mosaic-media / contracts

Der aufgelöste Abhängigkeitssatz konnte für diesen Bericht nicht erhoben werden: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository

{
  "data": {
    "repo": {
      "topics": [],
      "is_fork": false,
      "size_kb": 624,
      "has_wiki": true,
      "homepage": null,
      "languages": {
        "Go": 487031,
        "CSS": 6647,
        "Shell": 5400,
        "JavaScript": 8353,
        "TypeScript": 318857
      },
      "pushed_at": "2026-07-27T16:12:35Z",
      "created_at": "2026-07-20T04:34:06Z",
      "owner_type": "Organization",
      "updated_at": "2026-07-27T16:13:14Z",
      "description": "The server-driven-UI contract for Mosaic — one JSON Schema, generated bindings.",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "Apache-2.0",
      "default_branch": "main",
      "license_spdx_raw": "Apache-2.0",
      "primary_language": "Go",
      "significant_languages": [
        "Go",
        "TypeScript"
      ]
    },
    "owner": {
      "blog": null,
      "name": "Mosaic",
      "type": "Organization",
      "login": "mosaic-media",
      "company": null,
      "location": null,
      "followers": 0,
      "avatar_url": "https://avatars.githubusercontent.com/u/304150337?v=4",
      "created_at": "2026-07-12T20:17:48Z",
      "is_verified": null,
      "public_repos": 16,
      "account_age_days": 15
    },
    "license": {
      "state": "standard",
      "spdx_id": "Apache-2.0",
      "raw_spdx": "Apache-2.0",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.60.0",
          "kind": "minor",
          "published_at": "2026-07-27T16:12:02Z"
        },
        {
          "tag": "v0.59.0",
          "kind": "minor",
          "published_at": "2026-07-27T14:30:06Z"
        },
        {
          "tag": "v0.58.0",
          "kind": "minor",
          "published_at": "2026-07-27T03:07:27Z"
        },
        {
          "tag": "v0.57.0",
          "kind": "minor",
          "published_at": "2026-07-27T02:41:11Z"
        },
        {
          "tag": "v0.56.0",
          "kind": "minor",
          "published_at": "2026-07-26T22:12:37Z"
        },
        {
          "tag": "v0.55.0",
          "kind": "minor",
          "published_at": "2026-07-26T20:10:26Z"
        },
        {
          "tag": "v0.54.0",
          "kind": "minor",
          "published_at": "2026-07-26T15:30:18Z"
        },
        {
          "tag": "v0.53.0",
          "kind": "minor",
          "published_at": "2026-07-26T12:35:54Z"
        },
        {
          "tag": "v0.52.0",
          "kind": "minor",
          "published_at": "2026-07-26T12:08:26Z"
        },
        {
          "tag": "v0.51.0",
          "kind": "minor",
          "published_at": "2026-07-26T11:57:00Z"
        },
        {
          "tag": "v0.50.0",
          "kind": "minor",
          "published_at": "2026-07-26T11:39:48Z"
        },
        {
          "tag": "v0.49.0",
          "kind": "minor",
          "published_at": "2026-07-26T11:27:08Z"
        },
        {
          "tag": "v0.48.0",
          "kind": "minor",
          "published_at": "2026-07-25T19:16:27Z"
        },
        {
          "tag": "v0.45.0",
          "kind": "minor",
          "published_at": "2026-07-25T17:21:38Z"
        },
        {
          "tag": "v0.44.0",
          "kind": "minor",
          "published_at": "2026-07-25T16:20:06Z"
        },
        {
          "tag": "v0.43.0",
          "kind": "minor",
          "published_at": "2026-07-25T15:19:57Z"
        },
        {
          "tag": "v0.42.0",
          "kind": "minor",
          "published_at": "2026-07-25T14:43:16Z"
        },
        {
          "tag": "v0.41.0",
          "kind": "minor",
          "published_at": "2026-07-25T13:55:44Z"
        },
        {
          "tag": "v0.40.0",
          "kind": "minor",
          "published_at": "2026-07-25T13:47:23Z"
        },
        {
          "tag": "v0.39.0",
          "kind": "minor",
          "published_at": "2026-07-25T13:39:52Z"
        },
        {
          "tag": "v0.38.0",
          "kind": "minor",
          "published_at": "2026-07-25T13:29:48Z"
        },
        {
          "tag": "v0.37.0",
          "kind": "minor",
          "published_at": "2026-07-25T13:22:45Z"
        },
        {
          "tag": "v0.36.0",
          "kind": "minor",
          "published_at": "2026-07-25T13:07:58Z"
        },
        {
          "tag": "v0.35.0",
          "kind": "minor",
          "published_at": "2026-07-25T12:58:00Z"
        },
        {
          "tag": "v0.34.0",
          "kind": "minor",
          "published_at": "2026-07-25T12:28:55Z"
        },
        {
          "tag": "v0.33.0",
          "kind": "minor",
          "published_at": "2026-07-25T05:03:15Z"
        },
        {
          "tag": "v0.32.0",
          "kind": "minor",
          "published_at": "2026-07-25T04:39:14Z"
        },
        {
          "tag": "v0.31.0",
          "kind": "minor",
          "published_at": "2026-07-25T03:56:30Z"
        },
        {
          "tag": "v0.30.0",
          "kind": "minor",
          "published_at": "2026-07-25T03:51:48Z"
        },
        {
          "tag": "v0.29.0",
          "kind": "minor",
          "published_at": "2026-07-25T03:45:56Z"
        },
        {
          "tag": "v0.28.0",
          "kind": "minor",
          "published_at": "2026-07-25T03:42:10Z"
        },
        {
          "tag": "v0.27.0",
          "kind": "minor",
          "published_at": "2026-07-25T03:28:26Z"
        },
        {
          "tag": "v0.26.0",
          "kind": "minor",
          "published_at": "2026-07-25T03:15:12Z"
        },
        {
          "tag": "v0.25.0",
          "kind": "minor",
          "published_at": "2026-07-25T03:05:45Z"
        },
        {
          "tag": "v0.24.0",
          "kind": "minor",
          "published_at": "2026-07-25T02:50:59Z"
        },
        {
          "tag": "v0.23.0",
          "kind": "minor",
          "published_at": "2026-07-25T02:37:25Z"
        },
        {
          "tag": "v0.22.0",
          "kind": "minor",
          "published_at": "2026-07-25T02:18:38Z"
        },
        {
          "tag": "v0.21.0",
          "kind": "minor",
          "published_at": "2026-07-25T01:33:32Z"
        },
        {
          "tag": "v0.20.0",
          "kind": "minor",
          "published_at": "2026-07-25T01:20:58Z"
        },
        {
          "tag": "v0.19.0",
          "kind": "minor",
          "published_at": "2026-07-25T01:04:54Z"
        },
        {
          "tag": "v0.18.0",
          "kind": "minor",
          "published_at": "2026-07-25T00:37:12Z"
        },
        {
          "tag": "v0.17.0",
          "kind": "minor",
          "published_at": "2026-07-25T00:20:38Z"
        },
        {
          "tag": "v0.16.0",
          "kind": "minor",
          "published_at": "2026-07-24T23:04:28Z"
        },
        {
          "tag": "v0.15.0",
          "kind": "minor",
          "published_at": "2026-07-24T12:41:24Z"
        },
        {
          "tag": "v0.14.0",
          "kind": "minor",
          "published_at": "2026-07-24T02:49:06Z"
        },
        {
          "tag": "v0.13.0",
          "kind": "minor",
          "published_at": "2026-07-24T02:48:27Z"
        },
        {
          "tag": "v0.12.0",
          "kind": "minor",
          "published_at": "2026-07-24T02:28:00Z"
        },
        {
          "tag": "v0.11.0",
          "kind": "minor",
          "published_at": "2026-07-23T16:02:55Z"
        },
        {
          "tag": "v0.10.0",
          "kind": "minor",
          "published_at": "2026-07-23T12:33:04Z"
        },
        {
          "tag": "v0.9.0",
          "kind": "minor",
          "published_at": "2026-07-22T18:23:26Z"
        },
        {
          "tag": "v0.8.0",
          "kind": "minor",
          "published_at": "2026-07-22T10:04:24Z"
        },
        {
          "tag": "v0.7.0",
          "kind": "minor",
          "published_at": "2026-07-21T22:46:37Z"
        },
        {
          "tag": "v0.6.1",
          "kind": "patch",
          "published_at": "2026-07-21T22:28:04Z"
        },
        {
          "tag": "v0.6.0",
          "kind": "minor",
          "published_at": "2026-07-21T22:10:29Z"
        },
        {
          "tag": "v0.5.0",
          "kind": "minor",
          "published_at": "2026-07-21T21:36:56Z"
        },
        {
          "tag": "v0.4.0",
          "kind": "minor",
          "published_at": "2026-07-21T20:53:35Z"
        },
        {
          "tag": "v0.3.0",
          "kind": "minor",
          "published_at": "2026-07-21T14:52:47Z"
        },
        {
          "tag": "v0.2.0",
          "kind": "minor",
          "published_at": "2026-07-20T23:01:53Z"
        },
        {
          "tag": "v0.1.0",
          "kind": "minor",
          "published_at": "2026-07-20T04:39:18Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "00451a33edb28ba4014e285d5431cf2647dbfbe0",
          "body": "Five wire fields for SDK v0.26.0, batched so there is one contracts release\nand one round of module bumps rather than two.\n\nStreamLink gains container, video_codec and audio_codec. A module parses all\nthree at its own boundary (ADR 0051) and had nowhere to put them, so the parse\nwas narrowed to qual\n[…]\nubtitles yet.\n\nAdditive within the major, and every zero value is the previous behaviour, so\na module built against the older wire keeps working.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Carry container, codec and subtitle coordinates over the module wire",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-27T16:12:02Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "5f2a1b4c5e9699eca1c1f8163617f58f0f56fbcf",
          "body": "ADR 0052 needs a message whose lifetime outlives the moment it was pushed: a\nsource that stays unreachable is a condition, and a toast announces a condition\nonce and then removes itself, so a user who looked away has no way to know the\nlibrary is stale.\n\n`Toast` gains `id`, `persistent` and `cleared\n[…]\nract has\nto be nameable, so a repeat failure updates the standing notice instead of\nstacking a fifth copy, and a recovery clears the exact one it fixed.\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "A notice is a toast that stays until it is retracted",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-27T14:30:06Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "46a2eeef9d059103ea2f3ad90a0fdac10136f372",
          "body": "FilterChip is one selectable narrowing on a browse surface: a pressable\npill that draws its own selected state, with an optional count of what it\nwould leave. A definition rather than a primitive, composed from\nPressable, Text and style — so it costs no client release, which is the\ntest ADR 0024 set\n[…]\n, push: it compares package.json against\nthe newest tag in the repository, so the gate is red between the bump and\nthe tag rather than before it.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "A FilterChip, and the npm version v0.57.0 left behind",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-27T03:07:27Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "fb1c8b480dea843073223ea277854edd7d10b99d",
          "body": "M2 slice 4 needs two things to cross the process boundary, and the\nboundary drops silently what it has no field for: an SDK field with no\n`module.proto` field compiles fine, converts to nothing, and arrives as a\nzero indistinguishable from a source that did not supply one. That is how\n`HasMore`, `Cr\n[…]\nes not have: genres are\nfiltered in bulk rather than rendered in bulk, and a facet that reads an\nunvalidated document cannot be indexed honestly.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Carry catalog filters and node genres over the module wire",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-27T02:41:11Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "0006c5326bf504421a9d80c8714a323c8f240b06",
          "body": "…hen on Box\n\nThree changes the identity milestone (M1) cannot be built without, plus two\ndefinitions that were quietly broken.\n\n**AuthService.Invoke** is the pre-session counterpart of the session\ntransport's Invoke. A doorway is a screen like any other, so its controls emit\nactions like any other —\n[…]\nalidators and visibleWhen now have generated\nsugar (ui.Validators, ui.VisibleWhen, ui.FieldLabel) so that call sites stop\nsetting them by string.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "A pre-session action lane, the session's capability set, and visibleW…",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-26T22:12:37Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "446af756df9b35c73e80fe80bea14674f34b4e8a",
          "body": "Two decisions, one release, because they change the same file and shipping\nthem as two tags would leave a Platform pinned to a contract carrying half of\nwhat it needs.\n\n**Bootstrap** (ADR 0101). One unauthenticated RPC on AuthService answering with\nthe skin, the definitions the doorway needs and the\n[…]\ntachRequest.session keeps its name and changes meaning to the\naccess token, so every client sends the credential in the same place it always\ndid.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "The pre-session bootstrap, and the session as a bearer pair",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-26T20:10:26Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "47440e99b51bb89cfd1819d649644bf914fb03eb",
          "body": "Three editor and OS artefacts were ignored in some repositories and not others,\nfor no reason beyond which one was set up when. Levelled up so the same three\nlines are in all twelve. Nothing was tracked, so this only stops them appearing\nin working trees.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Ignore .vscode/ and .DS_Store, matching the other repositories",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-26T19:21:18Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "94a10c1e9394d455fb080a2771b82525c29b4420",
          "body": "JetBrains project files had been committed by accident — the .iml, modules.xml,\nvcs.xml and the IDE's own .idea/.gitignore. They are per-machine editor state\nrather than anything the repository needs, and the ignore rule alone would have\nchanged nothing, because an ignore does not apply to a file already tracked. So\nthey are untracked here as well, and left on disk.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Ignore .idea/, and stop tracking the IDE scaffolding already committed",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-26T19:18:56Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "3f0df955348bb4ada84a423fe2ef93533a90ed87",
          "body": "\"Until the first npm release lands you can install straight from git\" has been\nuntrue for a long time — `@mosaic-media/sdui` is on npm and the version check\nthat gates every run of this repository reports it agreeing at v0.54.0. The\n`npm install @mosaic-media/sdui` two lines above is the whole instruction.\n\nDeleted rather than annotated, per the documentation rule.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Drop the install-from-git fallback; the package is published",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-26T17:58:03Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "1ea96a2d8523b89fa05c31409edd7aef3779c05e",
          "body": "The test container still worked in `/src/sdui` and bind-mounted the checkout\nthere, two renames after the repository became `contracts`. It is a\nsingle-purpose container so nothing failed, but it is what a contributor reads\nwhen the drift guard goes red, and it disagreed with `platform`'s overlay, w\n[…]\nose.test.yml run --rm test` green —\nversion check, drift guard, build, tests and the TypeScript check all run from\nthe renamed working directory.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Use this repository's own name in its paths and its documentation",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-26T17:51:31Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "0fa68f0ccebf5e554d7bc20a5b50590251e8b215",
          "body": "Every module repository's release.yml reuses its own verify.yml on the tagged\ncommit and makes the release job need it. This one checked that the version\nliteral matched the tag and then published, which left the most depended-on\nartifact in the tree — the Platform, four modules and the Shell all re\n[…]\nithout this the release path would generate, build and typecheck under\nwhatever the repository default grants. Nothing in verify reads the token.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Gate the npm publish behind verify, so a tag cannot publish unverified",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-26T16:09:21Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "2cabe9ef19ea3c910758c1d237e4f696fb9d778b",
          "body": "sdk v0.23.0 and v0.24.0 added CatalogItemsResponse.HasMore,\nContentMetadata.Crew and EpisodePreview.RuntimeMinutes, but this proto had no\nfields for them, so sdk/host's converters had nothing to map them onto and\ndropped all three. An out-of-process module could not report crew, a\nper-episode runtim\n[…]\nbinary and never crosses the boundary.\n\nAll three are new field numbers on existing messages, so the change is\nwire-compatible in both directions and every zero value is the current\nbehaviour exactly.",
          "is_bot": false,
          "headline": "Give the module wire the crew, episode runtime and has-more it lacked",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-26T15:30:18Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b54740bd52fb1564efcdb99563bfd83552ed515d",
          "body": "v0.52.0 is published and does not typecheck. The sugar helper added for a trace\nrow's status colour was called `Tone`, and the TypeScript binding already\nexports a `Tone` *type* — the tones enum — so ts/ui.ts declared the name twice\nand every consumer compiling against it fails.\n\nThe helper is `Stat\n[…]\neck's failures are lowercase `error TS2440`, and the grep looking for\nproblems was matching uppercase. The gate had been telling me for two runs.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "release: v0.53.0 — rename the tone helper, which shadowed the Tone type",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-26T12:35:54Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "11b8cbeac5840ff55952d3444122784f5ab78b9e",
          "body": "release.yml fires on a v* tag and publishes the package. There is no npm publish\nto run by hand and no registry token on a developer machine, so 'publish this'\nand 'push the tag' are the same instruction — and having to say so twice is a\nsign it belonged in the file rather than in a conversation.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Write down that publishing is a pushed tag, because it keeps being asked",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-26T12:22:36Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "9af7bc04553fdf913fcb25a9b9585d3e365ed23c",
          "body": "…earing acrylic\n\nThe design does have a waterfall and it is nothing like what was built. Two\ndefinitions for it:\n\n- **SpanRow** — a name indented by depth, a bar showing its share of the whole,\n  a duration. Depth is a layout property now rather than spaces inside the\n  name, which is where it had b\n[…]\nButton\ngains `quiet` and `dangerQuiet` — the secondary and danger pills with the\nmaterial taken out, which is what the design draws on that side.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "release: v0.52.0 — the waterfall, and the administrative side stops w…",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-26T12:08:26Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "689ea68199b33acc2f9d28f0ea4d2254c1e5288f",
          "body": "Four definitions the traces and logs panels are built from, none of which the\ncontract had:\n\n- **LogTable** — records in fixed columns: time, level, service, message, trace.\n  A table rather than a stack of cards because the columns are how a log is\n  read: the eye runs down one of them looking for \n[…]\n it knows what the tallest bucket is.\n- **TraceRow** — one trace: what ran, its id, how long, and a status dot when\n  something inside it failed.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "release: v0.51.0 — the diagnostics vocabulary the design draws",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-26T11:57:00Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "e1949f65c7158e0dee152aa6ff365a03cb2188d7",
          "body": "…n can be a chip\n\nSection takes `compact`: a small uppercase label instead of a title, and the\nheading itself becomes the pressable. One flag because it is one treatment — a\nresults group is labelled, counted and entered from the same line, which is how\nthe search design draws it.\n\nButton gains `chip` and `chipOn`, the design's filter row: a 34px pill that\ncarries the accent when it is the one in force.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "release: v0.50.0 — a Section's heading can be the way in, and a Butto…",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-26T11:39:48Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "a7141065236dbb1e2219da28dbe45e0b7c8e8abd",
          "body": "… screens disagree\n\nMeasured, the design uses two: a settings panel's sections and the detail\nscreen's bands sit 24 under their headings, and the home's rails sit 14. The\ncomponent had one, hard-coded, so whichever screen was measured last was right\nand the other was quietly wrong.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "release: v0.49.0 — a Section's heading gap is authorable, because the…",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-26T11:27:08Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "0c4f9319af676bff28da84eed15cea2f04f6396c",
          "body": "…ork yet\n\nReverts v0.46.0 and v0.47.0: SignInScreen, ClaimServer, SignInPanel and\nSetupFrame are gone from the contract.\n\nThey were built and they did not render. A pre-session tree names components —\nSignInPanel, SetupFrame — and the client has never been given their definitions:\nthe library is pus\n[…]\nor the library becomes an\nunauthenticated fetch. ADRs 0097 and 0098 keep their reasoning and say in their\nstatus lines that the code was removed.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "release: v0.48.0 — withdraw the pre-session surface, which does not w…",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-25T19:16:27Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "4e7f444df462ff38cdbb8b7edf29803c15ea6d07",
          "body": "AuthService gains ClaimServer: unauthenticated, because every command that could\ngrant the first authority is itself policy-gated, and refusing once any user\nexists. ADR 0098 records the threat that accepts — whoever reaches an unclaimed\nserver first owns it — rather than burying it.\n\nSetupFrame is \n[…]\nne-off panel because the design has six\nsteps and Mosaic can answer one; the shape is right for the others as the\ncapability behind them arrives.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "release: v0.47.0 — a server nobody owns can be claimed",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-25T18:45:35Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "c6ca660c3b533489b9f678d7b0c8d9a3972cfdab",
          "body": "AuthService gains SignInScreen, which returns a UINode (ADR 0097). It is on the\nunauthenticated service because that is what it is: SessionService's every\nrequest begins with a session ref, and this is the screen you see when you have\nnone. Putting it there would have meant a method on that service \n[…]\nree carries exactly one action a client interprets itself — an invoke whose\nmutation is `signIn` — because there is no session to dispatch it on.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "release: v0.46.0 — a tree can be served before there is a session",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-25T17:45:50Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "7aabfe86695bb04b79f0763819ccbdd83dfc67cc",
          "body": "…wo rooms\n\nAppShell takes a `chrome`: \"media\" is the floating glass pills over a full-bleed\nhero, and \"admin\" is the solid 66px bar the settings side wears — a way back, the\nbrand, and a breadcrumb saying where you are. The design draws them differently\non purpose, and one frame over both made the a\n[…]\nther than a boolean. They are two rooms in the same building, and a\nthird — a player, a setup wizard — is another case rather than a second flag.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "release: v0.45.0 — the app shell has two chromes, because Mosaic is t…",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-25T17:21:38Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "75e0e681f6d4655cdcdd921533d07020c35a3326",
          "body": "SettingsRow is new: a label, an optional explanation of what it does, and a\ncontrol or a value on the right. It is the workhorse of every panel the design\ndraws, which is exactly why it is a component — a panel that assembles its own\nrows is a panel that drifts from the others.\n\nThe frame takes the \n[…]\nng badge and an `indent`, so an\ninstalled extension nests under the store it came from: one list that reads as\na hierarchy rather than two lists.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "release: v0.44.0 — the settings frame takes the design, and gains a row",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-25T16:20:06Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "eb86a13244601be20dbe9dee30e3c594b99997b4",
          "body": "…n hold a control\n\nThree things the detail screen could not say.\n\n**\"NN% screen\".** The design's hero is 88vh — short of the fold on purpose, so\nthe band under it shows and invites the scroll. The vocabulary had \"screen\"\n(the whole viewport axis) and a plain percentage (of the parent) and nothing in\n[…]\nst it filters.\n\n**Carousel's track was only ever the browse default.** It is authorable, so a\n132px cast portrait need not sit in a 196px column.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "sdui: a Dimension can be a fraction of the viewport, and a Section ca…",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-25T15:19:57Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "4418f6ab9eee3820b50c0c52f1df9118d01ba613",
          "body": "… line and a facts grid\n\nThe Detail mockup states things the vocabulary could not say and the emit-side\nwas not asking for. Six of them, all from data Mosaic already had:\n\n- FactCard, a new definition: one labelled card of short statements, for the\n  four-up band of technical facts under the cast. D\n[…]\nadded, and worth naming: InfoPanel has no footer. The design closes it with\n\"Change device\", and Mosaic has no device registry to change between.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "release: v0.42.0 — the detail screen gets its episode facts, its crew…",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-25T14:43:16Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "52fae5f354b93cb627ca5dd29ed3f2693ff3a4af",
          "body": "The column was rendering empty: a preview has neither a runtime nor a quality,\nso the mockup's duration+quality slot had nothing to put in it and collapsed to\na 0-width track that still paid for its gap. EpisodePreview does carry the air\ndate, and nothing anywhere used it.\n\nAdds an `Aired` helper and fills the column with it, guarded so it collapses\nproperly when a source gives neither.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "release: v0.41.0 — the episode row's facts column carries the air date",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-25T13:55:44Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "8b4edf9f39e57fd7276bf2c1149151e5c0187cd3",
          "body": "…design\n\nThree more pieces of the previous UI on the detail page, replaced rather than\nadjusted.\n\nEpisodeRow is the mockup's row: a 196px still, a fluid title column, a\nright-aligned facts column. It is the arrangement `gridColumns` was added for —\nauto-fill cannot state \"fixed, then everything left\n[…]\nnd its page title drops from 2xl bold to xl medium\n— the voice every other heading in the new design uses. 2xl bold was the\nprevious UI shouting.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "release: v0.40.0 — episode rows, cast and the page body take the new …",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-25T13:47:23Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "89223c0ebb52a6c43f8088a2e1fc29c215c55178",
          "body": "…ythm\n\nMeasured off the rendered mockup rather than read off its CSS, which is where\nI had it wrong. The steps are 32 / 12 / 16 / 24 / 24: a deliberate break after\nthe kicker, then a TIGHT title-and-pills cluster, then the synopsis, then air\nbefore the actions. The hierarchy is in the variation.\n\nTh\n[…]\nght the vocabulary has, and it beats\na pixel number that is wrong on every display but the one it was measured on.\nIt also matches the home hero.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "release: v0.39.0 — the detail hero's copy gets the mockup's actual rh…",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-25T13:39:52Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "676077e12c84d216c2d0f8af3091845e6df9b858",
          "body": "Measured against the mockup rather than eyeballed, and two of the three columns\nwere wrong: the poster rendered 200px against a specified 236, the panel 264\nagainst 312. The three fixed widths plus their gaps exceed the content box at\n1440, so flex took the difference out of the two columns that had\n[…]\nmn where the design puts air before the actions. A flex gap cannot\nvary per child, so the wider steps are padding on the children that need them.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "release: v0.38.0 — the detail hero's columns stop shrinking",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-25T13:29:48Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "739382e6ab88eb53065c60fe2ef87824cda7dc3e",
          "body": "… wearing it\n\nDetailHero was still the previous design with new parts bolted on: the copy\nlived inside a large floating glass slab, which the mockups do not have. Their\ndetail hero puts the copy directly on the artwork and keeps exactly one glass\nsurface — the panel on the right.\n\nRewritten to that:\n[…]\nnfoPanel takes the mockup's card treatment — radius lg, the shadow, an\nuppercase eyebrow — and stops sizing itself, since the hero owns the slot.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "release: v0.37.0 — the detail hero IS the new design, not the old one…",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-25T13:22:45Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "10d68df5fb34ae9ffd0af700e249e1bca378a4cf",
          "body": "The mockups draw the detail hero as three columns: the poster, the copy, and\nthe playback panel. DetailHero had the last two and no way to say the first,\nso a screen with a perfectly good poster in hand could not show it.\n\n`poster` renders as a 2:3 frame ahead of the copy panel, and drops below 900px\nwhere three columns do not fit.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "release: v0.36.0 — the detail hero docks its poster",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-25T13:07:58Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "83a55758bfca6f4e37107103ba087ab3163a7246",
          "body": "The hero's up-next dock is a wide slot on a wide surface, and the mockups draw\nit as a landscape tile of the backdrop with the title on the picture. A tile\nwhose title sits beneath it leaves a caption bar hanging under the hero floor.\n\n`overlayTitle` moves the title and subtitle into the frame, on a\n[…]\ndefault: a title on the picture is only legible when the tile is large enough\nto carry a scrim, which the continue-watching rail's tiles are not.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "release: v0.35.0 — MediaTile can lay its title over the artwork",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-25T12:58:00Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "de3c42104cdacec6ede65df430e6f908955d1501",
          "body": "The cinematic redesign's vocabulary: ten new style fields (scrim, glow, grain,\nhoverGroup/hoverReveal, gridColumns, overlap, borderSide/borderWidth,\nTextStyle.shadow, Image motion), the definitions reworked to the mockups, and\nEmptyState reaching its own message and action slot.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "release: v0.34.0",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-25T12:28:55Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "0319824aa295d849cf23d5af68fc34c5f5b15bb9",
          "body": "empty-state.json binds `message` and declares an `action` slot, and no builder\ncould set either: EmptyState was a two-argument constructor with variadic\nexplicitly disabled, and `message` had no sugar helper at all. Every caller\ntherefore passed its message as the *title* and no empty state anywhere\n[…]\nint is green either way, which is\nitself worth noting: `message` satisfied the \"some helper sets it\" check\nbecause Banner takes one positionally.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "sdui: EmptyState can reach its own message and action slot",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-25T12:28:29Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "823f81e56d31f4634be6d54f1ab61271d05e38a2",
          "body": "The hero's `rail` outlet was the last child of the content column, so anything\nput in it stretched the full width: the home's new \"up next\" card rendered as a\nposter the height of the viewport, standing where the hero should have been.\nIt is now a right-aligned row that hides below 900px, which is w\n[…]\n floor actually is.\n\nGrid and Carousel take the mockups' measurements — 186px grid columns, 196px\nrail tracks, and the gutters that go with them.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "sdui: the hero's rail is a dock, and the rails take the mockup metrics",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-25T06:33:34Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "c3bf9cd6d7ac07d2834f9471a2c988d001485c9a",
          "body": "The redesigned screens need eight things no BoxStyle could state, and each\nis added as a NAMED recipe rather than as the CSS the mockup wrote:\n\n  scrim      the legibility wash over artwork (bottom/top/leading/cinematic)\n  glow       the art-light bloom, from the sampled palette or the brand pair\n  \n[…]\nveil) beside PosterCard's\n2:3 browse card, Section grows the count and the hover-revealed see-all, and\nButton becomes the mockups' pill language.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "sdui: grow the style vocabulary for the cinematic screens",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-25T05:52:42Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "1bacf05285df7b234a9109264499d26ff2bdc5ca",
          "body": "The merge rule decided whose value wins when a form and the action it\ncarries both name a field. ADR 0088 said the producer's value wins, on\nthe reasoning that a server which pinned a field is stating something a\nform may not overwrite.\n\nThat is backwards, and the first real migration is what showed\n[…]\n running it, as with\nexpansion — this repository has no dispatcher, and writing one to run\nthe corpus is the manufactured drift ADR 0094 refused.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Give the submit merge a corpus, because it was wrong and nothing said so",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-25T05:03:15Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "8286ffc4e2fefc2fdbdd360a139118e87d923407",
          "body": "…out one\n\n`$value` outlived four attempts to replace it for one structural reason: the\ncollected values could only ever land at the top level of an action's input, and\na module's configureModule takes a whole settings document, so the field that\nwas typed belongs *inside* it. A literal string substi\n[…]\na primitive left the tier, and unlike Form leaving it in\n2.0.0 this one was implemented and used. Four modules and the web client change\nwith it.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Give submit a destination, and delete the primitive that existed with…",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-25T04:39:14Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "ed28b566d34fd5308ac81e892f690ebc24bc2ac6",
          "body": "The instructions described genui as emitting the builders and the registry. It\nemits six artefacts now, and a contributor reading this would not have known the\nconformance corpus exists at all — so they would change what a validator says,\nwatch every gate stay green here, and leave the client's runn\n[…]\nsame failure the thread spent thirteen slices removing,\none level up: instructions that read as complete while the thing they describe\nhas moved.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Say that the corpus exists and that the closed sets are closed",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-25T04:17:56Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "3561c78a4e2a430f32071b897c860797a804196d",
          "body": "v0.30.0 published a conformance fixture and both registries carrying version\n9.9.9 while the spec said 2.4.0. It came from verifying the drift guard: the\ncheck sets the spec version to a sentinel, and the restore afterwards put back\nui.spec.json and REFERENCE.md but not the three artefacts the same \n[…]\ner than deleted; npm forbids republishing a version,\nand a wrong artefact that is superseded and explained is more useful than one\nthat vanishes.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Correct three generated artefacts that shipped claiming vocabulary 9.9.9",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-25T03:56:30Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "0afe0314c8f8cde714baaa86db79910496de6def",
          "body": "The vocabulary is one spec generating five artefacts, negotiated on the wire,\nenforced by lint and held in parity by a corpus — and still unreadable by anyone\nwho has not read its source. Most of why DivKit and Beagle are usable by people\nwho did not write them is that both publish a reference, and \n[…]\nnd inside the generator, so a\nvocabulary concept the generator does not know to describe will appear in the\ntables and be missing from the prose.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Publish a reference, generated from the spec like everything else",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-25T03:51:48Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "3b72dd0b1047959f37a66437b4e6b980c041c13b",
          "body": "…d JSON\n\nThe comment describing the comparison rule was written with unescaped quotes, so\nthe file stopped parsing and TestExpansionCorpusIsWellFormed went red. It was\npushed anyway: the command that ran the gate was chained to a `grep`, so the\npush keyed off grep's exit status and the FAIL scrolled\n[…]\n caught by the test and then\nignored by the thing running it — which is worth more than the typo. The gate\nworked; the harness around it did not.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Repair the expansion corpus, which the previous commit left as invali…",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-25T03:46:50Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "5a1f2794d8699919de744a6f0346baedd29d2cfe",
          "body": "Running the expansion corpus against the client found seven disagreements, and\nevery one of them was the same thing: the expander emits `props: {}` and\n`children: []` where the goldens omitted them. Those are the same tree.\n\nA corpus that failed the second would be asserting a serialisation rather t\n[…]\nd the corpus now says so, because a comparison rule\nleft to each runner's judgement is a corpus that means something different in\nevery language.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "State that the corpus compares trees by meaning, not by encoding",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-25T03:45:56Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "d39ea45becb0a4aed1dc8c1ea4ddfc4258303f5c",
          "body": "The vocabulary fixture says what the contract contains. It says nothing about\nhow any of it behaves, and behaviour is where clients diverge — two\nimplementations of \"resolve a binding\" agree about the easy cases and differ\nabout the empty string, the missing path, and the object that merely looks li\n[…]\ner than an act of faith. A client that passes the corpus\nbehaves like the one that exists; a client that does not knows exactly where it\ndiffers.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Publish the conformance corpus: golden cases, not prose",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-25T03:42:10Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "c94e051e40a8e1d4c104141972b4f451feeb3335",
          "body": "// SPDX-FileCopyrightText: 2026 the Mosaic authors\n\n/*\n * Lazy lists (ADR 0093).\n *\n * A node saying `hasMore` is a page of something longer, and `loadMore` is what\n * fetches the next one. Both come from the server: a page that happens to be\n * full is not evidence there is another, and a client in\n[…]\n  }\n      },\n      { rootMargin: `0px 0px ${PREFETCH_MARGIN_PX}px 0px` },\n    );\n    io.observe(el);\n    return () => io.disconnect();\n  }, [wrapper, hasMore, loadMore, childCount]);\n}\nTS\necho written",
          "is_bot": false,
          "headline": "// SPDX-License-Identifier: AGPL-3.0-only",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-25T03:28:26Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d86b02a5cd4a8ec782b4152d1b111ac788682c41",
          "body": "…b key\n\nA web client can nearly get away without one: the browser has a tab order and a\nfocus ring, and a keyboard user gets something. A television cannot. There is no\ntab key on a remote, only a direction pad, and every press has to resolve to\nexactly one node or the viewer is stuck on a screen wi\n[…]\nssed right\" is the least reportable bug there is, since the person\nhitting it cannot get anywhere to report it from.\n\nVocabulary 2.3.0, additive.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Give the vocabulary a focus model, because a remote control has no ta…",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-25T03:15:12Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "0626fb07a408a4c78892c2ee6c0a82854b8bb892",
          "body": "…ring it\n\nRole, accessible name, heading level and live-region politeness are now props\nany node may carry. Nothing has to set them, which is exactly why they are\ndeclared now: an optional prop added later is additive, but a vocabulary that\nnever had a role model cannot grow one without revisiting e\n[…]\n second. 1-6, because a level outside the outline is a mistake\nwhose only symptom is heading navigation skipping it.\n\nVocabulary 2.2.0, additive.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Put accessibility in the vocabulary, before anything depends on infer…",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-25T03:05:45Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "659d4348cd1f0011f91fbfdb9cd7f46066136fbf",
          "body": "onAppear and onDisappear carry an Action, which is the whole design rather than\nan implementation detail: the *server* decides what being seen means, because it\nwrote the action. A client fires what it was handed and reports nothing it was\nnot asked to, so no client-to-server telemetry lane is neede\n[…]\ng attributes\neverything, and only the server knows which it has written.\n\nVocabulary 2.1.0, additive. Nothing fires yet; the client half is next.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Let a node say what to do when it is seen, and say what \"it\" is",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-25T02:50:59Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "a16a200947a3c0e56455cc0547d3b50b276c747f",
          "body": "…tion somewhere to land\n\nThe two closed sets have been declared since the vocabulary was unified and\nenforced by nobody, which is the failure mode the closed-ness exists to prevent\nrunning in reverse: a server could state a rule and no client applied it.\n\nValidateField applies a field's rules in a f\n[…]\natching nothing renders as a form-level error\nrather than being dropped, because a rejection nobody can see is worse than one\nin the wrong place.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Implement the six validators and the six predicates, and give a rejec…",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-25T02:37:25Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "06e0dc563d64cfe34210cadc1ba80d9ddebc5785",
          "body": "Form was a primitive in the vocabulary and implemented by nobody. It is a State\nscope with a submit control, which is three things that already exist, so it\nmoves to the tier where compositions live and becomes definitions/form.json: a\nState declaring the fields' variables, an Outlet for them, a for\n[…]\no deprecate — but the version is what a client reasons\nagainst, and quietly calling a tier move additive is how a version stops meaning\nanything.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Make a Form a composition, and give every input a name",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-25T02:18:38Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "6cf71531971062868518bde26876d879463d09b6",
          "body": "A tree describes one moment, and nothing carried a value between two of them. A\nTextInput held what was typed in the client's own component state, where nothing\ncould read it; the only way to get a value back out was SubmitField putting the\nliteral string \"$value\" into an action, one field at a time\n[…]\nnder — the visible form of conflating unset with the zero value.\n\nVocabulary 1.3.0, additive. Nothing emits a State yet; the client half is next.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Give the vocabulary somewhere to remember things",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-25T01:33:32Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "7f3624056eba1df724444170120055dcf1ea7ee8",
          "body": "A prop has been a literal in every position, with exactly one escape:\nSubmitField substitutes the literal string \"$value\" into its action before\ndispatching. That mechanism is specced nowhere, carries one field, and\nsubstitutes everywhere it appears — module-tmdb documents working around\nprecisely t\n[…]\nworks: retiring it needs the form scope that\nreplaces it, and it is used at nine sites across four separately released\nmodules. Vocabulary 1.2.0.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Let a prop be a binding, not only a literal",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-25T01:20:58Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "734078d5e08dc8bba3603fe4fdfc64db1661d4cc",
          "body": "The `type` vocabulary is open on purpose — that is what lets a module introduce\na component the Platform never shipped. It was also flat, which is a different\nthing and was never decided: two modules could both contribute a StatChip and\nthe second to register would replace the first, and a module co\n[…]\ngenerator bug rather than as the spec error it is.\n\nVocabulary 1.1.0: additive, and the first thing a negotiating client can use the\nversion for.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Namespace a module's types, so two of them cannot mean the same thing",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-25T01:04:54Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "19e9076f92426cff76cce7ecca282634baea9d08",
          "body": "… degrades to\n\nThe server has been emitting into the dark. The vocabulary is versioned and it\ngrows; clients are released on their own schedules; and nothing on the wire\ncarried the answer to \"can the thing I am about to send actually be drawn?\" An\nunsupported node became a placeholder on the client\n[…]\n checked by writing\na bad fallback and watching lint refuse it.\n\nNo definition declares a fallback yet; nothing in the current library needs one.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Let a client declare what it can render, and a definition say what it…",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-25T00:37:12Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "2eee001ac65b23542c6658c46044dba517098b65",
          "body": "The SDUI was three vocabularies pretending to be one. The proto enumerated ten\naction kinds, the schema nine, the authoring spec four and the client nine; the\nprimitive tier existed only as TypeScript inside the React client, so a Swift or\nKotlin client could not be written from the published contra\n[…]\nire, so it belongs to the slice that changes what a prop is.\n\nADR 0083. The Platform builds and vets against this contract with no source\nchange.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Generate one vocabulary from one spec, and gate it against drift",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-25T00:20:38Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "5053b6bb30559b1decf1531a871fb2af363bc534",
          "body": "The tag and the package version have to agree — check-versions enforces\nit here and the release workflow guards it again before publishing.\n\n0.16.0 carries the component library (definitions/*.json plus the Go and\nTS aggregates), the style vocabulary in the schema, the design tokens and\ntheir generated CSS, and Manifest.description on the module wire.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Bump the package version to 0.16.0 for release",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-24T23:04:28Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "62611f417f6f92d8d0b5ca723efa856e94e7d6ad",
          "body": "The rule was implicit, and being implicit it lost: components were\nwritten in a client for most of this repository's life while four stale\ncopies sat here looking authoritative.\n\nStates it as a hard rule, with what it cost, plus the two corollaries the\nmigration turned up — the authoring layer must keep up (the lint enforces\nit), and one prop key means one type across every component.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Write down that a component is authored here and nowhere else",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-24T22:54:35Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "1f880497fd8e39f47ff9fabba2e51592487efd7a",
          "body": "generate.sh now emits ts/definitions.gen.ts and tokens/tokens.css beside\nthe existing bindings, check-generated.sh diffs them, and package.json\nexports both (./definitions and ./tokens.css) so a JavaScript consumer\ngets the library and the skin from the contract rather than keeping a\ncopy.\n\nGuarding\n[…]\n from files in this\nrepository, and an aggregate that silently lags its source is exactly how\nthe four stale definitions here survived unnoticed.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Generate and drift-guard the two new artefacts",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-24T22:54:35Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "9a9cabdfaea1846244ddbd2e00d7ce7bc18908ce",
          "body": "sdui.OpenOverlay existed in the producer binding and had no ui helper, so\na screen that wanted to present something over itself had to reach past\nthe authoring layer to build it.\n\nHand-written rather than generated because it is the one action whose\nargument is a tree: the node rides inside the acti\n[…]\n and DismissOverlay() — the latter is what a\ncancel control emits, since an overlay never navigated anywhere and has\nnothing to navigate back to.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Add an Overlay action to the authoring layer",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-24T22:54:35Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "dd341151ea19e1bb8f3c5256c8a5e4059c9daa9d",
          "body": "An extension's card could say what a module can DO — the roles come off\nits signed manifest — and nothing about what it IS. No field for it\nexisted anywhere in the chain, so the only way to show \"AIOStreams\naggregates many sources behind one instance\" would have been a table of\nprose about other peo\n[…]\nublished one.\n\nManifest.description is optional and travels with everything else the\nmodule claims, so it is signed rather than added downstream.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Let a module say what it is, not just what it fills",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-24T22:54:35Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "05110a28af113cc2609312d1170147e886cbfe95",
          "body": "tokens/tokens.json was the definitions fault a second time: a DTCG set\nthat nothing consumed, drifted wholesale from the client's live\ntokens.css — a different color.bg, opaque surfaces where the client's\nwere translucent, a different accent entirely. The values the interface\nactually drew with live\n[…]\nrt-up, because a token set a client cannot apply leaves the\nwhole interface unstyled, and that is worth failing at boot rather than\nin a browser.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Make the design tokens contract, and servable",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-24T22:54:35Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "46ca2fa856172117dac88e300d4aba1789a5ca9d",
          "body": "Definitions were data, but the vocabulary they are written in existed\nonly inside the web package: BoxStyle and TextStyle lived in\nsdui-react/src/sdui/style.ts and nowhere else. A Flutter client could\nread every definition served to it and still not know what radius \"md\"\nor responsive {below: 720} o\n[…]\n: a field the override omits keeps its\nbase value, and null clears one, because these travel as JSON where an\nundefined member vanishes silently.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Specify the style vocabulary a definition is written in",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-24T22:54:35Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "10bbe68c85eced351f6d00e5f4bd3cd1db900d48",
          "body": "…once\n\nADR 0024 says a component is data and ADR 0040 says the Platform serves\nit. Neither was true. About thirty components lived as hand-written\nTypeScript inside the React client, and the \"server-delivered\" library\nthe Platform embedded was produced by building that package and dumping\nits object\n[…]\n cannot embed across a\n    directory boundary.\n  - ts/definitions.gen.ts — for a JavaScript consumer with no Platform\n    to ask (the storybook).\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Move the whole component library here, where a component is authored …",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-24T22:54:04Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "4159e211862ddfc15e7c240799e74230f9631ef6",
          "body": "Nineteen of the thirty-four components had no entry here at all, so the\nPlatform authored them as ui.Component(\"MediaTile\", ui.Prop(\"title\", …))\n— strings into an open props bag, checked by nothing. That is how\nui.Subtitle came to be set on a Stack, which has no subtitle in its\ntemplate: it drew not\n[…]\nch\n    reading \"true\" as text would also read the string \"false\" as on.\n  - `meta` is a hero's variadic line, so a card's provenance is `origin`.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Cover the whole component library in the authoring spec",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-24T22:54:03Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "471d5b2598a2448216edd645d295bb3fe3a34181",
          "body": "`genui -lint` cross-checks definitions/*.json against the authoring spec:\nevery prop a template binds must have a ui helper that sets it. Two false\npositives made that check unsatisfiable for most real definitions, which\nis a plausible reason so few of them ever lived here.\n\n  - An $each alias was m\n[…]\ne\ncomponents that were about to move here bind switch states and lists of\nobjects, and a spec that cannot express a boolean cannot describe them.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Teach the definition lint about $each aliases and injected bindings",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-24T22:54:03Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "13fbc15a380d060721b5cbd65112da3db33b8ba7",
          "body": "The drift guard regenerated and diffed the quicktype and genui output but\nnot gen/**/*.pb.go, the Connect and gRPC stubs, or gen-ts — the protobuf\nbindings, generated by hand and committed with no check. That is the gap\na corrupted .pb.go slipped through during the sdui -> contracts rename: a\ntextua\n[…]\nainer gate, which always has it, is what enforces it.\n\nnpm bumped to 0.15.0 to keep the tag and the package version in step, as\ncheck-versions requires.\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Drift-guard the protobuf bindings (contracts), and it caught two things",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-24T12:41:24Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "dbc01935002823832811555a8cd1d53f2f8fcff6",
          "body": "I tagged v0.13.0 with package.json still reading 0.12.0 — precisely the\nmismatch check-versions exists to catch, walked into one command after\nthe gate caught the same mistake for v0.12.0.\n\nThe tidy fix would be to delete v0.13.0, bump, and re-tag it. That is\nnot worth the risk: the Go module proxy \n[…]\n0 stands as a Go-resolvable tag carrying the module wire, and\n0.14.0 is where the npm version and the tag agree again. 0.13.0 is never\npublished to npm.\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Bump the package version to 0.14.0, skipping 0.13.0",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-24T02:49:06Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "d56f07fee3a978f8799e1f266329c515705139c9",
          "body": "mosaic/module/v1 is the fourth package in this workspace: the wire an\nout-of-process extension module speaks, carried over a Unix socket by\nhashicorp/go-plugin.\n\n**This file is not the contract**, and the header says so at length. The\ncontract is the hand-written Go in sdk — v1.Capability, the eight\n[…]\nson still said 0.11.0. The\ntag is what a Go consumer resolves and the package version is what npm\nserves; when they differ one is lying about the other.\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "The extension module wire (ADR 0064, ADR 0077)",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-24T02:48:27Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "a50f1e8fb2ed7a2c017ca864ef33a146f216d431",
          "body": "The rename commit rewrote the module path across every file that\ncontained it, including the generated .pb.go files. That corrupted them,\nand the gate caught it as a panic at package init:\n\n  panic: runtime error: slice bounds out of range [-5:]\n\nA .pb.go carries the FileDescriptorProto as a seriali\n[…]\ned by hand\nand committed, with no equivalent check. A corrupted or stale binding\nsurvives every gate here and fails at init in the consuming repository.\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Regenerate the protobuf bindings rather than rewriting them (ADR 0044)",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-24T02:28:00Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "376b57cce2872b252ee2fca080e8a2e3ce928407",
          "body": "ADR 0044 decided this repository is `contracts` and publishes two proto\npackages; the workspace, the generated Go and TypeScript and the typed\nsession envelope all landed, but the rename itself never did. The\nrecord has been claiming \"Accepted (built)\" while platform still\nrequired github.com/mosaic\n[…]\nURL, so existing clones keep working; Go does\nnot redirect a module path, so every importer needs its require and its\nimports updated, and those follow.\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Rename the module path to github.com/mosaic-media/contracts (ADR 0044)",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-24T02:22:06Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "4c0d258fb97e085ddbf2e7021220ca8ec35c82e7",
          "body": "…nistic\n\nAdds docker-compose.test.yml + Dockerfile.test (the one repo needing two\ntoolchains at once — go, gofmt, node, npx — so the drift guard can\nregenerate Go and TS together) and a \"nothing runs on the host\" section in\nCLAUDE.md and README.\n\nFour fixes the container surfaced, all pre-existing:\n\n[…]\ned: `docker compose -f docker-compose.test.yml run --rm test` is\ngreen end to end (version check, drift guard, go test, tsc typecheck; exit 0).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Run gates in a container; pin quicktype so the drift guard is determi…",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-23T18:02:06Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "9e12fd1944006b836794953166eafe73f1ae0ce3",
          "body": "Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.11.0",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-23T16:02:55Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "4f0f67163dbbddb8e686f80255b914abb5fdba9a",
          "body": "Two props: nodeId and partId. A client that reports its position needs to say\nwhat the position is *of*, and both are server decisions carried on the node\nrather than things a client works out — which keeps ADR 0047's limit where it\nis. The client owns the decoding pipeline and the transport control\n[…]\n\nwhat it sees, and does not decide what it is watching.\n\nGenerated from ui.spec.json, so the Go authoring layer and the TS mirror stay in\nstep.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "The Player node names what it is playing (ADR 0046)",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-23T16:02:42Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "6a402660b4e083c15cf6cad5e33dd26e6030d9e9",
          "body": "The server was guessing. Stream selection ranks a source's candidates against\nwhat the caller can decode (ADR 0048), and with nothing declared the Platform\nhard-coded a desktop browser's abilities at the call site — honest for one\nclient and a lie for the four the transport was built to serve (ADR 0\n[…]\nces\nthis declaration to a stable class so clients that decode the same things share\none cached resolution instead of each paying for their own.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "A client declares what it can play on Attach (ADR 0047, ADR 0049)",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-23T12:33:04Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "f4d16f5558cdaab69e533cd926ae82ce72860052",
          "body": "The Platform's client API is Connect on both lanes since ADR 0041, with one\nhole: SessionService has no way to *mint* a session. Every request on it begins\nwith a session ref, so a client with only a username and password had to reach\nfor the GraphQL signIn mutation — the single operation keeping a \n[…]\nnown` across the whole file, which breaks ts/ui.ts and has\nnothing to do with this change. That drift predates this commit and wants\npinning on its own.\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "AuthService: a client gets a session without GraphQL (ADR 0061)",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-22T18:23:26Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "aa10e54e7e0e6bcb625e524aab83ff7e50a2636f",
          "body": "Go modules no longer need this: a module is its tag, and it reads back whatever\nwas actually linked, so the number is structurally true. npm has no equivalent\n— a package.json version is a literal somebody has to remember to change, and a\nforgotten one publishes under the wrong number or silently fa\n[…]\nhave found nothing and passed.\n\nVerified both ways: it passes as-is and fails on a deliberately stale version\nwith a message naming both fixes.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Check the npm version against the git tag in CI",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-22T15:59:54Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "16211c4389e53c896006afca8729092cf4d5cbeb",
          "body": "…0047)\n\nAdds Player to the ui spec, with ResumeAt and MimeType sugar; the Go and TS\nbindings regenerate from it and the spec lint passes.\n\nPlayer is where the SDUI thesis takes its first stated limit, and the component\ndoc says so: the server decides everything about a playback session except the\nde\n[…]\nN schema is untouched), and it wants fixing as its own\npiece of work rather than riding in here.\n\nnpm typecheck, go build and go test all pass.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "The Player component: a client primitive over a playback ticket (ADR …",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-22T10:04:24Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "c85e659b2a6d13e9a52d6403b89caafe51b3891b",
          "body": "Ship the protoc-gen-es output so a web client can speak the ADR 0041 two-lane\nConnect transport:\n\n- exports \"./session\" (gen-ts SessionService descriptor + message schemas:\n  Attach/Navigate/Invoke/SubmitInput/Subscribe, ServerMessage/RegionUpdate/\n  ShellUpdate/Toast/Event, RegionUpdate_Op) and \"./\n[…]\nsumers create the client themselves: createClient(SessionService,\ntransport) — no protoc-gen-connect-es needed, the es v2 descriptor is enough.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Publish the generated TS session transport bindings (v0.7.0)",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-21T22:46:37Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "cef7773d5fdb283451415801dc6560b13604fe84",
          "body": "…6.1)\n\nAdditive helpers a producer needs to author its screens entirely through the\nui layer:\n\n- Element.BuildJSON() marshals the built UINode to the canonical protojson\n  bytes, so a producer that returns wire bytes (a module's settings UI, ADR\n  0038) need not import protojson itself — which a mod\n[…]\n(the openUrl ActionKind, the Banner type) that the ui layer\n  simply did not yet surface.\n\nRegenerated from ui.spec.json. npm unified to 0.6.1.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Add Element.BuildJSON, OpenURL action and Banner component to ui (v0.…",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-21T22:28:04Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "fb62238ff7d88915c093832f5a13344a2736e8ba",
          "body": "Make the ui authoring layer spec-driven and retire the old sdui option-bag\nbuilders.\n\nGenerator + linter (tools/genui):\n- ui.spec.json is the single source of truth for the ergonomic authoring\n  API — component constructors, typed sugar, slot helpers, action/tone\n  re-exports.\n- tools/genui emits ui\n[…]\nstremio-addons and a platform test that still call the\nbuilders — both fixed in a follow-up. npm package unified to 0.6.0 to match\nthe git tag.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Generate the ui layer from a spec; retire the sdui builders (v0.6.0)",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-21T22:10:29Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "9fc5e62df1f7a1901432bc5074463179705408d2",
          "body": "Mirror the Go sdui/ui package on the TS side as the @mosaic-media/sdui/ui\nsubpath export: a \"reads like a widget tree\" authoring layer for\nhand-writing screens (the Shell's mock payloads, storybook stories) instead\nof raw UINode JSON. build() emits exactly the UINode shape the wire carries\n(ADR 0044\n[…]\nas raw .ts alongside the generated contract (no build step, bundler\nresolution). Bumps the npm package to 0.3.0 (additive: new subpath export).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Add the declarative ui authoring layer for TypeScript",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-21T21:48:52Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "74ab6b167c8c01af3a3f3e8768751550b1e6baac",
          "body": "Introduce package ui — a \"reads like a widget tree\" authoring layer over\nthe producer binding (Flutter/Compose/Vaadin, the gomponents pattern). A\ncomponent takes ...El; children, props and slots are Els that intermix, so\na screen reads as a tree rather than a builder with option bags. The tree\ncompi\n[…]\ncers (including module-stremio-addons) keep\ncompiling. Retiring the builders is a follow-up gated on porting the last\nconsumer to the ui layer.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Add declarative ui authoring layer (v0.5.0)",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-21T21:36:56Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "789f15c70a5869bb5bdafd7e0b28021384488aab",
          "body": "@bufbuild/protoc-gen-es, @bufbuild/protobuf and typescript were added for the\nprotobuf TS generation (ADR 0044); pin them with a lockfile.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Add package-lock for the protobuf TS toolchain devDeps",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-21T20:53:35Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "ba016e2cf53794b712a5b11176b1ab38acfc2160",
          "body": "…hful)\n\nRewrites the producer ergonomic layer (sdui.go/actions.go/components.go) to build\nthe generated mosaic.sdui.v1.UINode instead of the JSON-Schema type — so a built\ntree rides the transport as a typed message (RegionUpdate.ui_node). The public\nAPI is unchanged: same constructors, same Option/P\n[…]\n- The old sdui/contract JSON-Schema Go binding is now orphaned but kept, along\n  with the schema/TS/npm side, for the additive retirement step.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Port the Go ergonomic builders to the protobuf UINode (ADR 0044, fait…",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-21T20:31:26Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "c9aed20b52c78087391c34e070db99cba6dd9c6a",
          "body": "Adds protoc-gen-es to the buf generation and emits the TS bindings for both\nmodules under gen-ts/ (sdui_pb.ts, session_pb.ts), typechecked strict. Additive:\nthe published @mosaic-media/sdui exports (the JSON-Schema TS) are untouched —\nrepackaging into the two protobuf packages (@mosaic-media/sdui,\n@\n[…]\nufbuild/protobuf is a devDependency for now (the generated TS is not yet\nexported), promoted to a runtime dependency when the packages are cut.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Generate TypeScript bindings for the protobuf contracts (ADR 0044)",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-21T18:52:06Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "f07385b2adeea1ea8e84a70849ab46af6d800128",
          "body": "…0044)\n\nLays the protobuf foundation for ADR 0044 (option b of ADR 0041) additively, so\nthe existing JSON-Schema contract stays green while the migration proceeds:\n\n- proto/mosaic/sdui/v1/sdui.proto — UINode, Action, ComponentDefinition, the\n  Tone/Surface/ActionKind enums. Open leaves (props/params\n[…]\n+ npm packaging, retiring the\nJSON-Schema pipeline, and the sdui -> contracts repo rename. go_package stays on\nthe sdui path until that rename.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Add the protobuf SDUI + session contracts alongside JSON Schema (ADR …",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-21T18:20:43Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "009c34b134def774040c2d41095f0b4622855623",
          "body": "Repos dropped the redundant mosaic- prefix on 2026-07-21 (ADR 0043):\narchitecture, platform, sdk, sdui, module-stremio-addons. Update repo names,\nGo module paths, sibling folder paths, and GitHub/Pages URLs in the living\ndocs. The three web repos (mosaic-shell, mosaic-sdui-react, mosaic-storybook)\nand the cmd/mosaic-platform code path are unchanged. Version numbers not\ntouched here.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: update repo references after mosaic- prefix drop (ADR 0043)",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-21T16:18:40Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "7934d4cc13fe019f9385ed56f31786df55bb7a43",
          "body": "…sdui\n\nRepo renamed mosaic-sdui -> sdui under the mosaic-media org. Update the Go\nmodule path, internal import paths, and the package.json repository URL.\nnpm package name (@mosaic-media/sdui) is unchanged.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: rename module path github.com/mosaic-media/mosaic-sdui -> .../…",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-21T14:52:47Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "f0ae3519f70ec69bcec7d99dce1f8243c2929bfc",
          "body": "Bump to 0.2.0 for the new Logo option + hero-banner logo binding (ADR 0034).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Release v0.2.0: HeroBanner clearlogo binding",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-20T23:01:53Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "590d19f36d6f83dc435b88ed7bd64af4a1373a29",
          "body": "Add a Logo option to the Go binding and a `logo` image binding to the HeroBanner\ndefinition (canonical hero-banner.json): when the source has a clearlogo it\nrenders as the hero's title treatment, else the text title. This was the one\ndetail-page piece with no component — PersonChip, EpisodeRow, SeasonSelector and\nCarousel already existed. Props are open, so no schema change.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "HeroBanner grows a clearlogo binding (ADR 0034)",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-20T22:54:47Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "4bf6bc23a4de80040f06c634aa07eeb3fa0e75ae",
          "body": "Enable consumers to pull the SDUI contract in per ecosystem.\n\n- Go: publishes by git tag (module proxy). Consumers `go get …@v0.1.0`.\n- npm: package.json (@mosaic-media/sdui) shipping the generated TS types plus the\n  standard definitions and tokens as data; published on a version tag by\n  .github/w\n[…]\n the drift guard, Go + conformance tests,\n  and a TypeScript typecheck on every push.\n- README: per-language consumption + the release process.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Make the contract publishable per language",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-20T04:39:18Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "5b330423b57bba1e364539e48d252ee16e935af4",
          "body": "Replace the hand-written Go and TS types with generation from one schema, so the\ncontract cannot drift across languages — the point of the repo.\n\n- schema/sdui.schema.json is now the single source of truth (consolidated from\n  the three split files into one, with $defs and internal $ref so a generat\n[…]\nchema — so the hand-written layer is held to\n  the generated contract. All tests pass.\n\nRemoves the earlier hand-written node.go / ts/types.ts.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Generate the language bindings from the schema (single source of truth)",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-20T04:30:25Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "bacba7b3ccfedc83ef70693c19809cf7d6705e3e",
          "body": "The published SDUI contract, extracted now because two Go producers already need\nit (the Platform's emit-side and a Module's), while the Shell consumes it in TS\nand a native client will in Dart — one contract, not re-written per language\n(ADR 0023 \"extract on the second consumer\"; ADR 0025).\n\n- sche\n[…]\nuild its UI against it under any licence (ADR 0022).\n\nLocal only (no remote yet). Producers wire it via a replace directive until it\nis tagged.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Scaffold mosaic-sdui: the Server-Driven-UI contract",
          "author_name": "AdamNi-7080",
          "author_login": "Pickles2235",
          "committed_at": "2026-07-20T04:12:45Z",
          "body_truncated": true,
          "is_coding_agent": true
        }
      ],
      "releases_count": 59,
      "commits_last_year": 93,
      "latest_release_at": "2026-07-27T16:12:02Z",
      "latest_release_tag": "v0.60.0",
      "releases_from_tags": true,
      "days_since_last_push": 0,
      "active_weeks_last_year": 2,
      "days_since_latest_release": 0,
      "mean_days_between_releases": 0.1
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": false,
      "health_percentage": 50,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "github.com/mosaic-media/contracts",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": true,
          "registry_url": "https://pkg.go.dev/github.com/mosaic-media/contracts",
          "is_deprecated": false,
          "latest_version": "v0.60.0",
          "repository_url": "https://github.com/mosaic-media/contracts",
          "versions_count": 59,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-27T16:12:02Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 0
        },
        {
          "name": "@mosaic-media/sdui",
          "exists": true,
          "license": "Apache-2.0",
          "keywords": [
            "mosaic",
            "sdui",
            "server-driven-ui",
            "json-schema",
            "design-tokens",
            "connect",
            "protobuf"
          ],
          "ecosystem": "npm",
          "matches_repo": true,
          "registry_url": "https://www.npmjs.com/package/@mosaic-media/sdui",
          "is_deprecated": false,
          "latest_version": "0.60.0",
          "repository_url": "https://github.com/mosaic-media/contracts",
          "versions_count": 53,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": 1,
          "monthly_downloads": 1687,
          "first_published_at": "2026-07-20T04:47:32.221000Z",
          "latest_published_at": "2026-07-27T16:13:18.405000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 0
        }
      ]
    },
    "popularity": {
      "forks": 0,
      "stars": 0,
      "watchers": 0,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 0
      },
      "star_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_stars": 0,
        "collected_at": null
      },
      "open_issues_and_prs": 0
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [],
      "has_llms_txt": false,
      "has_dockerfile": true,
      "has_mcp_signal": false,
      "bootstrap_files": [],
      "api_schema_files": [
        "proto/mosaic/auth/v1/auth.proto",
        "proto/mosaic/module/v1/module.proto",
        "proto/mosaic/sdui/v1/sdui.proto",
        "proto/mosaic/session/v1/session.proto"
      ],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [
        "go.mod"
      ],
      "largest_source_bytes": 268387,
      "source_files_sampled": 51,
      "oversized_source_files": 3,
      "agent_instruction_files": [
        "CLAUDE.md"
      ],
      "agent_instruction_max_bytes": 12763
    },
    "dependencies": {
      "manifests": [
        "go.mod",
        "package.json"
      ],
      "advisories": {
        "error": null,
        "scope": null,
        "source": null,
        "findings": [],
        "collected": false,
        "malicious": [],
        "truncated": false,
        "by_severity": {},
        "advisory_count": 0,
        "affected_count": 0,
        "assessed_count": 0,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "go",
        "npm"
      ],
      "dependencies": [
        {
          "name": "connectrpc.com/connect",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.20.0"
        },
        {
          "name": "github.com/santhosh-tekuri/jsonschema/v5",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v5.3.1"
        },
        {
          "name": "google.golang.org/grpc",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.82.1"
        },
        {
          "name": "google.golang.org/protobuf",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.36.11"
        },
        {
          "name": "@bufbuild/protobuf",
          "manifest": "package.json",
          "ecosystem": "npm",
          "version_constraint": "^2.13.0"
        }
      ],
      "all_dependencies": {
        "error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
        "source": null,
        "packages": [],
        "collected": false,
        "truncated": false,
        "total_count": null,
        "direct_count": null,
        "indirect_count": null
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 0,
        "open_issues": 0,
        "closed_ratio": null,
        "closed_issues": 0,
        "closed_unmerged_prs": 0
      },
      "bus_factor": 1,
      "bot_contributors": 0,
      "top_contributors": [
        {
          "type": "User",
          "login": "Pickles2235",
          "commits": 93,
          "avatar_url": "https://avatars.githubusercontent.com/u/32930825?v=4"
        }
      ],
      "contributors_sampled": 1,
      "top_contributor_share": 1
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "release.yml",
        "verify.yml"
      ],
      "has_docs_dir": false,
      "linter_configs": [],
      "has_editorconfig": false,
      "has_linter_config": false,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "go.sum",
        "package-lock.json"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": null,
            "reason": "no pull request found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/30 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 0,
            "reason": "project has 0 contributing companies or organizations -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 0,
            "reason": "no update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 0,
            "reason": "project was created within the last 90 days. Please review its contents carefully",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": 10,
            "reason": "packaging workflow detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 4,
            "reason": "dependency not pinned by hash detected -- score normalized to 4",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "no SAST tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 0,
            "reason": "security policy file not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": null,
            "reason": "no releases found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 1,
            "reason": "9 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "00451a33edb28ba4014e285d5431cf2647dbfbe0",
        "ran_at": "2026-07-28T07:07:16Z",
        "aggregate_score": 2.9,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": false,
      "has_dependabot_config": false
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-27T16:13:17Z",
      "oldest_open_prs": [],
      "last_merged_pr_at": null,
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": []
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/mosaic-media/contracts",
    "host": "github.com",
    "name": "contracts",
    "owner": "mosaic-media"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "at_risk",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 44,
      "inputs": {
        "security": 29,
        "vitality": 68,
        "community": 31,
        "governance": 33,
        "engineering": 56
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "moderate",
        "name": "Vitality",
        "value": 68,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "moderate",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 55,
            "inputs": {
              "commits_last_year": 93,
              "human_commit_share": 1,
              "days_since_last_push": 0,
              "active_weeks_last_year": 2
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 0 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 0
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "2/52 weeks with commits",
                "points": 1.4,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 2
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "93 commits in the last year",
                "points": 17.7,
                "status": "partial",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 93
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 88,
            "inputs": {
              "releases_count": 59,
              "latest_release_tag": "v0.60.0",
              "releases_from_tags": true,
              "days_since_latest_release": 0,
              "mean_days_between_releases": 0.1
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "59 version tags (no GitHub releases)",
                "points": 16.2,
                "status": "partial",
                "details": [
                  {
                    "code": "version_tags_no_releases",
                    "params": {
                      "count": 59
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 0 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 0
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~0.1 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 0.1
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "at_risk",
        "name": "Community & Adoption",
        "value": 31,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 1,
            "inputs": {
              "forks": 0,
              "stars": 0,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "0 stars",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "0 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "moderate",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 50,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": false,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (Apache-2.0)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "Apache-2.0"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          },
          {
            "key": "ecosystem_adoption",
            "band": "moderate",
            "name": "Ecosystem adoption (downloads)",
            "note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "registry_dependents"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 54,
            "inputs": {
              "packages": [
                "github.com/mosaic-media/contracts",
                "@mosaic-media/sdui"
              ],
              "dependents": null,
              "ecosystems": "go, npm",
              "total_downloads": null,
              "monthly_downloads": 1687
            },
            "components": [
              {
                "key": "monthly_downloads",
                "name": "Monthly downloads",
                "detail": "1,687 downloads/month across go, npm",
                "points": 43,
                "status": "partial",
                "details": [
                  {
                    "code": "downloads_monthly",
                    "params": {
                      "count": 1687,
                      "ecosystems": "go, npm"
                    }
                  }
                ],
                "max_points": 80
              },
              {
                "key": "registry_dependents",
                "name": "Registry dependents",
                "detail": "not reported by this ecosystem",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_reported_by_this_ecosystem",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "at_risk",
        "name": "Sustainability & Governance",
        "value": 33,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 10,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 1,
              "top_contributor_share": 1
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 100% of commits",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 100
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "1 contributors",
                "points": 1.4,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 0 contributing companies or organizations -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "critical",
            "name": "Issue & PR responsiveness",
            "note": "Excluded from scoring (no data or not applicable): Issue resolution, PR acceptance. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "issue_resolution",
                    "pr_acceptance"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 1,
            "inputs": {
              "merged_prs": 0,
              "open_issues": 0,
              "closed_issues": 0,
              "issue_closed_ratio": null,
              "closed_unmerged_prs": 0
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "no issues or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_issues_or_data",
                    "params": {}
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "no decided pull requests or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_decided_prs_or_data",
                    "params": {}
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "at_risk",
            "name": "Ownership & stewardship",
            "note": null,
            "notes": [],
            "value": 39,
            "inputs": {
              "followers": 0,
              "owner_type": "Organization",
              "is_verified": null,
              "owner_login": "mosaic-media",
              "public_repos": 16,
              "account_age_days": 15
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "organization-owned",
                "points": 30,
                "status": "met",
                "details": [
                  {
                    "code": "owner_organization",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "0 followers of mosaic-media",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 0,
                      "login": "mosaic-media"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "16 public repos, account ~0 yr old",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 16
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 0
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "github.com/mosaic-media/contracts",
                "@mosaic-media/sdui"
              ],
              "ecosystems": "go, npm",
              "any_deprecated": false,
              "min_days_since_publish": 0
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "2 package(s) on go, npm",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 2,
                      "ecosystems": "go, npm"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 0 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 0
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "59 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 59
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "moderate",
        "name": "Engineering Quality",
        "value": 56,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "moderate",
            "name": "Engineering practices",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_ci_tests"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 60,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": false,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "2 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "moderate",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 50,
            "inputs": {
              "topics": [],
              "has_wiki": true,
              "homepage": null,
              "has_readme": true,
              "has_docs_dir": false,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "critical",
        "name": "Security",
        "value": 29,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "critical",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): CI-Tests, Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "ci_tests",
                    "signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 29,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 16,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 2,
              "scorecard_aggregate": 2.9
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 0 contributing companies or organizations -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "no update tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 4",
                "points": 2,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "no SAST tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file not detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "9 existing vulnerabilities detected",
                "points": 0.8,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "good",
        "name": "AI Readiness",
        "value": 74,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "excellent",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 0.989,
              "agent_instruction_files": [
                "CLAUDE.md"
              ],
              "agent_instruction_max_bytes": 12763
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "CLAUDE.md",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "CLAUDE.md"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "92 of 93 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 92,
                      "sampled": 93
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "good",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 70,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "go.sum",
                "package-lock.json"
              ],
              "has_dockerfile": true,
              "typed_language": true,
              "bootstrap_files": [],
              "has_devcontainer": false,
              "has_linter_config": false,
              "typecheck_configs": [],
              "agent_commit_share": 0.978,
              "toolchain_manifests": [
                "go.mod"
              ],
              "dependency_bot_commit_share": 0
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "go.mod (toolchain convention, no task runner)",
                "points": 12.6,
                "status": "partial",
                "details": [
                  {
                    "code": "toolchain_convention",
                    "params": {
                      "files": "go.mod"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "Go (statically typed)",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "Dockerfile, lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Dockerfile, lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "91 of the last 93 commits agent-authored or agent-credited",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "agent_authored_commits",
                    "params": {
                      "count": 91,
                      "sampled": 93
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "no automated dependency updates observed",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_dependency_automation",
                    "params": {}
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 4",
                "points": 4,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 97,
            "inputs": {
              "primary_language": "Go",
              "largest_source_bytes": 268387,
              "source_files_sampled": 51,
              "oversized_source_files": 3
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Go (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "3/51 source files over 60KB",
                "points": 51.8,
                "status": "partial",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 51,
                      "oversized": 3
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "at_risk",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "example_dirs": [],
              "has_mcp_signal": false,
              "api_schema_files": [
                "proto/mosaic/auth/v1/auth.proto",
                "proto/mosaic/module/v1/module.proto",
                "proto/mosaic/sdui/v1/sdui.proto",
                "proto/mosaic/session/v1/session.proto"
              ]
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": "proto/mosaic/auth/v1/auth.proto, proto/mosaic/module/v1/module.proto, proto/mosaic/sdui/v1/sdui.proto, proto/mosaic/session/v1/session.proto",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "proto/mosaic/auth/v1/auth.proto, proto/mosaic/module/v1/module.proto, proto/mosaic/sdui/v1/sdui.proto, proto/mosaic/session/v1/session.proto"
                    }
                  }
                ],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
    "deps.dev does not index npm:@mosaic-media/sdui@0.60.0; advisories assessed against the repository dependency graph instead"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-28T07:07:23.607207Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/m/mosaic-media/contracts.svg",
  "full_name": "mosaic-media/contracts",
  "license_state": "standard",
  "license_spdx": "Apache-2.0"
}