Self-hosted agentic OS — connects Claude Code, Codex or Hermes Agent to Discord, Telegram, WhatsApp, Slack & Email. EU AI Act 2026 & GDPR compliance by architecture.
Python · TypeScriptApache-2.0★ 19 estrellas⑂ 4 forksdesde jun 2026Ver en GitHub ↗
CorvinLabs/CorvinOS tiene un índice de salud de 60 sobre 100, lo que lo sitúa en la banda Moderado. Su puntuación más alta es Engineering Quality (84/100) y la más baja, Security (32/100). Se actualizó por última vez hoy. Una sola persona concentra la mayor parte del trabajo reciente.
60
global / 100
Moderado
Índice de salud del software
Las métricas se agrupan en categorías ponderadas sobre una escala de 1 a 100. El resultado global parte de su media; cuando la evidencia pública activa la Política de Jurisdicciones de Alto Riesgo, la calificación se ajusta y recibe el límite 49 (En riesgo). Preparación para IA queda fuera.
60
Excelente85-100Ejemplar; cumple prácticamente todos los criterios evaluados
Bueno70-84Saludable; carencias menores
Moderado50-69Aceptable con carencias notables; se recomienda revisión
En riesgo30-49Debilidades significativas; su adopción exige cautela
Crítico1-29Problemas graves (proyecto abandonado, un solo mantenedor, sin higiene)
Perfil de puntuación
Cada eje es una categoría. La forma importa más que la media: un proyecto sano llena toda la figura, mientras que un perfil de picos y cráteres indica que la fortaleza en una dimensión enmascara el riesgo en otra.
¿Hasta qué punto está el repositorio preparado para desarrollarse y mantenerse con agentes de codificación de IA? Es una insignia independiente y experimental — peso 0,0, de modo que se presenta por separado y no afecta a la puntuación de salud global.
Esquema de API (OpenAPI/GraphQL/proto) — core/gateway/corvin_gateway/grpc/corvin.proto
20/20
Servidor MCP
40/40
Ejemplos ejecutables — examples
Datos de entrada utilizados
example_dirs
examples
has_mcp_signal
sí
api_schema_files
core/gateway/corvin_gateway/grpc/corvin.proto
Datos clave
19estrellas de GitHub
1contribuidores
574commits en los últimos 12 meses
0días desde el último push
11versiones publicadas
1factor bus
0issues abiertas
npm, PyPIecosistemas de paquetes
Advertencias de recopilación de datos
Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
deps.dev does not index pypi:corvinos@0.10.62; advisories assessed against the repository dependency graph instead
Más detalle
Historial de estrellas y forks 0 ★ / 4 ⇿
0Estrellas
4Forks
Cuándo se añadió cada estrella y fork, recopilado de GitHub y agrupado por día. El crecimiento acumulado se sitúa justo encima de las adiciones diarias que lo componen, de modo que ambos se leen en conjunto: la acumulación orgánica sostenida no se parece en nada a un pico abrupto y efímero. Cuando esa diferencia es medible, se informa como autenticidad del crecimiento.
OpenSSF Scorecard 3.2 / 10
3.2agregado
Evaluación de seguridad independiente y agnóstica en cuanto a herramientas, procedente del proyecto de código abierto OpenSSF Scorecard. Cada comprobación premia una práctica de seguridad, no la herramienta de un proveedor concreto. Las comprobaciones que Scorecard no pudo determinar se marcan como n/d y se excluyen de la puntuación de seguridad (nunca se cuentan como cero).Scorecard v5.5.0 · 2026-07-24 20:49 UTC
No fue posible recopilar el conjunto de dependencias resuelto para este informe: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
Informe JSON sin procesar legible por máquina
{
"data": {
"repo": {
"topics": [
"agentic-ai",
"ai-assistant",
"eu-ai-act",
"gdpr",
"llm",
"ollama",
"privacy",
"self-hosted",
"agentic",
"agentic-framework",
"agentic-os",
"agentic-workflows",
"claude-code",
"hermes-agent",
"ai-compliance",
"ai-governance",
"discord-bot",
"gdpr-compliant",
"python",
"telegram-bot"
],
"is_fork": false,
"size_kb": 20763,
"has_wiki": false,
"homepage": "https://corvin-labs.com",
"languages": {
"Go": 10949,
"CSS": 6401,
"MDX": 12060,
"HTML": 32261,
"Shell": 312989,
"Python": 19053021,
"Dockerfile": 9095,
"JavaScript": 826330,
"PowerShell": 51015,
"TypeScript": 3098870,
"Go Template": 915,
"Standard ML": 833
},
"pushed_at": "2026-07-24T20:29:56Z",
"created_at": "2026-06-28T23:12:56Z",
"owner_type": "Organization",
"updated_at": "2026-07-24T20:29:59Z",
"description": "Self-hosted agentic OS — connects Claude Code, Codex or Hermes Agent to Discord, Telegram, WhatsApp, Slack & Email. EU AI Act 2026 & GDPR compliance by architecture.",
"is_archived": false,
"is_disabled": false,
"license_spdx": "Apache-2.0",
"default_branch": "main",
"license_spdx_raw": "Apache-2.0",
"primary_language": "Python",
"significant_languages": [
"Python",
"TypeScript"
]
},
"owner": {
"blog": null,
"name": null,
"type": "Organization",
"login": "CorvinLabs",
"company": null,
"location": null,
"followers": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/289506478?v=4",
"created_at": "2026-05-31T22:06:16Z",
"is_verified": null,
"public_repos": 5,
"account_age_days": 53
},
"license": {
"state": "standard",
"spdx_id": "Apache-2.0",
"raw_spdx": "Apache-2.0",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v0.10.58",
"kind": "patch",
"published_at": "2026-07-22T09:38:22Z"
},
{
"tag": "v0.10.57",
"kind": "patch",
"published_at": "2026-07-22T09:38:22Z"
},
{
"tag": "v0.10.56",
"kind": "patch",
"published_at": "2026-07-22T09:38:21Z"
},
{
"tag": "v0.10.54",
"kind": "patch",
"published_at": "2026-07-22T09:38:11Z"
},
{
"tag": "v0.10.55",
"kind": "patch",
"published_at": "2026-07-22T09:38:20Z"
},
{
"tag": "v0.10.53",
"kind": "patch",
"published_at": "2026-07-22T09:38:10Z"
},
{
"tag": "v0.10.52",
"kind": "patch",
"published_at": "2026-07-22T09:38:10Z"
},
{
"tag": "v0.10.51",
"kind": "patch",
"published_at": "2026-07-22T09:38:09Z"
},
{
"tag": "v0.10.50",
"kind": "patch",
"published_at": "2026-07-20T14:58:24Z"
},
{
"tag": "v0.9.60",
"kind": "patch",
"published_at": "2026-07-01T17:53:35Z"
},
{
"tag": "v0.9.59",
"kind": "patch",
"published_at": "2026-06-30T22:49:52Z"
}
],
"recent_commits": [
{
"oid": "57a1cf7000be5e04b156dc1f2c915ca165f3c7cc",
"body": "Independent review of 4b7bc77 found 5 issues; correctness ones fixed here.\n\nCRITICAL — error envelopes were booked as successful steps. claude -p\n--output-format json returns is_error=true with rc=0 for soft failures\n(error_max_turns — ROUTINE under --max-turns 1 --disallowedTools \"*\" — and\nAPI erro\n[…]\ns error non-leak,\nnon-success subtype, tokens_by_kind), verified against the REAL success\nenvelope (error=None), full non-live TDE suite green.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(tde): ADR-0218 Phase 0 hardening — adversarial-review findings",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-24T20:29:54Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "d16eb68e90ad3b863dac7cacc33e17b8b182f676",
"body": "…l review)\n\nMaintainer decision (ADR-0217): within the console's delegated branch, TDE is\nnow the DEFAULT delegation engine; ACS runs only for big-data-shaped tasks, the\nexplicit /delegate override, and the unavailable/pool-exhausted degrade. Routing\nis a pure, deterministic function (_delegation_en\n[…]\n/L34/quota/injection suites pass. Also fixes CorvinLogs telemetry:\ncorvin_version pyproject fallback (59% \"unknown\") + a stale-lock flock guard.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "release: v0.10.62 — ADR-0217 TDE-first delegation (9-round adversaria…",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-24T19:22:55Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "4b7bc77e2d1c1dda3d63e8e017c08709fe8133d5",
"body": "The prerequisite for any token-saving delegation work: there was no per-token\nsignal at all. Workers ran `--output-format text`, so `token_savings_pct` was\nstructurally None and `token_usage_instrumented` False — every savings claim\nunfalsifiable (no gradient, in LDD terms).\n\nChange (measurement-onl\n[…]\nCorvin-ADR\nADR-0218 Phase-0 bullet marked implemented (status stays Proposed — routing is\nstill gated on the Phase-1 measurement this unlocks).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(tde): ADR-0218 Phase 0 — real per-step token instrumentation",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-24T19:05:01Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "366770a0974774ab0c2e8472e0dedf37e3caa5b3",
"body": "… TTS\n\nSymptom (reported with a screenshot): \"TTS failed: {\"detail\":\"invalid CSRF\ntoken\"}\" in the web console. The csrf_token is a pure HMAC of the session id\nwith the session's csrf_secret, so it survives a server restart — but it goes\nstale when the session rotates (re-login / tier change) or duri\n[…]\n3s only — a re-auth 403 does not trigger it. 61/61 api unit\ntests (3 new), tsc clean on the changed files, frontend rebuilt, console\nrestarted.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(console): auto-recover from a stale CSRF token instead of failing…",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-24T17:17:50Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e2142716fd13ccf77a5630cb458c4df63313bb67",
"body": "Added _route_rag_source() handler to support RAG (Knowledge Base) source\nregistration via CCC (Chat Command Center).\n\n**What was broken:**\n- CCC prompts with 'url=<source>' returned 'Entity type rag_source not implemented'\n- RAG was defined in entity_extract.py but had no routing handler\n\n**What's f\n[…]\namp\n\nUsers can now say: 'Add knowledge base url=https://docs.example.com'\nor: 'Register RAG source url=/path/to/docs.pdf type=pdf name=MyDocs'\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(chat-router): Implement rag_source entity routing",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-24T17:09:53Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "566b3f0205f758518665739c04f2580e5cffb138",
"body": "…compute pool (ADR-0216)\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "release: v0.10.61 — TDE production-readiness review + shared agentic-…",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-24T13:56:01Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "b5671d24efd2389cc358ccac143f152dfb074fb1",
"body": "…pool (free tier 10/day)\n\nThe e2e counter tests pinned the old free-tier value (1/day) literally.\nThey now read the limit dynamically via validator.get_limit and burn the\nwhole pool before asserting the over-quota rejection, so a future tier\nchange cannot silently rot them again.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "test(license): adapt console e2e/proof suites to the ADR-0216 shared …",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-24T13:55:55Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "2daf7ad6383c7a4082c2c22736ae8baa654c12ab",
"body": "…framing from the simulation package\n\noperator/benchmarking/ is a deterministic SIMULATION that encodes the very\nsavings ratios it then 'finds' (harness._simulate_tokens; nothing imports\nor executes TDE). The analysis code bucketed a pseudo p-value and then\nUNCONDITIONALLY forced p=0.01 for any mean\n[…]\nasured counterpart remains operator/orchestration/tde/\nbench.py (real SendIntegration runs; wall-clock only until token\ninstrumentation exists).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(benchmark): honesty pass — remove fabricated p-value and 'proof' …",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-24T11:57:14Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "9ba544c51ba5686bc27b88d745c1bedcd758151f",
"body": "…aches ChatMessages (live + reload)\n\nThe k=8 backend persistence was write-only dead data: tdeProgress was\ndeclared on ChatMessage but assigned NOWHERE in the frontend — the TDE\nmetrics card never rendered, live or after reload, and the commit-a6293f0\nhandler comment claiming hydration 'already popu\n[…]\n measured latency delta and an\n honest 'not measured' for token savings (ADR-0215 honesty contract).\n\ntsc --noEmit clean; vitest 844/844 green.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(tde-visibility): complete the k=8 chain — tdeProgress actually re…",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-24T11:57:01Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "296a6fa8bc836cc2b580573758604e35fd8649d3",
"body": "…-scoped audit graph, quota chokepoint hardening (ADR-0216)\n\nFour-axis review of the last 3 days (TDE core / audit chain / graph /\nADR-0215 infra); every confirmed backend finding fixed:\n\nAudit chain (GDPR Art. 30/32, load-bearing):\n- tde.l34_prescan now emits via tde_audit onto the canonical hash c\n[…]\nwned a real claude CLI.\n- two aspirational routing examples xfail'd (conservative canary\n fallback is deliberate) instead of failing the suite.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(tde): adversarial-review round — hash-chained L34 prescan, tenant…",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-24T11:56:48Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "571db37e92dc6c948c5dbe3fe7e2be84db21125e",
"body": "- Fixed text color contrast in all 6 TDE diagrams (01-06)\n - Changed from dark (#1a1a1a, #333) to pure black (#000)\n - Ensures visibility on both light and dark backgrounds\n - Tested for accessibility\n\n- Created 07-tde-data-flow.svg (new diagram)\n - Professional flowchart replacing ASCII box dia\n[…]\ncheme documentation\n - Verified visibility on light and dark backgrounds\n\nAll diagrams now use consistent color scheme with maximum contrast.\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs(tde): fix SVG diagram visibility and replace ASCII flowchart",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-24T11:17:01Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "05ab806356bf9601f6deadf800bceb389a7b7b46",
"body": "- Point main navigation to docs/TDE_COMPREHENSIVE.md as flagship entry\n- Update TDE feature section to emphasize evidence-based token savings\n- Link directly to benchmark harness for reproducibility\n- Streamlined description focusing on practical benefits and science\n\nThe comprehensive guide now ser\n[…]\now to verify and run your own tests\n ✅ Production deployment guidance\n\nREADME change signals: TDE is now a primary product feature with\nfull documentation backing, not a secondary experimental layer.",
"is_bot": false,
"headline": "docs: update README to highlight TDE comprehensive documentation",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-24T11:08:09Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "015740c3d340502db92bf5873cbf8e04804ad6f2",
"body": "Create comprehensive TDE_COMPREHENSIVE.md (5000+ words):\n - High-level overview with core promise\n - Problem statement with cost analysis\n - Three-engine solution with routing logic\n - Deep dive into 5-signal detector with example\n - Real benchmark evidence with category breakdown\n - Three mec\n[…]\nnext steps\n\nThis is production-grade documentation suitable for:\n - Enterprise adoption decisions\n - Token savings ROI calculations\n - Technical architecture reviews\n - Research/academic reference",
"is_bot": false,
"headline": "docs: add comprehensive TDE documentation with detailed diagrams",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-24T11:07:41Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "397195e43106299ea7b9e47b5986681b6c413a9a",
"body": "… fires\n\nThe bounded no-LLM fallback (previous commit) is the safety net; this closes\nthe gap that actually trips it. For an active user the only realistic way both\nsummary backends fail is a COLD local model on the first voice note after boot —\na cold qwen3:8b load overruns the 60 s summary timeout\n[…]\n; _hermes_base_url\nadds the scheme for a bare host:port. summarize 36/36.\n\nCloses the reliability follow-up noted in the previous voice commit.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(voice): prewarm the summary model at boot so the fallback rarely…",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-24T10:54:14Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "a6293f0c77799981d81406f91504826b9a39ccf5",
"body": "…0214)\n\nMove TDE delegation metrics computation from frontend to backend. TDE-Engine now\npopulates tdeProgress after execution, attaches to ChatMessage via _append_turn,\nand auto-persists to turns.jsonl. Frontend no longer needs React Query caching.\n\nArchitecture fix (k=8 from docs/tde-visibility-bl\n[…]\n1158)\n\nBackward compatible: turns.jsonl entries without tde_progress field are valid;\nfrontend reads whatever is there (graceful degradation).\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(tde-visibility): k=8 — Backend persistence for tdeProgress (ADR-…",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-24T10:49:51Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "d43f9cedd238e355810fbdb2cdccb0aa2864b659",
"body": "…on + tests\n\nCompletes the voice-summary rework whose core (summarize.py + adapter.py +\ntest_adapter_voice_lang_detect.py) was accidentally swept into the concurrent\ncommit bf96d04 (\"docs(tde-visibility)…\") by a parallel session's `git add -A`\nwhile it was still uncommitted here. Those files are alr\n[…]\n90.\n\nRemaining follow-up (not this commit): keep an LLM backend warm so the bounded\ndegraded path rarely fires — the deeper \"stable\" guarantee.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(voice): always a human summary in the profile language — completi…",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-24T10:37:19Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "bf96d04a2deac8de1f863bdb387e02311d80876e",
"body": "…ision\n\nTDE-Visibility feature k=1 through k=7 (commits cd1fce7..5956239) implemented\nmetrics visualization and audit-graph wiring. Comprehensive adversarial review\n(6 angles, 72 findings, verified via LLM E2E) exposed 3 CRITICAL blockers in\nk=4b implementation:\n\n1. Persistence Architecture Broken (\n[…]\n), k=9 (1-2h optional).\n\nAlso includes voice-summary fixes from earlier iterations (BUG-1.2 language\nrouting, BUG-2.3 timing, GDPR audit gap).\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs(tde-visibility): Document k=8+k=9 blockers and architectural dec…",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-24T10:24:29Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "5956239b818d1c45d03158da2d83c8e3211b828a",
"body": "…placeholder\n\nk=6 (Graph Rendering): ComputeGraphView already supports mode='tde' —\ndecision-tree graph rendering is LIVE via existing infrastructure.\nTdeAuditGraphPanel calls ComputeGraphView with run_id auto-resolution.\n\nk=7 (Token-Savings Visualization): Added placeholder card in metrics panel.\n'\n[…]\npending' — estimated 30-70% savings vs. full model.\nWill integrate actual values once TDE-Engine computes token_savings_pct.\n\nType-check: ✅ OK. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(tde-visibility): k=6+k=7 — Full graph rendering + token-savings …",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-24T09:58:57Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "48b26caede86fdc2f7083cdb0633435cf0a0382b",
"body": "Create 4 professional SVG diagrams replacing inline ASCII art:\n\n1. 01-problem-current-architecture.svg\n - Shows one-engine-fits-all problem\n - Claude Code vs ACS tradeoffs\n - 95% inefficient routing issue\n\n2. 02-solution-tde-routing.svg\n - TDE three-engine routing architecture\n - 5-signal \n[…]\nart.\n\nSVGs are:\n ✅ Professional, publication-ready quality\n ✅ Optimized for web and print\n ✅ Accessible in all markdown viewers\n ✅ Embeddable in documentation tools\n ✅ Easy to update and maintain",
"is_bot": false,
"headline": "docs: add professional SVG diagrams for TDE guide",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-24T09:57:39Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "0b89c60a71b23ef4d30823bc17740e0ce168b214",
"body": "Phase 5 (Visualization): TdeAuditGraphPanel now displays persisted tde_progress\nmetrics in a compact card above the graph:\n- Steps: completed/total\n- Delegated count\n- Local count\n- L34 Gate status (color-coded: red=blocked, green=allowed)\n\nReads from message.tde_progress (k=4b persistent layer). Survives reload.\n\nType-check: ✅ OK. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(tde-visibility): Add TDE metrics card to audit graph panel",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-24T09:51:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ffaee3a8ca9b185b3ecb278f3ba8b3723df8e0dc",
"body": "…y docs\n\nImplements the four items left open at the end of the ADR-0215 adversarial\nreview session.\n\n1. Root-caused and fixed the test_adapter_security_hardening.py flake\n (11 tests, previously mischaracterized as \"pre-existing, unexplained\").\n Bisection traced it to test_adapter_btw.py / test_a\n[…]\nt session's broad `git add`\nbefore this commit — verified intact and unchanged by inspection, not\nre-committed here to avoid duplicate history.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(adr-0215): open-items follow-up — env-leak flake, WA race, honest…",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-24T09:49:31Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "683217cb1897fe258e97f97c414dd98a43ac45b1",
"body": "- Inline SVG diagrams don't render in all Markdown viewers\n- Replaced with ASCII-art equivalents that display everywhere\n- SVG files extracted to docs/diagrams/ for reference\n- Add text placeholders linking to diagram folder\n- Improves readability on GitHub, GitLab, all Markdown renderers\n\nNow readable in:\n ✅ GitHub/GitLab web UI\n ✅ All Markdown viewers\n ✅ Plain text editors\n ✅ Email clients",
"is_bot": false,
"headline": "fix: replace inline SVGs with ASCII art + placeholders",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-24T09:17:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "45690674ee1359126b69f5d1c66d935fc3453fc7",
"body": "…sistence\n\nPhase 4b (Handler Logic): engine_progress now attaches tde_progress to the\nlatest assistant message via React Query setQueryData. This persists the\ndelegation metrics to turns.jsonl automatically.\n\nOn reload/reconnect, audit graph can reconstruct the full TDE delegation tree\nfrom message.tde_progress (not ephemeral anymore). Imports: SessionState, TdeProgress.\n\nType-check: ✅ OK. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(tde-visibility): Wire engine_progress handler to ChatMessage per…",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-24T09:09:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "15cbf84ca53093285139c071dd62e138582cf7aa",
"body": "Phase 4a (Frontend Types): Define TdeProgress struct for persistence.\nUpdate ChatMessage interface to include optional tde_progress field.\n\nPhase 4b (Handler Logic) deferred to next session:\n- Update chat.tsx engine_progress handler to attach progress to message\n- Wire React Query setQueryData to persist to turns.jsonl\n- Audit graph will read from message.tde_progress (not ephemeral)\n\nType-check: ✅ OK. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(tde-visibility): Add TdeProgress interface to ChatMessage",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-24T09:05:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fcb6aaf0d690db1bdbf119c2c86f874865eb6163",
"body": "…t. 30)\n\nCRITICAL Compliance Fix: TDE L34-gate decision was never logged to formal\naudit trail. Now emits tde.l34_prescan event with decision + counts.\n\nRemoved token_savings_pct from engine_progress event (TODO: TDE-Engine must\ncalculate actual savings; currently always 0). Will re-add once compute\n[…]\nage (only console.debug)\n- token_savings_pct not calculated (TDE-Engine dependency)\n- Zero-step plans don't emit engine_progress\n\nSyntax: ✅ OK. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(tde-visibility): Add audit_emit for L34 prescan decision (GDPR Ar…",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-24T08:43:48Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "34f5d29d1bd1f45cb73febf1094bce468025755a",
"body": "- Main navigation now links to both guide and benchmark study\n- Updates percentage from 40-70% to proven 48.8%\n- TDE section references reproducible results (seed=42)",
"is_bot": false,
"headline": "docs: link TDE benchmark scientific paper in README",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-24T08:31:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6c9e8def9a01422f9fe1047fa98b20f985593de2",
"body": "…h results\n\nImplements deterministic TDE vs Claude Code benchmarking:\n\nBENCHMARK INFRASTRUCTURE:\n - operator/benchmarking/harness.py: Main runner + simulation model\n - operator/benchmarking/token_collector.py: Token tracking instrumentation\n - operator/benchmarking/analysis.py: Statistical analys\n[…]\nn of 3 savings mechanisms (context carryover, parallelization, task enablement)\n - Production deployment recommendations\n\nAll results are reproducible: python3 operator/benchmarking/run_benchmarks.py",
"is_bot": false,
"headline": "feat(tde-benchmark): add comprehensive scientific benchmark suite wit…",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-24T08:30:45Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "faaab4ac89e8b20bd310484dd0159be3e7848ad6",
"body": "Found during the ADR-0215 iterative adversarial review of the bridge\nadapter, and independently reproduced (not just trusted from the review):\nseveral operator/bridges/shared/test_adapter_*.py tests fake the `claude`\nbinary by prepending a fake-bin directory onto PATH alone. But\nhelper_model.resolve\n[…]\nt only\noccur in a full test_adapter*.py run, not in isolation — genuine\ntest-order contamination, a different bug class from this commit's fix.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(adr-0215): CRITICAL — fake-claude tests silently called the real CLI",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-24T08:26:34Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "5a0f8ed7a8f42fc0abe318dd953360feae2d5f27",
"body": "Phase 2 (Frontend): Add engine_progress event type to StreamEvent union.\nDefine TDE progress fields: total_steps, completed_steps, delegated_count,\nlocal_count, token_savings_pct, l34_forced.\n\nChat.tsx: Subscribe to engine_progress events, log for debug (console.debug).\nPhase 2b/3 will attach progress to ChatMessage + render in audit graph.\n\nType-check: ✅ OK. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(tde-visibility): Frontend type definitions + progress event handler",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-24T08:25:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cd1fce7602345da9e28cd411c9e3a8134b6ac835",
"body": "Phase 1 (Backend): Add structured engine_progress event when TDE turn completes.\nCaptures: total_steps, completed_steps, delegated_count, local_count,\ntoken_savings_pct, l34_forced status.\n\nFrontend will consume this in Phase 2 for inline badge + audit graph.\nMirrors ACS's worker-completion tracking semantics (run_id, counts, status).\n\nSyntax verified. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(tde-visibility): Emit engine_progress event on TDE completion",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-24T08:25:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b959466424290cebb3f8221f3d8a5771824d5980",
"body": "… SVG diagrams\n\n- Complete 5-stage TDE architecture documentation\n- Real token-savings metrics for 3 scenarios (simple, moderate, complex)\n- 8 SVG diagrams explaining engine routing, detection signals, and flow\n- Proof of 34-64% aggregate token reduction vs current architecture\n- Console Chat + Bridge integration examples\n- Production readiness status (Phase 1-4 complete)\n- Link in main README (top navigation)",
"is_bot": false,
"headline": "docs: add comprehensive TDE Layer guide with token-savings analysis +…",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-24T08:00:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6afc5488d72ef189ff00d02b4b6edcd46e686e7f",
"body": "Found during the ADR-0215 iterative adversarial review of the full\nagentic-compute call chain (chat_runtime.py -> acs_runtime.py -> ADR-0213\ncontext sync), verified live against real `claude -p` subprocesses.\n\n1. chat_runtime.py: the ADR-0114 delegation branch's compute-quota-module\n ImportError p\n[…]\niting\n worker) + real ADR-0213 sync + real --continue follow-up turn\n correctly recalled the delegated task from the actual CLI transcript.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(adr-0215): review-found fixes in the ACS delegation chain",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-24T07:56:31Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "a370d1697cbb3cb067832948909339b598011429",
"body": "operator/orchestration/tde/bench.py: runs a fixed, versioned corpus of 13\ntasks (5 \"real\"/representative + 8 deliberately adversarial/fictional edge\ncases: empty prompt, whitespace-only, embedded slash-command/injection\ntext, ~11KB repetitive input, non-English, self-contradictory\ninstructions, cred\n[…]\n mocked unit tests, no LM\ncost), tests/test_tde_bench_live.py (2 live tests, same\nCLAUDE_LIVE_E2E=1 opt-in convention as test_tde_e2e_live.py).\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(adr-0215): Phase 3 — tde_bench extensible benchmark harness",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-24T07:46:53Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "bcd2039b062c119e7bdec164176698b15866c19c",
"body": "Runtime (\"Nervensystem\") half of ADR-0215's proof mechanism, complementing\nPhase 1's CI-time wiring_gate.py. Both new Tier-0 built-in fibers follow\nthe existing NerveFiber protocol (ADR-0177) exactly, reading only the\nalready content-free tde.* audit chain plus the WIRING.yaml manifests.\n\nWiringInte\n[…]\neasured delegated-vs-local latency\ndata from existing test-run traffic).\n\nNew test coverage: core/console/tests/test_wiring_integrity_fiber.py.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(adr-0215): Phase 2 — WiringIntegrityFiber + TokenSavingsFiber",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-24T07:36:33Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "2f6d08e67c1b7c19030e9aef9a820a0b5f7a79c3",
"body": "Structural prevention for the two recurring bug classes ADR-0215's\nadversarial review found: orphan modules (streaming_executor.py,\ndetector_plugin_registry.py — unwired for the 4th consecutive review\nround) and dotted `operator.` imports (which can never resolve, since\noperator/ has no __init__.py \n[…]\nage: tests/test_wiring_gate.py (gate logic against\nsynthetic fixtures + a live run against the real repo — this IS the CI\ncheck going forward).\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(adr-0215): Phase 1 — Wiring Manifest + Reachability Gate",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-24T07:31:42Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "06eea5fc618f18ea6c7ad33585ca941d4a4669ff",
"body": "Adversarial review of the agentic-compute-layer changes from the last 3\ndays found 7 real defects (ADR-0215). This commit fixes the 5 that needed\ncode changes; F6/F7 were doc-only corrections already applied to the ADRs.\n\nF1 CRITICAL: /healthz crashed on every call — unguarded dotted\n`from operator.\n[…]\nU-bounded.\n\nNew test coverage: test_healthz.py, test_eu_ai_act_audit.py, and\ntest_tde_slash_command_parser.py did not exist before this commit.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(adr-0215): Phase 0 — 7 tactical wiring/isolation fixes (F1-F5)",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-24T07:17:58Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "20b3caf18f2bd5825e9d52dd0d2c24f41737346f",
"body": "Resolved merge conflict in voice adversarial review docs (kept main version).\n\nADR-0214 Phase 1-4 complete and merged to main:\n- Multi-signal engine detection (parallelization, iteration, context)\n- L34 data-safety gating (fail-closed enforcement)\n- Streaming executor (>1GB data with adaptive chunki\n[…]\nine visibility (for Console Chat + Bridge UI)\n\n65+ comprehensive E2E tests, zero critical findings.\nReady for testing in Console + Bridge UIs.\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Merge feature/adr-0214-tde to main",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-23T18:38:18Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "1935cb43a44455d36876f744774bd70a1dc6b848",
"body": "**Problem:** Voice summaries still sounded robotic because generate_voice_summary()\nwas never called. The actual voice-summary path went through:\n 1. summarize_smart.py → 2. passed analysis as LLM context → 3. called summarize.py\n\nThis meant my improved, tone-aware generation function was dormant.\n\n[…]\nto truncation\n\n**Next:** Language param needs to flow through to Acronym expansion so\nGerman voice-notes don't get English acronym expansions.\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(voice-summary): Wire generate_voice_summary into active path",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-23T18:25:20Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e5a1a54ce29d27df8c94ace8be6d2f6fe63d631d",
"body": "ADR-0214 now exposes engine_selection dict with all engine info needed for UI:\n- engine: Selected engine name (tiered_delegation, acs, claude_code)\n- confidence: 0-1 probability score\n- l34_forced: True if L34 gate blocked delegation\n- trivial: True if task marked as simple\n- override: User override\n[…]\n detailed signals\n- Error cases: Handle L34-forced and trivial task labels\n\nReady for Console Chat + Bridge teams to integrate engine display.\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs(adr-0214): Engine visibility guide for Console Chat + Bridge UI",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-23T18:20:15Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e799f06e561d7f3e6bccea0dea17f8e015e22ff4",
"body": "ADAPTIVE CHUNKING (performance optimization):\n- StreamingExecutor now uses adaptive chunk sizing based on value size\n- <100MB values: 1MB chunks (fine-grained scanning, fewer gate calls)\n- 100-500MB values: 5MB chunks (sweet spot, near L34 scan limit)\n- >=500MB values: 10MB chunks (large throughput,\n[…]\ncutor + Plugin Registry (proto)\n✅ Phase 4: Adaptive Chunking + Plugin Discovery (production-ready)\n\nTotal: 65+ E2E tests, 8 commits, ~2000 LoC\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(adr-0214): Phase 4 complete — Adaptive Chunking + Plugin Discovery",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-23T18:06:13Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "2be94391b699c4c7066a689dab1e4905286038e2",
"body": "**Root cause fixed:** Voice Summary was completely ignoring the voice profile\nsettings (tone, voice_audience, custom_instructions). It used rigid templates\nlike \"Good news: we just unblocked...\" that sounded robotic.\n\n**What changed:**\n\n1. **Respects voice profile:** Now accepts `tone` parameter (wa\n[…]\ne explaining what\nhappened and why, not a robot reading facts. Aligns with user's voice profile\n(warm, personal, \"erzeuge auch eigene ideen\").\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(voice-summary): Make voice summaries human & respect tone profile",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-23T17:44:10Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "14c699ea97718e6ddd2d7873e022d1dc0fa8e89a",
"body": "…in Registry\n\nSTREAMING EXECUTOR (production-ready):\n- Large-data handling: >1GB datasets streamed in 1MB chunks\n- L34 filtering per-chunk: fail-closed on CONFIDENTIAL/RESTRICTED\n- Async streaming generator: memory-efficient for huge datasets\n- Per-step filtering: can_delegate() on each chunk, unsaf\n[…]\nled correctly ✓\n\nPHASE 3 STATUS: Production-ready (streaming + proto plugins)\nNext: Phase 4 could add adaptive chunk sizing + plugin discovery\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(adr-0214): Phase 3 complete — Streaming Executor + Detector Plug…",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-23T17:42:07Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "52d0fd020d5c25b026fbd58bf81ce2bc74ae3ceb",
"body": "Adversarial review identified 3 concerns; fixed 2 critical ones:\n\n1. task_type='reasoning' ACS bonus was overriding parallelization gate\n → FIX: Only give ACS reasoning bonus if parallelization > 20%\n → Result: 0% parallel reasoning → TDE/CC, not ACS (refutation confirmed)\n\n2. Iteration heuristi\n[…]\n: CC ✓ (not ACS)\n - Simple pipeline (10 steps): 1 loop ✓ (not over-penalized)\n - Complex refactor (5 steps): 2 loops ✓ (correctly iterative)\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(adr-0214): Adversarial review fixes — tighten edge case handling",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-23T17:34:53Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "10e3c02d8c35ca674de9d0aedcd7bb21d7ec5306",
"body": "…+ context over volume\n\nADR-0214 routing strategy implemented: ACS vs. TDE decision now based on:\n- Parallelization ratio (ACS wants >60%)\n- Iteration loops (ACS hates iteration; TDE loves it)\n- Context dependency (TDE needs state-carrying)\n- User interaction (TDE for real-time steering)\n- Sensitivi\n[…]\nnts:\n parallelization: 0.35 (+0.05, most important signal)\n iteration: 0.20 (NEW)\n data_complexity: 0.03 (-0.17, volume insufficient alone)\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(adr-0214): Refined engine routing — parallelization + iteration …",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-23T17:33:45Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "c839c5f2c2751bf7887006516ac6ce8d61d2e02b",
"body": "Adds a TDE Graph tab (TdeAuditGraphPanel.tsx) to the console's Audit\npanel, backed by the ADR-0214 hash-chain-verified audit-graph endpoint.\nchat_runtime.py now stamps tde_run_id on the \"engine\" SSE event so the\nfrontend can correlate a chat turn back to its delegation run;\nchat-registry.ts/api.ts/c\n[…]\nat id\nthrough to the panel.\n\nNo new ADR: this is a UI extension of the already-documented ADR-0214\naudit-graph mechanism (no new protocol, schema, or security decision),\nnot a new structural decision.",
"is_bot": false,
"headline": "feat(adr-0214): wire TDE delegation audit graph into chat Audit panel",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-23T14:27:19Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "cf9e30bc1f9e3ce713855570011cd28d313cbbe8",
"body": "…ied)\n\nAdds GET /compute/tde/{run_id}/graph (core/console/corvin_console/routes/compute.py,\nalready committed in 0a7728e alongside a concurrent ProcHolder fix that landed in the\nsame working tree): reconstructs one TDE-delegated turn's real delegation tree from the\ntde.* hash-chained audit trail, mo\n[…]\nor/orchestration/tde/README.md documentation\nsection for the new endpoint; the endpoint/correlation code itself is already on main\nvia 0a7728e.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(adr-0214): TDE delegation audit-graph endpoint (hash-chain-verif…",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-23T14:11:22Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "0a7728e5dc40975cf264c98a31a9a2026e833478",
"body": "… (ProcHolder gather tracking)\n\nAdaptiveDelegationExecutor.execute() now allocates one worker_ipc.ProcHolder\nper concurrently-scheduled task in each asyncio.gather() batch (delegated\nAND local). A CancelledError raised out of gather() (client disconnect /\nserver shutdown mid-batch) kills every holde\n[…]\ne this fix was in progress; the\nfull TDE suite (100 tests across phase1/phase2/round2/proc_holder/streaming)\npasses with both changes combined.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(adr-0214): kill sibling subprocesses on parallel-batch disconnect…",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-23T14:06:37Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "4b2d001457ba9df1581222081f8dcbe397dd8e68",
"body": "…c-judge default off, ProcHolder subprocess kill, streaming chunk audit events, L34 cache-key fix, TdeDelegationFiber + namespace-package import fix",
"is_bot": false,
"headline": "fix(adr-0214): TDE round 4 hardening — shadow-run loss proxy, semanti…",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-23T13:48:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cf7945cc6bda16a75c60c1a38191dacad647021f",
"body": "…ial review rounds, live-LLM E2E verified\n\nThe merged 'production-ready' TDE implementation was falsified by an\niterative adversarial review (3 red baseline tests on main, placeholder\nengines that never executed anything, name-only 'fail-closed' L34 gate,\nzero audit events, missing wheel packaging).\n[…]\nailures (missing PyJWT), unrelated to this change.\n\nADR-0214 updated (Corvin-ADR 13fca74): status Implemented, addendum\nwith design corrections.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(adr-0214): TDE production hardening — 72 findings over 3 adversar…",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-23T12:29:52Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "f2331309fc817782e3867c570979e9d080d0c8aa",
"body": "Added BUG-2.3 documentation for the Voice Result Event Timing bug\nand marked it as fixed in Iteration 1. Status now: 2 bugs fixed\n(BUG-1.2, BUG-2.3), 11 remaining for Iterations 2-5.\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: Update voice adversarial review with BUG-2.3 (timing fix)",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-23T10:52:14Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "9bc46f0489c7f55c7bd0892930d792e7f1796ff2",
"body": "…, not intermediate\n\nThe Voice TTS was triggered on every result event, including intermediate ones\nbefore the annotation was complete. This caused voice summaries to be spoken from\nan older, incomplete Worker-Engine output instead of the final, annotated version.\n\nFix: setLastTts() now only updates\n[…]\ns user complaint: 'die summary wurde vor der letzten ausgabe der worker\nengine erzeugt' (voice was created before final worker engine output).\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(voice): Timing bug — ensure voice summary uses FINAL result event…",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-23T10:51:58Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "4a45cfc9cfbb740016c19172d6cc29dd3bf96158",
"body": "Wire _resolve_voice_output_language() to console voice.py to match adapter.py.\nImplements 3-tier language resolution: user display_language → auto-detect from\ntext → fallback to de. Fixes critical bug where English text with German\ndisplay_language was summarized in German.\n\nImports detect_lang + i1\n[…]\n; no auto-detect in console.\nIMPACT: Voice summaries now respect user language preference with intelligent\nfallback to text-detected language.\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(voice): Language-routing smart-hybrid approach (BUG-1.2)",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-23T10:37:53Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "9fec50ee9ce16bf855e87eb29db6c769fe3b49b6",
"body": "Wire _resolve_voice_output_language() to console voice.py to match adapter.py.\nImplements 3-tier language resolution: user display_language → auto-detect from\ntext → fallback to de. Fixes critical bug where English text with German\ndisplay_language was summarized in German.\n\nImports detect_lang + i1\n[…]\n; no auto-detect in console.\nIMPACT: Voice summaries now respect user language preference with intelligent\nfallback to text-detected language.\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(voice): Language-routing smart-hybrid approach (BUG-1.2)",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-23T10:37:43Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "f395793d6114449c9eaa30c84384f9b9f078f460",
"body": "ADR-0214: Tiered Delegation Engine (TDE) — Production-Ready Implementation",
"is_bot": false,
"headline": "Merge pull request #4 from CorvinLabs/feature/adr-0214-tde",
"author_name": "Gordon Shumway",
"author_login": "veegee82",
"committed_at": "2026-07-23T10:34:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f9ad165a9fd8e30bff2943e470ec4b809c7894f8",
"body": "… resolution\n\n- adaptive_delegation_executor.py: use relative imports for L34Gate, LossTracker\n- send_integration.py: use relative imports for all TDE submodules\n- streaming_executor.py: use relative imports for Step Result, L34Gate\n- worker_ipc.py: use relative imports for DelegationEnvelope\n\nFixes ModuleNotFoundError when importing TDE components via 'from tde import ...'\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(adr-0214): Use relative imports in TDE modules for proper package…",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-23T10:32:33Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "547557fd73aeee47262b6ffa00703a3fb9915c36",
"body": "Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs(adr-0214): clarify Phase 1/2 production-ready status",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-23T10:30:58Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "42a0f004c23d0e0e680ffe78a116e4810bffb9ac",
"body": "Console voice.py now pre-processes text through strip_for_tts.py (--mode code-only)\nBEFORE passing to summarize.py, matching bridge adapter.py behavior exactly.\nPrevents LLM summarizer from reading code blocks, tables, and other noise that\ncauses hallucinated summary content (blind quoting from othe\n[…]\ndo this;\nconsole was sending raw text directly (regression from Bridge parity, found when\nuser reported voice summary reading random content).\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(voice): Pre-strip code blocks before voice summarization",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-23T10:23:25Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "2bb9f9000bf8687c365010c039394ef948c363a5",
"body": "…eck + Validation\n\nv0.10.60 hardens the installation chain based on adversarial review findings (see docs/voice-adversarial-review.md):\n\n**Installation Readiness (Fixes #1-4 from adversarial review):**\n1. **Credential Path Unification** (engine_detection.py): Engine detection now searches all 4 path\n[…]\n crash).\n\nAdversarial review tracked in docs/voice-adversarial-review.md (7 findings, 6 addressed in v0.10.60, 1 requires future LLM upgrade).\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(v0.10.60): Adversarial Review Fixes — Credential Paths + Healthch…",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-22T22:44:51Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "aeaf217956ba635ca578bb158ee6546a8c30672b",
"body": "…anscript\n\nThe web-chat ACS delegation branch advanced sess.turn_count without ever\nwriting to the real claude CLI transcript (ACSRuntime's manager/worker\nsubprocesses are separate, discarded `claude -p` runs) — so the next\n`--continue` turn resumed a transcript that had no idea a delegation just\nha\n[…]\nlegation-context-sync.md updated to\nStatus: implemented, with a Milestones section recording both the E2E\nverification and the review findings.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(adr-0213): sync ACS delegation results into the OS engine CLI tr…",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-22T22:17:59Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "8b8c2e6a3f0c0a3846fecd18e203b8d6deb44723",
"body": "…rsarial Review\n\n**IMPLEMENTATION**\n- Core engine: voice_summary_smart.py (analyze → analyze_response → semantic features)\n- Integration: summarize_smart.py (wraps existing summarizer with context injection)\n- E2E tests: test_summarize_smart_e2e.py (comprehensive coverage across response types)\n- Sa\n[…]\n\n**TEST COVERAGE**: 10/14 critical tests pass (71%)\n\n**SAFETY POSTURE**: Ship with fallback chain (analysis error → summarize.py works anyway)\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: Smart Voice Summary v0.10.59 — Production Implementation + Adve…",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-22T18:22:35Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "79366f7af439aeb565ce345eb8c826bb1c26336b",
"body": "**Problem**: Current voice summaries blindly read the text (user can already read).\nThey sound robotic and miss WHY decisions were made—just the WHAT.\n\n**Solution**: Analyze each response for meaning:\n1. Work type (fix/feature/refactor/docs)\n2. Impact & blockers resolved\n3. Trade-offs & reasoning\n4.\n[…]\nther user feedback on usefulness\n- [ ] Enhance analysis engine with LLM in v0.10.62\n- [ ] Add user controls (Settings → Voice → Summary Style)\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: Smart Voice Summary Engine — Context + Reasoning (ADR-0209)",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-22T18:11:49Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "993da958db4df8d4c3296c106324e8f2a08536ac",
"body": "The dashboard card reads data.adoption_pct[key]/data.total_instances, but\nthe endpoint returned flat bridges_adoption/instance_count fields — a\nguaranteed TypeError on first render, so the shipped card never worked.\nAlign the response shape to {adoption_pct, adoption_counts, total_instances}\n(same shape as the new ecosystem-wide GET /v1/stats/features on the Railway\nbackend) and expand the card to all 11 tracked features, not just 6.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(adr-0212): FeatureHeatmapCard/stats_features schema mismatch",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-22T17:54:03Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "107b892d2dd3adfba27efdd1c680dd2e4bdba725",
"body": "Remove query parameter; resolve home path from CORVIN_HOME env or default to ~/.corvin.\nDashboard FeatureHeatmapCard can now fetch /v1/console/stats/features without params.\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(adr-0212): Fix stats_features endpoint — use env CORVIN_HOME",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-22T17:26:42Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "9df357b511889bf3b73f5bfb708d453a06b46acf",
"body": "Create feature_snapshot.py: collect_feature_snapshot() + _assert_safe_features() + save_feature_snapshot(). Fail-closed enum validation ensures only known features (bridges, LDD, A2A, Workflows, Browser, Compute, Forge, Skills, Voice, Artifacts, MCP) are transmitted.\n\nModify heartbeat.py to collect snapshot on every 5-min ping and append to payload if valid. Complies GDPR Art. 6(1)(f) — anonymous aggregation, no PII/content.\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(adr-0212): Wire feature_snapshot collection into heartbeat",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-22T16:58:01Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "e185b83357fbab0df9275b274fb33d69d7616031",
"body": "Create stats_features.py (GET /stats/features endpoint) and register it in app.py.\nFeatureHeatmapResponse returns adoption percentages (0-100) for 6 core features.\nAggregates local feature_snapshot.json data per instance.\n\nFixes missing /stats/features endpoint that dashboard FeatureHeatmapCard depends on.\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(adr-0212): Add missing stats_features route registration",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-22T16:57:03Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "60edd32effc198b3767c02ec56cb8557b728a745",
"body": "Add FeatureHeatmapCard to dashboard showing adoption % per feature (Bridges, LDD, A2A, Workflows, Browser, Compute). Component fetches /stats/features endpoint, renders heatmap visualization with color-coded adoption bars (green >50%, yellow 20-50%, gray <20%). Refreshes every 60s.\n\nFrontend rebuild: dashboard bundle +0.16 KiB (cosmetic).\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(adr-0212): Dashboard Feature Telemetry card — ecosystem heatmap",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-22T16:55:31Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "378b31ca7638c132cd759723e3dd6904ef68722d",
"body": "…6 axes + refutation round)\n\nSix-axis adversarial review over everything since v0.10.58 (ADR-0199/0210/\n0211/0212, Discord zero-config, console UX) with a dedicated refutation\nround attacking the fixes themselves. Highlights:\n\n- GDPR: geo tier-1→3 auto-migration retired (overrode explicit opt-outs);\n[…]\n49\n passed) and tests no longer overwrite the live voice profile.\n\nFull details in CHANGELOG.md; ADR-0199/0208/0210/0211 amended in Corvin-ADR.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "release: v0.10.59 — iterative adversarial review of the last 3 days (…",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-22T15:34:23Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "9c73b707ef30e93503af65049edfa917c08c5307",
"body": "…icit user opt-outs (GDPR Art. 21)\n\nAdversarial review 2026-07-22. The v0.10.58 migration heuristic ('tier 1 +\nno consent flag ⇒ legacy auto-config') is structurally unable to\ndistinguish the legacy default from an EXPLICIT opt-out, because the\ndocumented ADR-0208 opt-out mechanism is precisely hand\n[…]\nkept for wire-compat); tests updated to pin the new\ncontract (explicit opt-out sticks; absent key still tier 3). ADR-0208\namended in Corvin-ADR.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(telemetry): retire geo tier-1→3 auto-migration — it overrode expl…",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-22T15:33:16Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "5e44e7bf0c23decdc9b03c12f25422e7c165584f",
"body": "… echo, both backends, anti-enumeration\n\nAdversarial review 2026-07-22. The receiver-side ping (0377f3b) shipped\nnon-functional: route registered under GET while the sender (and the ADR)\nPOST — every real ping 404'd — and the signed response omitted the\ntask_id echo, so even after a method fix every\n[…]\nstore than the server it fronted).\n- Tests: origin fixtures chmod 0600 (OriginRegistry enforces it); E2E\n suite 62 passed. layer-38 doc synced.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(adr-0199): a2a ping receiver actually works — POST route, task_id…",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-22T15:33:16Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "76df34442516eefd17273d2ec36779019f9d78e5",
"body": "… 501 for non-functional flows\n\nAdversarial review 2026-07-22 (ADR-0211 amended in Corvin-ADR):\n\n- save_discord_token/save_telegram_token wrote the source/_vendor tree; the\n daemon reads <corvin_home>/bridges/<ch>/settings.json and migrates\n legacy→runtime only ONCE at first boot, so every later t\n[…]\nructions) — it was a broken\n Discord copy-paste rendering 'App: undefined (undefined)' with a\n fictional OAuth step and a Discord portal link.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(console): bridges zero-config honesty pass — runtime paths, CSRF,…",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-22T15:32:54Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "70e66f3db139c671f573e3495381674f5419d9a3",
"body": "… voice profile\n\nAdversarial review 2026-07-22. 'uv run pytest tests/' ran 0 of 549 tests:\n\n- test_profile_identity_voice.py (c732633) imported\n 'operator.bridges.shared.profile' as a dotted path — never importable\n (stdlib 'operator' collision, no __init__.py); the collection error\n aborted the \n[…]\n on every\n full pytest run (ADAPTER_INBOX-sandbox-trap class, GDPR-relevant user\n config). PROFILE_FILE now patched to tmp_path for that test.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(tests): un-break default collection + stop tests writing the live…",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-22T15:32:54Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "2ec422c4607438ab34f007b824e34122e0988806",
"body": "… to green\n\nAdversarial review 2026-07-22. On main, 10 of 46 ADR-0210 tests were red:\nthe fix commits ad88183/b4c2632 had broken their own earlier phases without\nre-running the suite.\n\n- initial_analysis: unescaped '{path: ...}' template brace made\n make_task_analysis_prompt() raise KeyError('path'\n[…]\nR-0210 status amended in Corvin-ADR: scaffold-only, NOT integrated —\nheadline 56%/50% savings remain unrealized until send()-flow wiring exists.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(adr-0210): repair scaffold correctness + bring 46-test suite back…",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-22T15:32:01Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "c3b82e68cb765077efa644f39c195ace7576bb64",
"body": "…ures heatmap\"\n\nThis reverts commit a8b3b390a596bd4cf56839e0493f8f8be05d5156.",
"is_bot": false,
"headline": "Revert \"feat(adr-0212): Ecosystem Feature Telemetry — instance × feat…",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-22T14:09:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a8b3b390a596bd4cf56839e0493f8f8be05d5156",
"body": "…tmap\n\nComprehensive feature tracking (Bridges, LDD, A2A, Workflows, Browser, Compute, Voice):\n- feature_snapshot.py: Local aggregation (5min interval) with fail-closed validation\n- Closed-enum only (no PII, GDPR-compliant)\n- Heartbeat integration: Appends features payload to existing 5min ping (no \n[…]\non)\n\nDashboard heatmap shows adoption % per feature across instances.\nEnables data-driven prioritization: which features matter in production?\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(adr-0212): Ecosystem Feature Telemetry — instance × features hea…",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-22T13:49:44Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "821132fed4398f489eca317db3d5d5989a7e0aaa",
"body": "`npm run build` (tsc -b && vite build) failed on clean HEAD, which also blocks\n`uv build` — the wheel embeds the built SPA. Verified pre-existing by building\nHEAD in a separate worktree, so this is not fallout from the channel-disconnect\nwork committed alongside it. Introduced with the Discord/Teleg\n[…]\ncluded from the APP tsconfig instead of\n pulling in @types/jest, because nothing runs them yet.\n\nBuild is green again (vite: built in 24.60s).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(web-next): repair the broken frontend build",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-22T13:06:20Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "ffe01647bbb46be7f6fcdb0bf441fbd7448d49bb",
"body": "Channels could be created (save-token, OAuth exchange, QR pairing) and toggled\noff, but never un-connected: the credential stayed on disk forever. There was\nno way to hand a bridge to a different bot/account, or to revoke a leaked token\nfrom the console — re-running the wizard was the only option.\n\n\n[…]\ning, both-path cleanup, PIN survival,\nthe disconnect -> reconnect round trip, and that the response carries key names\nbut never a secret value.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(console): disconnect / delete a channel connection",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-22T13:06:10Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "c7326333fb64cfc93b39cc09afcfd68e48eee2d6",
"body": "**Improvements**\n1. Custom Instructions max_length: 500 → 2000 chars (frontend + backend)\n2. Textarea rows: 3 → 6 (better visibility for long instructions)\n3. Auto-save debounce: 800ms → 1500ms (less janky for longer text input)\n\n**Verification Tests**\nAdded comprehensive test suite (test_profile_id\n[…]\nle\n\n**Verification**\nRun: pytest tests/test_profile_identity_voice.py -v\nAll 13 test cases confirm identity settings actually work end-to-end.\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: improve Profile Identity UX + add verification tests",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-22T12:54:18Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "afe7e08310851087b41f7be573beb1bc4a54ea40",
"body": "**HIGH (2 of 7, final batch):**\n\n10. Inefficient Heartbeat Prune (a2a_friendship.py:925)\n - Added early return if cache under limit + no stale entries\n - Avoids O(N log N) sort when pruning not needed\n - Improves performance on high-frequency pings to active origins\n\n11. Ping Replay Window \n[…]\nndings now addressed (6 CRITICAL, 5 HIGH).\nCRITICAL fully fixed. HIGH findings either fixed or documented with\ndeferred-to-future-phase notes.\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(adr-0210): resolve HIGH findings #10, #11 from adversarial review",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-22T12:27:39Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "b4c263243888b2ea1f8c4ff17bd8fff93cf26f6f",
"body": "**HIGH (3 of 7):**\n\n6. Re-Plan Constraint Enforcement (scoped_step_execution.py)\n - Added NOTE documenting the architectural gap\n - Constraint is textual in prompt, not enforced downstream\n - Future: structured output or semantic validation needed\n - Documented for awareness; full fix deferr\n[…]\ns() called in __init__\n - Invalid step actions caught at executor creation time\n - Prevents wasted execution before discovering bad action\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(adr-0210): resolve HIGH findings #6, #8, #9 from adversarial review",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-22T12:27:17Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "537b6da88acaf341c9f0bbd38e860bc100a723a6",
"body": "…l hardening\n\n**Phase 4 (Email OAuth):**\n- AutoEmailOAuthFlow.js: Microsoft Graph + Gmail support (dual provider)\n- Console endpoints: /email/oauth/generate-url, /email/oauth/exchange-code (FIXED: was missing)\n- CSRF state parameter (RFC 6749 §10.12)\n- Scope validation via validateToken()\n\n**Phase 5\n[…]\n stub UX)\n- All phases: Scope validation + error discrimination\n\nAll 6 phases of ADR-0211 now production-ready per Discord/Slack security bar.\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(adr-0211): Phases 4-6 complete — Email/Signal/WhatsApp + critica…",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-22T11:34:01Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "ad881835ce0c992040cc0f5a2bce32d077ff1f26",
"body": "**HIGH (2 of 7):**\n\n5. Dependency/Parallelization Conflict (parallel_executor.py:72)\n - Added validation: step cannot both depend_on AND can_parallelize same step\n - Fail-closed: raises ExecutionError if conflict detected\n - Prevents logical contradictions in DAG\n\n7. Fallback Strategy Ignored \n[…]\nLate step validation (deferred to future)\n- #10: Inefficient heartbeat prune (optimization)\n- #11: Ping replay window (deferred, low priority)\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(adr-0210): resolve 2 HIGH findings from final adversarial review",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-22T11:27:16Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "c6e2aee66dcee8c785235b4d3c36b52b74b7a4ca",
"body": "Fixes from comprehensive final review (Phase 3-4 + prior fixes):\n\n**CRITICAL (4):**\n\n1. Greedy Regex Regression (initial_analysis.py:233)\n - Revert commit a3f7cfe's \"fix\" that inverted regex to greedy {.*}\n - Non-greedy {.*?} is correct: matches first JSON, not last-to-first\n - Greedy version \n[…]\nng from SQLite\n\nAll four break core execution paths and are production-blocking.\nRemaining HIGH findings (7) addressed in follow-up iteration.\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(adr-0210): resolve 4 CRITICAL findings from final adversarial review",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-22T11:26:40Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e5be40d241c22cd8e19bbda06cca4ffa92f55198",
"body": "ADR-0210 Phase 4 (final): Each step uses cached global decision to avoid\nre-planning. Reduces per-step LM cost from ~3K → ~1K tokens (66% savings).\n\n1. operator/orchestration/scoped_step_execution.py (NEW):\n - ScopedStepExecutor class: executes steps using global_decision context\n - DETERMINISTI\n[…]\natches)\n- Phase 4: Scoped Execution (per-step reuses global, prevents re-planning)\n\nTotal impact: 56% token reduction + 50% latency reduction.\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(adr-0210): implement Phase 4 — Scoped Step Execution",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-22T11:21:35Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "c7310c3878c7d6cc2c320a6e37a8a361d6a8ff97",
"body": "ADR-0210 Phase 3: Execute steps using can_parallelize hints for wall-clock\nspeedup. Builds dependency DAG, validates topology, groups independent steps\ninto concurrent batches, executes via asyncio.gather().\n\n1. operator/orchestration/parallel_executor.py (NEW):\n - ParallelExecutor class: init(pla\n[…]\n0% latency reduction for tasks with parallelizable steps.\nPhase 4 will add scoped step execution (reuse global decision, prevent re-planning).\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(adr-0210): implement Phase 3 — Parallel Execution Engine",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-22T11:20:40Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "beb53bc38b509dbc097ddf8e672fb47a2d9d7273",
"body": "…points\n\nImplements Category B (OAuth) pattern for Microsoft Teams:\n- AutoTeamsOAuthFlow.js: Azure AD v2.0 authorization, token exchange, Graph API validation\n- Console endpoints: /teams/oauth/generate-url, /teams/oauth/exchange-code\n- E2E test validates OAuth structure, scope list, tenant ID flexib\n[…]\nmicrosoft.com/.default)\n- Token validation via Graph /me endpoint\n\nTemplates now ready for Email Phase 4 (OAuth variant with Microsoft Graph).\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(adr-0211): Teams Phase 3 — Azure AD OAuth template + console end…",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-22T11:20:02Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "3a98f70b089c9186fe20e0e6c0faf2a5ff723256",
"body": "…dling\n\nFixes 8 production blocker findings from adversarial review:\n\nCRITICAL:\n- Call validateScopes() after OAuth code exchange (was TODO)\n\nHIGH (Error Handling):\n- Distinguish settings.json corruption from API errors\n- Catch subprocess.TimeoutExpired separately\n- Distinguish JSON parse errors fro\n[…]\nv-var token passing,\nexplicit error discrimination, 5s timeout bounds.\n\nReusable template for Teams (Azure AD) and Email (OAuth) in Phase 3-4.\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(adr-0211): Slack Phase 2 hardening — validate scopes + error han…",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-22T11:18:14Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "a3f7cfe5654b707be72e63a02c209d3ca2d64921",
"body": "Fixes from multi-dimensional adversarial review:\n\n**HIGH Priority** (3):\n1. Unbounded memory cache (decision_cache.py:53-79)\n - Added max_memory_entries parameter (default 1000)\n - Implemented LRU eviction when cache exceeds max size\n - Added _memory_access_order tracking + _evict_lru()\n\n2. TT\n[…]\noved redundant second get() call\n - Cleanup of accidental copy-paste\n\nAll changes maintain backward compatibility. Tests updated separately.\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(adr-0199, adr-0210): resolve 7 adversarial findings from code review",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-22T11:11:10Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "ee2b3b76c9c7f319b503a7b4855b608aadd59041",
"body": "…ry A Template)\n\nImplement Telegram bot setup following proven Discord pattern:\n\n## Components\n\n1. **AutoTelegramTokenProvisioner** (auto_telegram_provisioner.js)\n - Validates bot token via Telegram API (/getMe endpoint)\n - Extracts bot info (ID, username, name)\n - Mirrors AutoOAuth2Generator \n[…]\n clone for any API-token bridge in 1-2 days\n- Same security + UX across all bridges\n\nNext: Phase 2 (Slack) — build Category B (OAuth) template\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(telegram): ADR-0211 Phase 1 — Telegram Zero-Config Setup (Catego…",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-22T11:08:48Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "c20d358823cefd6cde5e4b85d764a34b9a051a4f",
"body": "ADR-0210 Phase 2: Persistent, TTL-aware cache for InitialAnalysisRequest\nresults. Enables 30-40% token reduction through cache hits (target 60%+ rate\nfor repeated/similar tasks).\n\n1. operator/orchestration/decision_cache.py (NEW):\n - DecisionCache class with in-memory + optional SQLite backend\n \n[…]\n.\n\nPhase 2 is memory-only (ephemeral, per-process). Phase 3 will add optional\nSQLite persistence for cross-process / cross-restart visibility.\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(adr-0210): implement Phase 2 — Decision Cache Layer",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-22T11:05:51Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e7157d9b3148e6a8f9e533315207d7ca36b48b94",
"body": "ADR-0210 Phase 1: Single LM call replaces 4 sequential calls (classify +\nextract + route + plan). Reduces token cost 56% and latency 50%.\n\n1. operator/orchestration/initial_analysis.py (NEW):\n - InitialAnalysisRequest dataclass with Classification, Entities, GlobalPlan\n - Step dataclass for exec\n[…]\nck speedup\n- Realism: tokens/duration are planning hints, not hard limits\n\nPhase 2 (Decision Cache) will add caching layer for repeated tasks.\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(adr-0210): implement Phase 1 — Unified Initial Analysis Prompt",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-22T11:04:50Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "0377f3b73af8160225e8a0acdd727946acad30dc",
"body": "Receiver-side implementation of ADR-0199 lightweight peer-liveness check:\n\n1. a2a_http_server.py:\n - New GET /v1/a2a/ping route with _handle_ping() handler\n - Signature verification using origin's hmac_key\n - Freshness window validation (±30s)\n - Signed response using recv_key (ok, instance_\n[…]\nnal\n(try/except), origins_dir defaults work out-of-the-box, unused second-backend\n(gateway.py) wiring deferred to Phase 2 per ADR-0199 design.\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(adr-0199): implement receiver-side ping endpoint (/v1/a2a/ping)",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-22T11:03:32Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "63152fc6a3240fde30c8180279432b2135e55f48",
"body": "Comprehensive design for extending zero-config setup to all bridges:\n\n## Overview\n- Category A (Tokens): Discord, Telegram — simple 1-day clones\n- Category B (OAuth): Slack, Teams, Email — 2-4 day implementations\n- Category C (Stateful): WhatsApp, Signal — enhancements only\n\n## Key Design Principles\n[…]\n (2d) — OAuth + SMTP fallback\n5. Signal (1d) — Service discovery\n6. WhatsApp (1d) — QR enhancement\n\nTotal: ~2-3 weeks to complete all bridges.\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: Universal Zero-Config Bridge Framework Concept",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-22T10:57:05Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "a400dcd166e98815e226fe6122bf389fc3563764",
"body": "…atency 50%\n\nProposes 'Decision Pipeline with Cache Layer' architecture:\n\n1. **Single Unified Initial Analysis Call**\n - Replaces 4 separate LM calls (classify, extract, route, plan)\n - Returns structured decision with global_plan + entities + routing\n - Input: 12K tokens; Output: 5K tokens\n\n2\n[…]\n56% tokens, 47% latency\n - Annual: ~20/year per 100 tasks/day\n\nIncludes implementation strategy, risks, metrics, and 'thin version' for MVP.\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs(concept): Batch LM Call Optimization — reduce token cost 56% + l…",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-22T10:35:28Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "758dbf4f98f101a55e89b89860630ad299ec0dfa",
"body": "…review\n\n## Critical Fixes\n\n**Axis 1: Command Injection via Token Interpolation**\n- CRITICAL: Token was interpolated directly into JavaScript f-string\n → Allows arbitrary code injection (e.g., token with quotes breaks syntax)\n- FIX: Pass token via environment variable (DISCORD_TOKEN env) instead\n \n[…]\nsistent state)\n✅ Explicit error handling\n✅ File existence checks\n✅ Response validation\n\nAll findings from 6-axis adversarial review addressed.\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(discord): Production hardening — security fixes from adversarial …",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-22T10:34:33Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "81b700c1b09c9153dabd4d4338d2447dab691c69",
"body": "…ation\n\nPhase 3: IntentAutoProvisioner\n- Auto-detect Message Content Intent availability on guild join\n- Graceful fallback: bot works without intent (DMs + @mentions only)\n- Cache intent status with TTL (1h)\n- Optional auto-request (with Portal link guidance)\n- Fail-open error handling (never crash \n[…]\n takes precedence over auto-owner\n ✓ Fail-open on errors (never deny access)\n\nNext: Adversarial code review (6 axes) for production readiness\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(discord): Phase 3 + 4 — Auto-Intent Detection + daemon.js Integr…",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-22T10:29:51Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "9b0d2f2265ab9d96d23bece7826eb7f5e0ab723f",
"body": "Implement Console UI for Discord zero-config setup:\n- Backend REST endpoints in bridges.py:\n * POST /v1/console/discord/validate-token (token validation + OAuth2 URL)\n * POST /v1/console/discord/save-token (token persistence)\n- Frontend React component: DiscordSetupDialog.tsx\n * Multi-step dialog\n[…]\nlidation → OAuth2 URL → user authorize → token save → success screen\n\nNext: Phase 3 — IntentAutoProvisioner (auto-intent activation detection)\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(discord): Phase 2 — Console UI for Zero-Config Bot Setup",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-22T10:25:30Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "6661871ee9d556e3af2c3639f90c6e3468e2a095",
"body": "Implement the first phase of Discord Zero-Config Setup:\n\n1. **AutoOAuth2Generator** (auto_oauth2.js)\n - Validates bot token via Discord REST API\n - Generates OAuth2 authorization URL automatically\n - Handles network errors and API timeouts gracefully\n - No user manual URL generation needed\n\n\n[…]\neneration\n- Whitelist completely optional (auto-owner by default)\n\nNext phases (Console UI, intent provisioning) follow the same architecture.\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(discord): zero-config setup — AutoOAuth2 + AutoOwnership",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-22T10:18:51Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "14770226dfcff2df3940f1a06f4168935e184829",
"body": "**Auto-Migration: Tier 1 → Tier 3 for existing installs**\n\nWhen users update from v0.10.56/v0.10.57 to v0.10.58+, old auto-generated\nconfig files with `geo_tracking_tier: 1` (old default) are automatically\nupgraded to tier 3 on first call to `effective_geo_tier()`.\n\n### Heuristic\nMigration triggers \n[…]\n-ON Tier 3\n- v0.10.57: Tier 3 default added (but no auto-migration for existing configs)\n- Stats dashboard: auto-refresh every 60s (v0.10.56+)\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "release: v0.10.58 — Geo-Tracking Auto-Migration for v0.10.57 upgrades",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-22T09:26:10Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "9b21e2df5ece671fe37efd7db798034aee00d32b",
"body": "**Major Change: Tier 1/2/3 geo-tracking now default-ON / opt-out (was opt-in)**\n\n### What Changed\n- Geo-tracking tier defaults to 3 (city + 10km grid) on fresh install\n- Users can opt-out by setting `spec.telemetry.geo_tracking_tier: 1`\n- Removed consent gate: `geo_tracking_consent_given` no longer \n[…]\n## Related\n- Frontend auto-refresh already live (v0.10.56 → corvin-labs.com/stats)\n- Stats dashboard: 8 tabs, 25+ charts, live Tier 1/2/3 maps\n\nCo-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "release: v0.10.57 — Geo-Tracking Tier 3 default-ON (ADR-0208)",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-22T09:10:53Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "d01cb9856f08b7cc38fad8e8e1b5e3097fa6c9f5",
"body": "…sweep\n\nVersion bump + CHANGELOG.md as single source of truth. Marks 0.10.50/0.10.52/\n0.10.53 as git-tag-only (never on PyPI) and adds the missing 0.10.54/0.10.55\nentries; banners the per-release CHANGELOG-0.10.5x.md files that contradicted\nPyPI reality. See the 0.10.56 entry for the full bridge + review fix list.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "release: v0.10.56 — fresh-install bridge repair + adversarial review …",
"author_name": "Verifier",
"author_login": null,
"committed_at": "2026-07-22T01:47:53Z",
"body_truncated": false,
"is_coding_agent": true
}
],
"releases_count": 11,
"commits_last_year": 574,
"latest_release_at": "2026-07-22T09:38:22Z",
"latest_release_tag": "v0.10.58",
"releases_from_tags": false,
"days_since_last_push": 0,
"active_weeks_last_year": 4,
"days_since_latest_release": 2,
"mean_days_between_releases": 2.3
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": true,
"health_percentage": 75,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": true
},
"ecosystem": {
"packages": [
{
"name": "corvinos",
"exists": true,
"license": "Apache-2.0",
"keywords": [
"agent",
"ai",
"cross-platform",
"installer",
"multi-platform",
"Development Status :: 4 - Beta",
"Environment :: Console",
"Intended Audience :: Developers",
"License :: OSI Approved :: Apache Software License",
"Operating System :: MacOS",
"Operating System :: Microsoft :: Windows",
"Operating System :: POSIX :: Linux",
"Programming Language :: Python :: 3",
"Programming Language :: Python :: 3.10",
"Programming Language :: Python :: 3.11",
"Programming Language :: Python :: 3.12",
"Programming Language :: Python :: 3.13",
"Topic :: System :: Shells",
"Topic :: System :: Systems Administration"
],
"ecosystem": "pypi",
"matches_repo": true,
"registry_url": "https://pypi.org/project/corvinos/",
"is_deprecated": false,
"latest_version": "0.10.62",
"repository_url": "https://github.com/CorvinLabs/CorvinOS",
"versions_count": 157,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": 22450,
"first_published_at": "2026-06-23T19:08:30.765595Z",
"latest_published_at": "2026-07-24T19:23:47.095509Z",
"latest_version_yanked": null,
"days_since_latest_publish": 0
}
]
},
"popularity": {
"forks": 4,
"stars": 19,
"watchers": 0,
"fork_history": {
"days": [
{
"date": "2026-07-06",
"count": 1
},
{
"date": "2026-07-10",
"count": 1
},
{
"date": "2026-07-11",
"count": 1
},
{
"date": "2026-07-12",
"count": 1
}
],
"complete": true,
"collected": 4,
"total_forks": 4
},
"star_history": null,
"open_issues_and_prs": 0
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [
"examples"
],
"has_llms_txt": false,
"has_dockerfile": true,
"has_mcp_signal": true,
"bootstrap_files": [],
"api_schema_files": [
"core/gateway/corvin_gateway/grpc/corvin.proto"
],
"has_devcontainer": false,
"typecheck_configs": [
"core/console/corvin_console/web-next/tsconfig.json"
],
"toolchain_manifests": [],
"largest_source_bytes": 523232,
"source_files_sampled": 1708,
"oversized_source_files": 34,
"agent_instruction_files": [
"CLAUDE.md"
],
"agent_instruction_max_bytes": 11612
},
"dependencies": {
"manifests": [
"package.json",
"pyproject.toml"
],
"advisories": {
"error": null,
"scope": null,
"source": null,
"findings": [],
"collected": false,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 0,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"npm",
"pypi"
],
"dependencies": [
{
"name": "playwright",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^1.61.1"
},
{
"name": "fastapi",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">= 0.110"
},
{
"name": "uvicorn",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">= 0.27"
},
{
"name": "pyyaml",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">= 6.0"
},
{
"name": "pydantic",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">= 2.4"
},
{
"name": "httpx",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">= 0.27"
},
{
"name": "PyJWT",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">= 2.8"
},
{
"name": "cryptography",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">= 42"
},
{
"name": "anthropic",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">= 0.25"
},
{
"name": "python-multipart",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">= 0.0.6"
},
{
"name": "edge-tts",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">= 6.1.8"
},
{
"name": "piper-tts",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">= 1.4.1"
},
{
"name": "imageio-ffmpeg",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">= 0.5.1"
},
{
"name": "pywhispercpp",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">= 1.5.0"
},
{
"name": "openai",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">= 1.0"
},
{
"name": "mcp",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">= 1.2"
},
{
"name": "jsonschema",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">= 4.0"
},
{
"name": "qrcode",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">= 7.0"
}
],
"all_dependencies": {
"error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"source": null,
"packages": [],
"collected": false,
"truncated": false,
"total_count": null,
"direct_count": null,
"indirect_count": null
}
},
"maintainership": {
"issues": {
"open_prs": 0,
"merged_prs": 4,
"open_issues": 0,
"closed_ratio": null,
"closed_issues": 0,
"closed_unmerged_prs": 0
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "veegee82",
"commits": 500,
"avatar_url": "https://avatars.githubusercontent.com/u/7315966?v=4"
}
],
"contributors_sampled": 1,
"top_contributor_share": 1
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"build-image.yml",
"compliance-check.yml",
"coverage.yml",
"e2e-nightly.yml",
"installer-test.yml",
"publish.yml",
"sync-installers.yml",
"test.yml",
"voice-e2e.yml"
],
"has_docs_dir": true,
"linter_configs": [
"eslint.config.js"
],
"has_editorconfig": false,
"has_linter_config": true,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"package-lock.json",
"uv.lock"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 0,
"reason": "branch protection not enabled on development/release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": null,
"reason": "no pull request found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/30 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 0,
"reason": "project has 0 contributing companies or organizations -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 0,
"reason": "project was created within the last 90 days. Please review its contents carefully",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": 10,
"reason": "packaging workflow detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 0,
"reason": "dependency not pinned by hash detected -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "no SAST tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 10,
"reason": "security policy file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 0,
"reason": "32 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "57a1cf7000be5e04b156dc1f2c915ca165f3c7cc",
"ran_at": "2026-07-24T20:49:23Z",
"aggregate_score": 3.2,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": true,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-24T20:34:08Z",
"oldest_open_prs": [],
"last_merged_pr_at": "2026-07-23T10:34:37Z",
"ci_last_conclusion": "FAILURE",
"oldest_open_issues": []
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/CorvinLabs/CorvinOS",
"host": "github.com",
"name": "CorvinOS",
"owner": "CorvinLabs"
},
"metrics": {
"overall": {
"key": "overall",
"band": "moderate",
"name": "Overall health",
"note": null,
"notes": [],
"value": 60,
"inputs": {
"security": 32,
"vitality": 74,
"community": 55,
"governance": 50,
"engineering": 84
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 74,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "moderate",
"name": "Development activity",
"note": null,
"notes": [],
"value": 57,
"inputs": {
"commits_last_year": 574,
"human_commit_share": 1,
"days_since_last_push": 0,
"active_weeks_last_year": 4
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 0 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 0
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "4/52 weeks with commits",
"points": 2.8,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 4
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "574 commits in the last year",
"points": 18,
"status": "met",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 574
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 100,
"inputs": {
"releases_count": 11,
"latest_release_tag": "v0.10.58",
"releases_from_tags": false,
"days_since_latest_release": 2,
"mean_days_between_releases": 2.3
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "11 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 11
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 2 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 2
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~2.3 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 2.3
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "unverified",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": "repository_too_young",
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": null,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "maintenance record not established from the collected data",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_unverified",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "moderate",
"name": "Community & Adoption",
"value": 55,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 24,
"inputs": {
"forks": 4,
"stars": 19,
"watchers": 0,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "19 stars",
"points": 20.4,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 19
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "4 forks",
"points": 4,
"status": "partial",
"details": [
{
"code": "forks",
"params": {
"count": 4
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "0 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 0
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "good",
"name": "Community health",
"note": null,
"notes": [],
"value": 77,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": true,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (Apache-2.0)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "Apache-2.0"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 18,
"status": "met",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 6.3,
"status": "met",
"details": [],
"max_points": 6.3
}
]
},
{
"key": "ecosystem_adoption",
"band": "good",
"name": "Ecosystem adoption (downloads)",
"note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"registry_dependents"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 72,
"inputs": {
"packages": [
"corvinos"
],
"dependents": null,
"ecosystems": "pypi",
"total_downloads": null,
"monthly_downloads": 22450
},
"components": [
{
"key": "monthly_downloads",
"name": "Monthly downloads",
"detail": "22,450 downloads/month across pypi",
"points": 58,
"status": "partial",
"details": [
{
"code": "downloads_monthly",
"params": {
"count": 22450,
"ecosystems": "pypi"
}
}
],
"max_points": 80
},
{
"key": "registry_dependents",
"name": "Registry dependents",
"detail": "not reported by this ecosystem",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_reported_by_this_ecosystem",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "moderate",
"name": "Sustainability & Governance",
"value": 50,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 10,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 1,
"top_contributor_share": 1
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 100% of commits",
"points": 0,
"status": "missed",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 100
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "1 contributors",
"points": 1.4,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 1
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 0 contributing companies or organizations -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "good",
"name": "Issue & PR responsiveness",
"note": "Excluded from scoring (no data or not applicable): Issue resolution. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"issue_resolution"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 72,
"inputs": {
"merged_prs": 4,
"open_issues": 0,
"closed_issues": 0,
"issue_closed_ratio": null,
"closed_unmerged_prs": 0
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "no issues or no data",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_issues_or_data",
"params": {}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "4/4 decided PRs merged",
"points": 38.2,
"status": "met",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 4,
"decided": 4
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "at_risk",
"name": "Ownership & stewardship",
"note": null,
"notes": [],
"value": 38,
"inputs": {
"followers": 1,
"owner_type": "Organization",
"is_verified": null,
"owner_login": "CorvinLabs",
"public_repos": 5,
"account_age_days": 53
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "organization-owned",
"points": 30,
"status": "met",
"details": [
{
"code": "owner_organization",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "1 followers of CorvinLabs",
"points": 2.2,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 1,
"login": "CorvinLabs"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "5 public repos, account ~0 yr old",
"points": 6,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 5
}
},
{
"code": "account_age_years",
"params": {
"years": 0
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"corvinos"
],
"ecosystems": "pypi",
"any_deprecated": false,
"min_days_since_publish": 0
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on pypi",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "pypi"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 0 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 0
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "157 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 157
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "good",
"name": "Engineering Quality",
"value": 84,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "good",
"name": "Engineering practices",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_ci_tests"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 80,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": true,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "9 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 9
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": "eslint.config.js",
"points": 16,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "eslint.config.js"
}
}
],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "no pull request found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "excellent",
"name": "Documentation",
"note": null,
"notes": [],
"value": 90,
"inputs": {
"topics": [
"agentic-ai",
"ai-assistant",
"eu-ai-act",
"gdpr",
"llm",
"ollama",
"privacy",
"self-hosted",
"agentic",
"agentic-framework",
"agentic-os",
"agentic-workflows",
"claude-code",
"hermes-agent",
"ai-compliance",
"ai-governance",
"discord-bot",
"gdpr-compliant",
"python",
"telegram-bot"
],
"has_wiki": false,
"homepage": "https://corvin-labs.com",
"has_readme": true,
"has_docs_dir": true,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 25,
"status": "met",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": "https://corvin-labs.com",
"points": 15,
"status": "met",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": "20 topics",
"points": 10,
"status": "met",
"details": [
{
"code": "topics_count",
"params": {
"count": 20
}
}
],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "at_risk",
"name": "Security",
"value": 32,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "at_risk",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): CI-Tests, Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"ci_tests",
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 32,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 16,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 2,
"scorecard_aggregate": 3.2
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection not enabled on development/release branches",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "no pull request found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 0 contributing companies or organizations -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "no SAST tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "32 existing vulnerabilities detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "good",
"name": "AI Readiness",
"value": 78,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "excellent",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 85,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.99,
"agent_instruction_files": [
"CLAUDE.md"
],
"agent_instruction_max_bytes": 11612
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "CLAUDE.md",
"points": 45,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "CLAUDE.md"
}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "99 of 100 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 99,
"sampled": 100
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "moderate",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 64,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"package-lock.json",
"uv.lock"
],
"has_dockerfile": true,
"typed_language": false,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": true,
"typecheck_configs": [
"core/console/corvin_console/web-next/tsconfig.json"
],
"agent_commit_share": 0.82,
"toolchain_manifests": [],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": "eslint.config.js",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "eslint.config.js"
}
}
],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "core/console/corvin_console/web-next/tsconfig.json",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "core/console/corvin_console/web-next/tsconfig.json"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "Dockerfile, lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Dockerfile, lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "82 of the last 100 commits agent-authored or agent-credited",
"points": 10,
"status": "met",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 82,
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "good",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 81,
"inputs": {
"primary_language": "Python",
"largest_source_bytes": 523232,
"source_files_sampled": 1708,
"oversized_source_files": 34
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Python with type-check config (core/console/corvin_console/web-next/tsconfig.json)",
"points": 27,
"status": "partial",
"details": [
{
"code": "typecheck_config_language",
"params": {
"files": "core/console/corvin_console/web-next/tsconfig.json",
"language": "Python"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "34/1708 source files over 60KB",
"points": 53.9,
"status": "partial",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 1708,
"oversized": 34
}
}
],
"max_points": 55
}
]
},
{
"key": "ai_interfaces",
"band": "excellent",
"name": "Machine-readable interfaces",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"example_dirs": [
"examples"
],
"has_mcp_signal": true,
"api_schema_files": [
"core/gateway/corvin_gateway/grpc/corvin.proto"
]
},
"components": [
{
"key": "api_schema_openapi_graphql_proto",
"name": "API schema (OpenAPI/GraphQL/proto)",
"detail": "core/gateway/corvin_gateway/grpc/corvin.proto",
"points": 40,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "core/gateway/corvin_gateway/grpc/corvin.proto"
}
}
],
"max_points": 40
},
{
"key": "mcp_server",
"name": "MCP server",
"detail": null,
"points": 20,
"status": "met",
"details": [],
"max_points": 20
},
{
"key": "runnable_examples",
"name": "Runnable examples",
"detail": "examples",
"points": 40,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "examples"
}
}
],
"max_points": 40
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
"GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"deps.dev does not index pypi:corvinos@0.10.62; advisories assessed against the repository dependency graph instead"
],
"report_type": "repository",
"generated_at": "2026-07-24T20:49:41.014902Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/c/CorvinLabs/CorvinOS.svg",
"full_name": "CorvinLabs/CorvinOS",
"license_state": "standard",
"license_spdx": "Apache-2.0"
}
Registros relacionados
Repositorios inspeccionados que comparten etiquetas de catálogo o ecosistemas con CorvinLabs/CorvinOS. Leer en paralelo →
Las puntuaciones son señales, no garantías. Reflejan prácticas públicamente visibles en GitHub; no son una auditoría de código ni una garantía de seguridad.
Los datos ausentes se excluyen y los pesos se renormalizan; nunca se puntúan como cero. La metodología es versionada y abierta: métricas v1.13.0, esquema v0.27.0 — metodología completa · wiki de métricas.
