.1",
"ecosystem": "pypi"
},
{
"name": "zensical",
"direct": false,
"version": "0.0.43",
"ecosystem": "pypi"
}
],
"collected": true,
"truncated": false,
"total_count": 138,
"direct_count": 31,
"indirect_count": 107
}
},
"maintainership": {
"issues": {
"open_prs": 1,
"merged_prs": 160,
"open_issues": 9,
"closed_ratio": 0.7,
"closed_issues": 21,
"closed_unmerged_prs": 11
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "wesm",
"commits": 468,
"avatar_url": "https://avatars.githubusercontent.com/u/329591?v=4"
},
{
"type": "User",
"login": "mariusvniekerk",
"commits": 21,
"avatar_url": "https://avatars.githubusercontent.com/u/73973?v=4"
},
{
"type": "User",
"login": "mjacobs",
"commits": 13,
"avatar_url": "https://avatars.githubusercontent.com/u/42575?v=4"
},
{
"type": "User",
"login": "cpcloud",
"commits": 8,
"avatar_url": "https://avatars.githubusercontent.com/u/417981?v=4"
},
{
"type": "User",
"login": "andyxhadji",
"commits": 2,
"avatar_url": "https://avatars.githubusercontent.com/u/3607647?v=4"
},
{
"type": "User",
"login": "cwensel",
"commits": 2,
"avatar_url": "https://avatars.githubusercontent.com/u/24684?v=4"
},
{
"type": "User",
"login": "obra",
"commits": 2,
"avatar_url": "https://avatars.githubusercontent.com/u/45416?v=4"
},
{
"type": "User",
"login": "njt",
"commits": 2,
"avatar_url": "https://avatars.githubusercontent.com/u/66792?v=4"
},
{
"type": "User",
"login": "schloerke",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/93231?v=4"
},
{
"type": "User",
"login": "hughdbrown",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/90322?v=4"
}
],
"contributors_sampled": 11,
"top_contributor_share": 0.898
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"publish-release.yml",
"release.yml",
"test.yml"
],
"has_docs_dir": true,
"linter_configs": [
".golangci.yml"
],
"has_editorconfig": false,
"has_linter_config": true,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"go.sum",
"uv.lock"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 3,
"reason": "branch protection is not maximal on development and all release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 10,
"reason": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 3,
"reason": "Found 9/30 approved changesets -- score normalized to 3",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 10,
"reason": "project has 10 contributing companies or organizations",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 0,
"reason": "project was created within the last 90 days. Please review its contents carefully",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": 10,
"reason": "packaging workflow detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 7,
"reason": "dependency not pinned by hash detected -- score normalized to 7",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 8,
"reason": "SAST tool is not run on all commits -- score normalized to 8",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": 0,
"reason": "Project has not signed or included provenance with any releases.",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 7,
"reason": "3 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "61a3d8c516e1dfde085938dc6c68ceedf20b0a40",
"ran_at": "2026-07-24T13:25:51Z",
"aggregate_score": 4.5,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-23T16:08:07Z",
"oldest_open_prs": [
{
"number": 15,
"created_at": "2026-05-05T17:32:03Z",
"last_comment_at": "2026-06-12T11:35:49Z",
"last_comment_author": "roborev-ci"
}
],
"last_merged_pr_at": "2026-07-23T16:00:45Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": [
{
"number": 3,
"created_at": "2026-05-04T00:33:35Z",
"last_comment_at": "2026-05-07T22:03:08Z",
"last_comment_author": "obra"
},
{
"number": 4,
"created_at": "2026-05-04T00:38:39Z",
"last_comment_at": "2026-05-04T04:16:30Z",
"last_comment_author": "mariusvniekerk"
},
{
"number": 17,
"created_at": "2026-05-05T20:28:29Z",
"last_comment_at": "2026-05-08T13:10:43Z",
"last_comment_author": "wesm"
},
{
"number": 37,
"created_at": "2026-05-11T21:21:06Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 38,
"created_at": "2026-05-12T00:59:48Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 42,
"created_at": "2026-05-12T16:57:24Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 97,
"created_at": "2026-06-04T11:04:04Z",
"last_comment_at": "2026-06-05T01:06:51Z",
"last_comment_author": "wesm"
},
{
"number": 102,
"created_at": "2026-06-06T01:04:55Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 162,
"created_at": "2026-07-09T22:37:59Z",
"last_comment_at": "2026-07-12T07:18:42Z",
"last_comment_author": "mjacobs"
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/kenn-io/kata",
"host": "github.com",
"name": "kata",
"owner": "kenn-io"
},
"metrics": {
"overall": {
"key": "overall",
"band": "moderate",
"name": "Overall health",
"note": null,
"notes": [],
"value": 66,
"inputs": {
"security": 54,
"vitality": 74,
"community": 52,
"governance": 62,
"engineering": 82
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 74,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "moderate",
"name": "Development activity",
"note": null,
"notes": [],
"value": 63,
"inputs": {
"commits_last_year": 522,
"human_commit_share": 1,
"days_since_last_push": 0,
"active_weeks_last_year": 13
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 0 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 0
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "13/52 weeks with commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 13
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "522 commits in the last year",
"points": 18,
"status": "met",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 522
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": null,
"notes": [],
"value": 90,
"inputs": {
"releases_count": 11,
"latest_release_tag": "v0.12.1",
"releases_from_tags": false,
"days_since_latest_release": 2,
"mean_days_between_releases": 3
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "11 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 11
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 2 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 2
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~3 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 3
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "Project has not signed or included provenance with any releases.",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "unverified",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": "repository_too_young",
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": null,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "maintenance record not established from the collected data",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_unverified",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "moderate",
"name": "Community & Adoption",
"value": 52,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "moderate",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 54,
"inputs": {
"forks": 24,
"stars": 318,
"watchers": 3,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "318 stars",
"points": 40.6,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 318
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "24 forks",
"points": 11.3,
"status": "partial",
"details": [
{
"code": "forks",
"params": {
"count": 24
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "3 watchers",
"points": 1.7,
"status": "partial",
"details": [
{
"code": "watchers",
"params": {
"count": 3
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "moderate",
"name": "Community health",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (MIT)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "MIT"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "moderate",
"name": "Sustainability & Governance",
"value": 62,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "at_risk",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 35,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 11,
"top_contributor_share": 0.898
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 90% of commits",
"points": 2.3,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 90
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "11 contributors",
"points": 13.5,
"status": "met",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 11
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 10 contributing companies or organizations",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "good",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 73,
"inputs": {
"merged_prs": 160,
"open_issues": 9,
"closed_issues": 21,
"issue_closed_ratio": 0.7,
"closed_unmerged_prs": 11
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "70% of issues closed",
"points": 32.7,
"status": "partial",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 70
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "160/171 decided PRs merged",
"points": 35.8,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 160,
"decided": 171
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 9/30 approved changesets -- score normalized to 3",
"points": 4.5,
"status": "partial",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "moderate",
"name": "Ownership & stewardship",
"note": null,
"notes": [],
"value": 54,
"inputs": {
"followers": 133,
"owner_type": "Organization",
"is_verified": null,
"owner_login": "kenn-io",
"public_repos": 12,
"account_age_days": 167
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "organization-owned",
"points": 30,
"status": "met",
"details": [
{
"code": "owner_organization",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "133 followers of kenn-io",
"points": 15.3,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 133,
"login": "kenn-io"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "12 public repos, account ~0 yr old",
"points": 9,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 12
}
},
{
"code": "account_age_years",
"params": {
"years": 0
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"go.kenn.io/kata"
],
"ecosystems": "go",
"any_deprecated": false,
"min_days_since_publish": 2
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on go",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "go"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 2 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 2
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "11 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 11
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "good",
"name": "Engineering Quality",
"value": 82,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "good",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 84,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": true,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "3 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 3
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": ".golangci.yml",
"points": 16,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": ".golangci.yml"
}
}
],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
"points": 20,
"status": "met",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "good",
"name": "Documentation",
"note": null,
"notes": [],
"value": 80,
"inputs": {
"topics": [],
"has_wiki": false,
"homepage": "https://www.katatracker.com",
"has_readme": true,
"has_docs_dir": true,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 25,
"status": "met",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": "https://www.katatracker.com",
"points": 15,
"status": "met",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "moderate",
"name": "Security",
"value": 54,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "at_risk",
"name": "Security posture",
"note": null,
"notes": [],
"value": 45,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 18,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 0,
"scorecard_aggregate": 4.5
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection is not maximal on development and all release branches",
"points": 2.2,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 9/30 approved changesets -- score normalized to 3",
"points": 2.2,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 10 contributing companies or organizations",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 7",
"points": 3.5,
"status": "partial",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 8",
"points": 4,
"status": "partial",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "Project has not signed or included provenance with any releases.",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "3 existing vulnerabilities detected",
"points": 5.2,
"status": "partial",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "excellent",
"name": "Dependency advisories",
"note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories. Remaining weights renormalized. Matched 138 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"indirect_dependencies_free_of_known_advisories"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "advisories_scope_repository",
"params": {
"assessed": 138
}
},
{
"code": "advisories_repo_graph_caveat",
"params": {}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 89,
"inputs": {
"source": "osv",
"advisories": 3,
"affected_packages": 3,
"assessed_packages": 138,
"unassessed_packages": 0,
"affected_by_severity": "unknown 3",
"direct_affected_packages": 1
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "1 affected: golang.org/x/text v0.38.0 (unknown)",
"points": 26.6,
"status": "partial",
"details": [
{
"code": "advisories_affected",
"params": {
"count": 1,
"packages": "golang.org/x/text v0.38.0 (unknown)"
}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "transitive set not separable from development and test dependencies in this scope",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_scope_not_separable",
"params": {}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "no advisory has been public longer than 90 days",
"points": 40,
"status": "met",
"details": [
{
"code": "advisories_none_stale",
"params": {
"days": 90
}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "excellent",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 138,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 10
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "good",
"name": "AI Readiness",
"value": 82,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "excellent",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 85,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 1,
"agent_instruction_files": [
"AGENTS.md",
"CLAUDE.md",
"docs/workflows/agents.md"
],
"agent_instruction_max_bytes": 10653
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "AGENTS.md, CLAUDE.md, docs/workflows/agents.md",
"points": 45,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "AGENTS.md, CLAUDE.md, docs/workflows/agents.md"
}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "100 of 100 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 100,
"sampled": 100
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "excellent",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 89,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"go.sum",
"uv.lock"
],
"has_dockerfile": true,
"typed_language": true,
"bootstrap_files": [
"Makefile"
],
"has_devcontainer": false,
"has_linter_config": true,
"typecheck_configs": [],
"agent_commit_share": 0.15,
"toolchain_manifests": [
"go.mod"
],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "Makefile",
"points": 18,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Makefile"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": ".golangci.yml",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": ".golangci.yml"
}
}
],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "Go (statically typed)",
"points": 11,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "Dockerfile, lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Dockerfile, lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "15 of the last 100 commits agent-authored or agent-credited",
"points": 10,
"status": "met",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 15,
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 7",
"points": 7,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 99,
"inputs": {
"primary_language": "Go",
"largest_source_bytes": 220359,
"source_files_sampled": 774,
"oversized_source_files": 20
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Go (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "20/774 source files over 60KB",
"points": 53.6,
"status": "partial",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 774,
"oversized": 20
}
}
],
"max_points": 55
}
]
},
{
"key": "ai_interfaces",
"band": "at_risk",
"name": "Machine-readable interfaces",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"example_dirs": [],
"has_mcp_signal": false,
"api_schema_files": [
"api/openapi.yaml",
"pkg/client/openapi.yaml"
]
},
"components": [
{
"key": "api_schema_openapi_graphql_proto",
"name": "API schema (OpenAPI/GraphQL/proto)",
"detail": "api/openapi.yaml, pkg/client/openapi.yaml",
"points": 40,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "api/openapi.yaml, pkg/client/openapi.yaml"
}
}
],
"max_points": 40
},
{
"key": "mcp_server",
"name": "MCP server",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "runnable_examples",
"name": "Runnable examples",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 40
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
],
"report_type": "repository",
"generated_at": "2026-07-24T13:26:13.152035Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/k/kenn-io/kata.svg",
"full_name": "kenn-io/kata",
"license_state": "standard",
"license_spdx": "MIT"
}
Verwandte Einträge
Geprüfte Repositories, die Katalog-Tags oder Ökosysteme mit kenn-io/kata teilen. Nebeneinander lesen →
Bewertungen sind Signale, keine Garantien. Sie spiegeln öffentlich sichtbare Praxis auf GitHub wider — kein Code-Audit und keine Sicherheitsgarantie.
Fehlende Daten werden ausgeschlossen und die Gewichte neu normiert, nie als null bewertet. Die Methodik ist versioniert und offen: Metriken v1.13.0, Schema v0.27.0 — vollständige Methodik · Metriken-Wiki.
