Registro públicoEn riesgo
Informe de salud del softwareesquema 0.26.0 · métricas 1.13.0 · 2026-07-22 09:47 UTC
DrBaher / contract-ops-agent
Contract work in an enclosure: a Claude Agent SDK agent whose only tools are the contract-ops suite — no shell, no filesystem, no signing.
DrBaher/contract-ops-agent tiene un índice de salud de 45 sobre 100, lo que lo sitúa en la banda En riesgo. Su puntuación más alta es Vitality (67/100) y la más baja, Community & Adoption (23/100). Se actualizó por última vez hace 4 días. Una sola persona concentra la mayor parte del trabajo reciente.
45
global / 100Índice de salud del software
Las métricas se agrupan en categorías ponderadas sobre una escala de 1 a 100. El resultado global parte de su media; cuando la evidencia pública activa la Política de Jurisdicciones de Alto Riesgo, la calificación se ajusta y recibe el límite 49 (En riesgo). Preparación para IA queda fuera.
45
Excelente85-100Ejemplar; cumple prácticamente todos los criterios evaluados
Bueno70-84Saludable; carencias menores
Moderado50-69Aceptable con carencias notables; se recomienda revisión
En riesgo30-49Debilidades significativas; su adopción exige cautela
Crítico1-29Problemas graves (proyecto abandonado, un solo mantenedor, sin higiene)
Perfil de puntuación
Cada eje es una categoría. La forma importa más que la media: un proyecto sano llena toda la figura, mientras que un perfil de picos y cráteres indica que la fortaleza en una dimensión enmascara el riesgo en otra.
Titularidad
DrBaherCuenta personal
1 seguidor27 repositorios públicosdesde mar 2012Medicus AI
Este repositorio pertenece a una cuenta personal. Un proyecto con un único propietario conlleva más riesgo de continuidad que uno respaldado por una organización.
Ecosistemas de paquetes
| Registro | Paquete | Versión | Descargas / mes | Versiones | Última publicación |
|---|---|---|---|---|---|
| npm | contract-ops-agent | 0.11.1 | 2085 | 14 | hace 4 días |
Métricas por categoría
Vitalidad
¿Está vivo el proyecto: se escribe código y se publican versiones?
67
Actividad de desarrollo
53Moderado
Cómo se puntúa
| 36/36 | Recencia de push — último push hace 4 días |
| 1.4/36 | Cadencia de commits — 2/52 semanas con commits |
| 15.8/18 | Volumen de commits — 56 commits en el último año |
| 0/10 | OpenSSF Scorecard: Maintained — project was created within the last 90 days. Please review its contents carefully |
Datos de entrada utilizados
| commits_last_year | 56 |
| human_commit_share | 1 |
| days_since_last_push | 4 |
| active_weeks_last_year | 2 |
Disciplina de publicación
88Excelente
Cómo se puntúa
| 16.2/27 | Publica versiones — 17 etiquetas de versión (sin releases de GitHub) |
| 36/36 | Recencia de las versiones — última versión hace 4 días |
| 27/27 | Cadencia de publicación — una versión cada ~0,2 días |
| 0/10 | OpenSSF Scorecard: Signed-Releases — sin datos |
Datos de entrada utilizados
| releases_count | 17 |
| latest_release_tag | v0.11.1 |
| releases_from_tags | sí |
| days_since_latest_release | 4 |
| mean_days_between_releases | 0,2 |
Excluidos de la puntuación (sin datos o no aplicable): OpenSSF Scorecard: Signed-Releases. Los pesos restantes se han renormalizado.
Comunidad y Adopción
¿Tiene el proyecto usuarios, descargas, atención y unas condiciones acogedoras para quienes contribuyen?
23
Popularidad y adopción
1Crítico
Cómo se puntúa
| 0/60 | Estrellas — 0 estrellas |
| 0/25 | Forks — 0 forks |
| 0/15 | Observadores — 0 observadores |
Datos de entrada utilizados
| forks | 0 |
| stars | 0 |
| watchers | 0 |
| growth_state | unverified |
| growth_factor_pct | 100 |
| growth_unverified_reason | no_history |
Salud de la comunidad
25Crítico
Cómo se puntúa
| 22.5/22.5 | README |
| 0/22.5 | Licencia — no se detectó ningún archivo de licencia |
| 0/18 | Guía CONTRIBUTING |
| 0/13.5 | Código de conducta |
| 0/7.2 | Plantilla de issues |
| 0/6.3 | Plantilla de PR |
Datos de entrada utilizados
| has_readme | sí |
| has_license | no |
| has_contributing | no |
| has_issue_template | no |
| has_code_of_conduct | no |
| has_pull_request_template | no |
Adopción en el ecosistema (descargas)
55Moderado
Cómo se puntúa
| 44.3/80 | Descargas mensuales — 2085 descargas/mes en npm |
| 0/20 | Dependientes en el registro — no lo informa este ecosistema |
Datos de entrada utilizados
| packages | contract-ops-agent |
| dependents | — |
| ecosystems | npm |
| total_downloads | — |
| monthly_downloads | 2085 |
Excluidos de la puntuación (sin datos o no aplicable): Dependientes en el registro. Los pesos restantes se han renormalizado.
Sostenibilidad y Gobernanza
¿Sobrevivirá el proyecto a sus personas: factor bus, capacidad de respuesta, quién lo respalda y mantenimiento del paquete?
35
Cómo se puntúa
| 9/54 | Factor bus — la mitad de los commits recae en 1 contribuyente(s) |
| 0/22.5 | Distribución de commits — el principal contribuyente firma el 100% de los commits |
| 1.4/13.5 | Amplitud de contribuyentes — 1 contribuyentes |
| 3/10 | OpenSSF Scorecard: Contributors — project has 1 contributing companies or organizations -- score normalized to 3 |
Datos de entrada utilizados
| bus_factor | 1 |
| contributors_sampled | 1 |
| top_contributor_share | 1 |
Cómo se puntúa
| 0/46.8 | Resolución de issues — sin issues o sin datos |
| 0/38.3 | Aceptación de PR — sin PR decididos o sin datos |
| 0/15 | OpenSSF Scorecard: Code-Review — Found 0/30 approved changesets -- score normalized to 0 |
Datos de entrada utilizados
| merged_prs | 0 |
| open_issues | 0 |
| closed_issues | 0 |
| issue_closed_ratio | — |
| closed_unmerged_prs | 0 |
Excluidos de la puntuación (sin datos o no aplicable): Resolución de issues, Aceptación de PR. Los pesos restantes se han renormalizado.
Propiedad y custodia
43En riesgo
Cómo se puntúa
| 10/30 | Respaldo de la propiedad — cuenta personal (usuario) |
| 0/20 | Dominio verificado — no aplicable a cuentas de usuario |
| 2.2/25 | Alcance del propietario — 1 seguidores de DrBaher |
| 22.5/25 | Trayectoria — 27 repos públicos, cuenta de ~14 años |
Datos de entrada utilizados
| followers | 1 |
| owner_type | User |
| is_verified | — |
| owner_login | DrBaher |
| public_repos | 27 |
| account_age_days | 5252 |
Excluidos de la puntuación (sin datos o no aplicable): Dominio verificado. Los pesos restantes se han renormalizado.
Mantenimiento de paquetes
100Excelente
Cómo se puntúa
| 25/25 | Publicado y resoluble — 1 paquete(s) en npm |
| 35/35 | Recencia de publicación — última publicación hace 4 días |
| 20/20 | Historial de versiones — 14 versiones en el registro |
| 20/20 | No obsoleto — activo, ni obsoleto ni retirado |
Datos de entrada utilizados
| packages | contract-ops-agent |
| ecosystems | npm |
| any_deprecated | no |
| min_days_since_publish | 4 |
Calidad de Ingeniería
¿Existen unas prácticas mínimas de ingeniería y documentación?
66
Prácticas de ingeniería
60Moderado
Cómo se puntúa
| 24/24 | Flujos de trabajo de CI — 3 flujo(s) de trabajo |
| 24/24 | Pruebas presentes |
| 0/16 | Configuración de linter |
| 0/9.6 | Hooks de pre-commit |
| 0/6.4 | .editorconfig |
| 0/20 | OpenSSF Scorecard: CI-Tests — sin datos |
Datos de entrada utilizados
| has_ci | sí |
| has_tests | sí |
| has_editorconfig | no |
| has_linter_config | no |
| has_precommit_config | no |
Excluidos de la puntuación (sin datos o no aplicable): OpenSSF Scorecard: CI-Tests. Los pesos restantes se han renormalizado.
Documentación
75Bueno
Cómo se puntúa
| 30/30 | README |
| 25/25 | Directorio de documentación |
| 0/15 | Sitio de documentación / página del proyecto |
| 10/10 | Descripción del repositorio |
| 0/10 | Topics |
| 10/10 | Wiki |
Datos de entrada utilizados
| topics | — |
| has_wiki | sí |
| homepage | — |
| has_readme | sí |
| has_docs_dir | sí |
| has_description | sí |
Seguridad
¿Son sólidas las prácticas visibles de seguridad y de cadena de suministro, sin exposición jurisdiccional de alto riesgo sin resolver?
31
Postura de seguridad
31En riesgo
Cómo se puntúa
| 7.5/7.5 | Binary-Artifacts — no binaries found in the repo |
| 0/7.5 | Branch-Protection — branch protection not enabled on development/release branches |
| 0/2.5 | CI-Tests — sin datos |
| 0/2.5 | CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected |
| 0/7.5 | Code-Review — Found 0/30 approved changesets -- score normalized to 0 |
| 0.8/2.5 | Contributors — project has 1 contributing companies or organizations -- score normalized to 3 |
| 10/10 | Dangerous-Workflow — no dangerous workflow patterns detected |
| 0/7.5 | Dependency-Update-Tool — no update tool detected |
| 0/5 | Fuzzing — project is not fuzzed |
| 0/2.5 | Licencia — license file not detected |
| 0/7.5 | Maintained — project was created within the last 90 days. Please review its contents carefully |
| 5/5 | Packaging — packaging workflow detected |
| 0/5 | Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0 |
| 0/5 | SAST — no SAST tool detected |
| 0/5 | Security-Policy — security policy file not detected |
| 0/7.5 | Signed-Releases — sin datos |
| 0/7.5 | Token-Permissions — detected GitHub workflow tokens with excessive permissions |
| 6/7.5 | Vulnerabilities — 2 existing vulnerabilities detected |
Datos de entrada utilizados
| source | openssf_scorecard |
| checks_evaluated | 16 |
| scorecard_version | v5.5.0 |
| checks_inconclusive | 2 |
| scorecard_aggregate | 3,1 |
Excluidos de la puntuación (sin datos o no aplicable): ci_tests, signed_releases. Los pesos restantes se han renormalizado.
Preparación para IA
¿Hasta qué punto está el repositorio preparado para desarrollarse y mantenerse con agentes de codificación de IA? Es una insignia independiente y experimental — peso 0,0, de modo que se presenta por separado y no afecta a la puntuación de salud global.
40
Contexto y guía para agentes
40En riesgo
Cómo se puntúa
| 0/45 | Instrucciones para agentes — sin CLAUDE.md / AGENTS.md / reglas de editor |
| 0/15 | Documentación legible por máquinas (llms.txt) |
| 40/40 | Historial de commits legible — 56 de 56 commits humanos declaran su intención (asunto estructurado o cuerpo explicativo) |
Datos de entrada utilizados
| has_llms_txt | no |
| legible_history_share | 1 |
| agent_instruction_files | — |
| agent_instruction_max_bytes | — |
Cómo se puntúa
| 0/18 | Arranque con un solo comando |
| 22/22 | Pruebas automatizadas |
| 0/11 | Configuración de lint / formato |
| 0/11 | Verificación estática de tipos |
| 10/10 | Entorno reproducible — Dockerfile, lockfile |
| 10/10 | Práctica demostrada con agentes — 42 de los últimos 56 commits con autoría o crédito de agente |
| 0/8 | Mantenimiento automatizado — no se observan actualizaciones automáticas de dependencias |
| 0/10 | OpenSSF Scorecard: Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0 |
Datos de entrada utilizados
| has_nix | no |
| has_tests | sí |
| lockfiles | package-lock.json |
| has_dockerfile | sí |
| typed_language | no |
| bootstrap_files | — |
| has_devcontainer | no |
| has_linter_config | no |
| typecheck_configs | — |
| agent_commit_share | 0,75 |
| toolchain_manifests | — |
| dependency_bot_commit_share | 0 |
Legibilidad del código para modelos
55Moderado
Cómo se puntúa
| 0/45 | Código verificable por tipos — JavaScript sin configuración de verificación de tipos |
| 55/55 | Tamaños de archivo manejables — 0/33 archivos fuente de más de 60 KB |
Datos de entrada utilizados
| primary_language | JavaScript |
| largest_source_bytes | 27.604 |
| source_files_sampled | 33 |
| oversized_source_files | 0 |
Interfaces legibles por máquina
20Crítico
Cómo se puntúa
| 0/40 | Esquema de API (OpenAPI/GraphQL/proto) |
| 20/20 | Servidor MCP |
| 0/40 | Ejemplos ejecutables |
Datos de entrada utilizados
| example_dirs | — |
| has_mcp_signal | sí |
| api_schema_files | — |
Datos clave
0estrellas de GitHub
1contribuidores
56commits en los últimos 12 meses
4días desde el último push
17versiones publicadas
1factor bus
0issues abiertas
npmecosistemas de paquetes
Advertencias de recopilación de datos
- GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
- deps.dev does not index npm:contract-ops-agent@0.11.1; advisories assessed against the repository dependency graph instead
Más detalle
OpenSSF Scorecard 3.1 / 10
3.1agregado
Evaluación de seguridad independiente y agnóstica en cuanto a herramientas, procedente del proyecto de código abierto OpenSSF Scorecard. Cada comprobación premia una práctica de seguridad, no la herramienta de un proveedor concreto. Las comprobaciones que Scorecard no pudo determinar se marcan como n/d y se excluyen de la puntuación de seguridad (nunca se cuentan como cero).
| 10 | Binary-Artifacts | no binaries found in the repo |
| 0 | Branch-Protection | branch protection not enabled on development/release branches |
| n/d | CI-Tests | no pull request found |
| 0 | CII-Best-Practices | no effort to earn an OpenSSF best practices badge detected |
| 0 | Code-Review | Found 0/30 approved changesets -- score normalized to 0 |
| 3 | Contributors | project has 1 contributing companies or organizations -- score normalized to 3 |
| 10 | Dangerous-Workflow | no dangerous workflow patterns detected |
| 0 | Dependency-Update-Tool | no update tool detected |
| 0 | Fuzzing | project is not fuzzed |
| 0 | License | license file not detected |
| 0 | Maintained | project was created within the last 90 days. Please review its contents carefully |
| 10 | Packaging | packaging workflow detected |
| 0 | Pinned-Dependencies | dependency not pinned by hash detected -- score normalized to 0 |
| 0 | SAST | no SAST tool detected |
| 0 | Security-Policy | security policy file not detected |
| n/d | Signed-Releases | no releases found |
| 0 | Token-Permissions | detected GitHub workflow tokens with excessive permissions |
| 8 | Vulnerabilities | 2 existing vulnerabilities detected |
Dependencias directas 4
| Registro | Paquete | Restricción de versión | Manifiesto |
|---|---|---|---|
| npm | @anthropic-ai/claude-agent-sdk | ^0.3.207 | package.json |
| npm | contract-ops-mcp | ^0.3.0 | package.json |
| npm | openai | ^6.46.0 | package.json |
| npm | zod | ^4.4.3 | package.json |
Todas las dependencias no recopilado
No fue posible recopilar el conjunto de dependencias resuelto para este informe: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
Informe JSON sin procesar legible por máquina
{
"data": {
"repo": {
"topics": [],
"is_fork": false,
"size_kb": 584,
"has_wiki": true,
"homepage": null,
"languages": {
"Dockerfile": 2279,
"JavaScript": 241911
},
"pushed_at": "2026-07-17T10:40:18Z",
"created_at": "2026-07-13T16:43:39Z",
"owner_type": "User",
"updated_at": "2026-07-17T10:40:26Z",
"description": "Contract work in an enclosure: a Claude Agent SDK agent whose only tools are the contract-ops suite — no shell, no filesystem, no signing.",
"is_archived": false,
"is_disabled": false,
"license_spdx": null,
"default_branch": "main",
"license_spdx_raw": null,
"primary_language": "JavaScript",
"significant_languages": [
"JavaScript"
]
},
"owner": {
"blog": "Drbaher.com",
"name": "DrBaher",
"type": "User",
"login": "DrBaher",
"company": "Medicus AI",
"location": "Austria",
"followers": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/1499131?v=4",
"created_at": "2012-03-04T10:38:23Z",
"is_verified": null,
"public_repos": 27,
"account_age_days": 5252
},
"license": {
"state": "absent",
"spdx_id": null,
"raw_spdx": null,
"file_present": false,
"scorecard_found": false,
"profile_has_license": false
},
"activity": {
"releases": [
{
"tag": "v0.11.1",
"kind": "patch",
"published_at": "2026-07-17T10:40:16Z"
},
{
"tag": "v0.11.0",
"kind": "minor",
"published_at": "2026-07-16T07:52:18Z"
},
{
"tag": "v0.10.0",
"kind": "minor",
"published_at": "2026-07-15T17:10:01Z"
},
{
"tag": "v0.9.0",
"kind": "minor",
"published_at": "2026-07-15T15:19:33Z"
},
{
"tag": "v0.8.1",
"kind": "patch",
"published_at": "2026-07-15T13:50:46Z"
},
{
"tag": "v0.8.0",
"kind": "minor",
"published_at": "2026-07-15T13:04:33Z"
},
{
"tag": "v0.7.0",
"kind": "minor",
"published_at": "2026-07-15T12:22:52Z"
},
{
"tag": "v0.6.0",
"kind": "minor",
"published_at": "2026-07-15T11:42:43Z"
},
{
"tag": "v0.5.0",
"kind": "minor",
"published_at": "2026-07-15T11:06:18Z"
},
{
"tag": "v0.4.0",
"kind": "minor",
"published_at": "2026-07-15T10:35:34Z"
},
{
"tag": "v0.3.1",
"kind": "patch",
"published_at": "2026-07-15T08:45:02Z"
},
{
"tag": "v0.3.0",
"kind": "minor",
"published_at": "2026-07-15T08:13:44Z"
},
{
"tag": "v0.2.1",
"kind": "patch",
"published_at": "2026-07-14T18:19:44Z"
},
{
"tag": "v0.2.0",
"kind": "minor",
"published_at": "2026-07-13T16:32:07Z"
},
{
"tag": "v0.1.2",
"kind": "patch",
"published_at": "2026-07-13T16:00:19Z"
},
{
"tag": "v0.1.1",
"kind": "patch",
"published_at": "2026-07-13T14:57:01Z"
},
{
"tag": "v0.1.0",
"kind": "minor",
"published_at": "2026-07-13T14:10:25Z"
}
],
"recent_commits": [
{
"oid": "fdd59021eeaa2ebff76d051cf3e9dfb0eb382359",
"body": null,
"is_bot": false,
"headline": "release: v0.11.1 — surface local-model limitation to users",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-17T10:40:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8ffd9423eeec16fa12651c604f2479676eaff889",
"body": "…0 tools)\n\nDecision: keep all ~50 tools (frontier models handle them 5/5) rather than\nmaintain a reduced 'core' profile, and make the small-local-model limit\nclear where users hit it:\n- setup wizard warns when picking a local (Ollama) endpoint\n- startup prints a one-line note on any key-optional/local provider\n- README gets a prominent callout; both point at docs/model-eval.md\n\n95 offline green.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs+ux: surface the local-model limitation to users (keep the full 5…",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-17T10:40:16Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "1406656d50fecbc005d0cf419fe7e3eacf60f04b",
"body": "…l at 50\n\nAdds eval/tool-ceiling.mjs (isolates tool-count from task difficulty) and\nthe finding: doubling the local model (qwen2.5 7B→14B) does NOT raise the\ntool-selection ceiling. Both are reliable to ~25 tools, both fall off a\ncliff by 35, both score 0/5 at the full 50. So within the small-local\n\n[…]\ntion updated:\nfor local, use a much larger model (32B+, needs ~32GB RAM) OR cap the tool\nset to ~20; the real lever is per-turn tool subsetting.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "eval: tool-count ceiling — 7B and 14B both cap at ~25 tools, both fai…",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-16T10:16:42Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "256d008b572b1891c5ec5ac49ce6b911d82afeab",
"body": null,
"is_bot": false,
"headline": "release: v0.11.0 — usage command + cross-model eval",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-16T07:52:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "357edb0812f9ed28c52f5db108f33f1f53a4c66d",
"body": "- contract-ops-agent usage: aggregate workspace transcripts into\n per-session + total turns/tools/tokens/cost (src/usage.mjs; test U8;\n live-smoked on real transcripts). Makes the BYO-model cost story concrete.\n- eval/cross-model.mjs + docs/model-eval.md: scores a provider on the core\n workflow. \n[…]\ne-coverage.mjs: every server tool is gate-classified (no\n unrecognized fallthrough), covering the legacy tools too.\n\n95 offline + 3 loop green.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: usage command, cross-model eval, gate-coverage test",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-16T07:52:18Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "ad58b88083d409e766389b726d36224dc908763a",
"body": "…E_WRITES)\n\nFound by a post-session audit — unused since the convert_to_pdf key moved\nto the output file and the signing challenge moved to the full target.\nNo behavior change.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore: drop dead imports in gates.mjs (dirname, basename, SIGN_PREPAR…",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-15T17:30:35Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "2e8752a549f622da56a2534862cb598c1a225ca2",
"body": null,
"is_bot": false,
"headline": "release: v0.10.0 — full template-vault & contract-vault tool coverage",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-15T17:10:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c435c058a30dc0ff346720e0fc6eb741122f608e",
"body": "- gates: template-vault browse/inspect + contract-vault obligations/\n reminders/register reads → allow; the six vault writes (compose, swap,\n template export, ingest, obligation, accept) → y/N gated (VAULT_WRITES)\n- dep bumped to contract-ops-mcp ^0.3.0 (50 tools); loop count 29→50\n- test N3 locks\n[…]\nline tools. 93 offline + 3 loop green.\n\nCloses the last significant CLI-surface gap — every suite CLI's real\ncapabilities are now curated tools.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "harness: gate + dep for the full vault surface (contract-ops-mcp 0.3.0)",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-15T17:10:01Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "ff96e029afb6a1c07ec8694864139e152f170325",
"body": "…e lifecycle)",
"is_bot": false,
"headline": "release: v0.9.0 — NDA review & negotiation (draft, redlines, negotiat…",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-15T15:19:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9756b2fdbdd09e98c322753ff125f5a617a06039",
"body": "…-mcp ^0.2.0\n\n- bump dep to ^0.2.0 (the 29-tool server with negotiation), loop test\n count 17→29\n- N2: REPL typed-consent gate for a negotiate sign act (wrong declines,\n exact approves) — same discipline as signing\n- README + CHANGELOG document NDA review & negotiation\n- live-verified: real model drove nda_setup→review→draft→negotiate_init→\n status; negotiate_init passed the typed-consent gate\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "release prep: NDA negotiation live-verified; dep bump to contract-ops…",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-15T15:19:21Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "a22edc906dc3d3b98fe4fb955281e095fd2e2dc3",
"body": "- gates: negotiate read-only views (status/review/diff/analyze/validate)\n allow; nda_setup/generate_redlines/draft_nda/negotiate_finalize are\n gated y/N writes; negotiate_init/counter/accept SIGN a round → typed\n consent gate (type the state/out target back, TTY-only, never\n remembered), same di\n[…]\nng paragraph to item 5)\n- test N1 locks the classification. 91 offline green. (tool-count\n assertion + mcp dep bump follow the server release.)\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "harness: gate policy + prompt for NDA negotiation tools",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-15T15:09:48Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "5d983a212098ecdd09741020fff6f8e2e7cd318f",
"body": null,
"is_bot": false,
"headline": "release: v0.8.1 — wizard re-prompt fix + live use-case verification",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-15T13:50:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7cb889336b2f86f19fb33d2ff7490c2ffd3a52d8",
"body": "…ault)\n\nA live first-run walkthrough surfaced it: an unrecognized answer to the\nprovider question (a fat-fingered '9', a stray path, anything not 1-4)\nsilently fell through to Claude. Now it re-prompts with a clear message;\nempty (Enter) still picks the recommended default. Test S10.\n\nFound during t\n[…]\nn one session: extract→lint→compare→fill→ready\n- Claude --resume live (SDK session recall)\n- container signing mounts (sign-cli 0.9.0, 32 tools)\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "wizard: re-prompt on an invalid provider choice (no silent claude def…",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-15T13:50:37Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "689fb1554d550fee7df271b3bf01f76f8b6d550f",
"body": "…Y-only)",
"is_bot": false,
"headline": "release: v0.8.0 — signing-security hardening (RCE fix, typed-gate, TT…",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-15T13:04:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "059bb7d204bfa3f08a363c11a26a660cc10fa609",
"body": "Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: changelog for v0.8.0 (security release)",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-15T13:04:33Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "cc74c1ea1b55ba3feec4f0c91cd0054a5205bc3a",
"body": "…ier misdiagnosis)\n\nAn earlier commit concluded 'signing unsupported on the claude provider'\nand refused it — that diagnosis used a STALE local sign binary (a dev\ncheckout on PATH) whose signer_list MCP schema the Agent SDK rejects. The\nPUBLISHED sign-cli is already spec-compliant; with it, the Clau\n[…]\n\n+ 15 sign), the model drove mcp__sign__signer_list, no breach, no leaked\nresource tool. 89 offline + 16 signing + 3 loop + 3 openai-live green.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "signing: works on ALL providers with a current sign-cli (correct earl…",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-15T13:04:01Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "b80adef02bd2f453c3abaad263b84a68735e990a",
"body": "- loop.mjs connects all MCP mounts concurrently (allSettled, order\n preserved, partial-failure cleanup) — signing-mode startup no longer\n pays contract-ops + sign serially\n- README: macOS/Linux support stated (sh -c sign mount assumes POSIX;\n Windows via WSL/Docker)\n- docs/beta-onboarding.md: a send-to-a-friend setup guide (bring your own\n model, Codex/OpenAI/preset/Claude, what to try, Docker option)\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "polish: parallel MCP mounts, platform note, beta onboarding kit",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-15T12:57:27Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "7f1e0a27ce09a312812c9ffead5de0622a8a6af5",
"body": "CRITICAL — shell injection via workspace path (Claude sign mount):\n- src/providers/claude.mjs interpolated the workspace into sh -c via\n JSON.stringify, which does NOT escape $() or backticks inside double\n quotes — a workspace like /tmp/wk$(touch x) executed code at session\n start. Now passed as\n[…]\nny, TTY refusal, run-guard\nevasion, per-file convert key, no-sign-tools assertion. 89 offline + 3\nloop + 3 live-openai + 16 signing(live) green.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "security: close signing-gate holes found by adversarial review",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-15T12:54:56Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "992795a5f603e3f1dfdf8900b2f4b3c1541c8c04",
"body": null,
"is_bot": false,
"headline": "release: v0.7.0 — fallback-on-claude fix, discoverability, hardening",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-15T12:22:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "58f032faf322a97e9d982ece086761d55694476a",
"body": "…efresh\n\n- CHANGELOG.md backfilled 0.1.x → 0.7.0 (npm/ghcr users finally have an\n in-repo record of what changed per version)\n- Dockerfile: org.opencontainers.image.* labels so the ghcr package page\n links the repo and shows a description\n- sign-mount-scope: baseline claim corrected (the curated r\n[…]\n; releasing.md + ci.yml test-suite\n descriptions unstaled; providers.md signing absolutism softened to\n 'unreachable by default' with pointers\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Tier 3: CHANGELOG, OCI image labels, decision-record and schema doc r…",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-15T12:22:52Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "4c16118b834b3857c2ca19039bc9c3c061d3536f",
"body": "- doctor validates the signing config (mode string, sign-cli presence\n when a mode is set, the --enable-signing activation hint) and resolves\n every fallback ref + its key up front — a typo'd or keyless fallback no\n longer waits until mid-session to surface (test D3)\n- /help shows the live sessio\n[…]\nrs to the optional fallbacks/signing config blocks\n- tool passthrough says it's contract-ops-only (signing unreachable)\n\n86 offline tests green.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Tier 2: signing + fallbacks are discoverable everywhere",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-15T12:20:49Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "cd8a0163e43bfda0032efe392b1508609ccaec7e",
"body": "…te hardening\n\n- claude provider maps SDK error subtypes (except max_turns) to\n meta.error, so fallback chains actually fire when Claude is the primary\n provider; a session that THROWS (SDK crash) now also gets the fallback\n chance instead of dying [fatal] — enclosure failures still never retry\n-\n[…]\nskip, exhausted notice,\nresume-seed carry, degenerate challenge, full-mode args, live no-drift,\nkeyless wizard, version sync). 85 offline green.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Tier 1 fixes: fallback works on Claude, full-mode whitelist, typed-ga…",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-15T12:18:33Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "8c541b5eb48a41037ce0950c9106126c3e6f0fbf",
"body": "…nsent gate",
"is_bot": false,
"headline": "release: v0.6.0 — opt-in signing modes (prepare | full) with typed-co…",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-15T11:42:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4291696af609fa6dbaeb35c841bcdf8969a7b88f",
"body": "The one deliberate softening of 'signing is unreachable', per the decision\non docs/sign-mount-scope.md (ship B and C as user-selectable modes):\n\n- signing.mode in config (off default | prepare | full) AND\n --enable-signing at launch — fail-closed double opt-in (config without\n flag warns and stays\n[…]\nlive-OpenAI green; live bin smoke: flagless\nstays off; prepare mode mounted 32 tools and a real model drove\nsigner_list through the sign server.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "v0.6: signing modes — prepare | full, double-opt-in, typed-consent gate",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-15T11:42:42Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "4583eb028b0ddef96843be8c54ebdc9c573c8731",
"body": null,
"is_bot": false,
"headline": "release: v0.5.0 — fallback chains, zero-setup container image",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-15T11:06:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ae5c0de72f75d17442940b1cdcc1499b74a67460",
"body": "…on pending)\n\n- Dockerfile: node:22-slim + the full CLI suite (pipx one-per-call for\n Debian's older pipx; npm CLIs incl. the human's sign-cli) + LibreOffice\n as the PDF backend. Non-root user, XDG_CONFIG_HOME on a /config volume\n so setup + stored keys persist, /workspace for contracts.\n- .githu\n[…]\n/9 + PDF backend inside the\ncontainer; two-step scripted flow (setup → live gpt-4o-mini turn driving\na real lint) green. 66 offline tests green.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "v0.5 M7+M8: zero-setup container image; sign-mount design doc (decisi…",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-15T11:06:18Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "2d99ceb034b337f6b479dea77b18e9484f893a39",
"body": "config.fallbacks: refs tried in order when a turn ends in a TERMINAL\nprovider error (transient errors still just retry). The REPL switches via\nthe same prepareModel preflight as /model, starts the next session seeded\nwith the completed conversation (loop providers keep context; fallback to\nclaude st\n[…]\nnd-to-end startRepl coverage: fake\nproviders over PassThrough streams prove replay, seed contents, and\nchain exhaustion. 65 offline tests green.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "v0.5 M6: fallback chains — REPL-level failover with seeded replay",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-15T10:59:29Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "b5fa986e87e7bb1b9d36f4334991f10d9c7225c7",
"body": "…ssthrough",
"is_bot": false,
"headline": "release: v0.4.0 — presets, /model switching, --resume, direct tool pa…",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-15T10:35:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2131b956b554785c186c9aaef44cca4ff2d30e0f",
"body": "…on}'\n\nOne-shot tool execution with no model: 'tool' lists the suite, 'tool\n<name> {json}' runs one through the SAME MCP mount (server-side path\nconfinement + sign guard intact) and the SAME gate policy — read-only\ntools run immediately, consequential ones confirm interactively. Exit\ncodes: 0 ok, 1 \n[…]\nge/declined. Closes the deferred\nonboarding-scope item on its stated terms. Test T1; smoked live: list,\nlint, declined + approved fill_template.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "v0.4 M5: direct-CLI passthrough — contract-ops-agent tool <name> '{js…",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-15T10:34:54Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "4b50fc1210f677fd3a3d7de9e9882d4ec8e5e50f",
"body": "--resume [last|<transcript.jsonl>]: loop providers are re-seeded with the\ntranscript's user/assistant turns (tool exchanges are summarized away —\ntheir call ids are gone); the Claude provider resumes the SDK session\nnatively via the session id now recorded in every init transcript record.\nloadResume\n[…]\nsts: loadResume parsing + seeded-loop history; live-verified across two\nprocesses (fact recalled from the resumed transcript). 61 offline green.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "v0.4 M4: --resume continues a prior conversation",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-15T10:32:27Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "5a8cf7e0d14ed27fdf09ec59951be726d96f4b18",
"body": "/model lists the current ref + all known providers (core, presets, config\nendpoints); /model <ref> switches — the session ends, a fresh one starts\non the new provider with the next message (context resets, enclosure\nre-verified). prepareModel() unifies the auth preflight for startup and\nswitching: r\n[…]\nfast on a missing key (key-optional endpoints exempt). bin simplified to\nuse it. Tests R3/P6; live-smoked: list, bad ref, real switch to gpt-4o.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "v0.4 M3: /model switching in the REPL",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-15T10:28:40Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "a223a19b0e35facbb5834b639dff07621527c071",
"body": "…ddendum\n\nbuildSystemPrompt(providerId): Claude keeps the lean base prompt; every\nloop provider gets an explicit tool-use-discipline addendum (call don't\nguess, stepwise calls, schema-exact args, honest error relay). Wired into\nbin and the live OpenAI suite. Test SP1.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "v0.4 M2: per-provider system prompt — loop providers get a tool-use a…",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-15T10:24:38Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "dc47ffcd40acc016a5cf3309e7e1364b6e8eb4c0",
"body": "…th zero config\n\nPRESET_ENDPOINTS bakes in the base URL + key env var so 'gemini/<model>'\nworks out of the box (wizard option 3). Custom providers entries override\npresets deliberately; only claude/openai stay collision-guarded. Local\nkey-optional endpoints (ollama) skip the startup key check and get a\nplaceholder key for the SDK. Docs + tests (P4/P5, S8). 56 offline green.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "v0.4 M1: preset endpoints — gemini/grok/deepseek/openrouter/ollama wi…",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-15T10:23:28Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "b53c512d526696d5a8b9a8faa2d2d95770b4dd8e",
"body": null,
"is_bot": false,
"headline": "release: v0.3.1 — resilient loop, REPL polish, provider-aware doctor",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-15T08:45:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "161fd918ad7fa4abef294050d0fa957dacbaaae7",
"body": "…README/docs refresh\n\n- doctor: auth is checked against the CONFIGURED provider's key vars\n (env or setup-stored), not a hardcoded ANTHROPIC_API_KEY; invalid\n provider refs render as INVALID instead of a misleading auth line\n- doctor now owns the v1→v2 config migration (version stamp, implied\n au\n[…]\n,\n compactHistory boundary behavior, loop trim notice — 53 offline green;\n loop + live OpenAI suites green; doctor migration smoked end-to-end\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Tier 3: provider-aware doctor + v1→v2 migration, context compaction, …",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-15T08:44:47Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "53432fe4b0bc2f5f381e7263926f2598f61c2b85",
"body": "- spinner while inference runs (TTY-only) so long turns don't look hung;\n pauses for gate prompts, cleared before any output\n- turn footer: tool-call count + Claude cost (total_cost_usd) or loop\n token usage (OpenAI usage normalized in the driver, summed across the\n turn's model calls) + non-succ\n[…]\ner-turn\n accumulation (49 offline; loop + live OpenAI suites green; REPL driven\n end-to-end through a real OpenAI turn with footer + commands)\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "REPL UX: spinner, per-turn cost/usage footer, /help, piped input",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-15T08:39:23Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e73c7000c155814e26b271d911695147b06ffd18",
"body": "- loop.mjs: transient inference errors (429/408/5xx/network) retry with\n exponential backoff and a visible notice; terminal errors surface as an\n error event + turn_end so the conversation survives; Ctrl-C aborts are\n recognized (APIUserAbortError/AbortError) and end the turn as\n interrupted ins\n[…]\nne + 3 loop green; live OpenAI suite (LO1–LO3) green\nthrough the hardened loop; corrupt-config and missing-key startup guards\nsmoked end-to-end.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "harden the loop runtime: failures end the turn, never the session",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-15T08:33:45Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e7921ca947a81a4a5f5caf51480de660fe52e8bf",
"body": null,
"is_bot": false,
"headline": "release: v0.3.0 — provider abstraction, bring-your-own-model",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-15T08:13:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d5139f44caa45d407b3f7ef4f9a22bc767d2cee2",
"body": "Claude via Agent SDK or any OpenAI-compatible endpoint (OpenAI, Gemini,\nGrok, Ollama, …) behind one Provider interface, same enclosure and gates.\nAudit-clean (16/16 findings fixed) and live-verified on both backends.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Merge v0.3: provider abstraction — bring-your-own-model (M1–M4)",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-15T08:13:36Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "282e64e9d5ce42557381b5efc1b0c4078f0665a1",
"body": "…rove\n\nCloses the v0.3 release gate: first real requests through openaiProvider\nagainst the live OpenAI endpoint. Mirrors L1/L3/L4 so both backends are\nheld to identical behavior. Skips itself when OPENAI_API_KEY is absent.\nVerified live: 3/3 pass.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "test: live OpenAI suite (LO1–LO3) — enclosure, extract→lint, gate app…",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-15T08:13:28Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "bf431c08aa8cb4f40d6a0bba75c558812abd0b23",
"body": "HIGH\n- provider name collision: a config endpoint named like a built-in (openai/claude)\n no longer silently routes to the wrong host — resolveProvider errors on the\n collision, and the wizard suffixes reserved names (…-endpoint).\n\nMEDIUM\n- OpenAI-compatible endpoints: accept tool_calls that omit `\n[…]\nt names), loop 3, Claude\nlive parity re-confirmed, masked input smoked.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Eb2KPgFieBjUKvpbLCEAXi",
"is_bot": false,
"headline": "fix(v0.3): address all 16 findings from the adversarial audit",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-14T19:54:32Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "b1b9ce2d2c857885f7cfc603b29b665c74a48089",
"body": "Reaches the whole long tail with one adapter instead of a per-vendor dialect:\nGemini, Grok, DeepSeek, Ollama, OpenRouter, local servers — all expose an\nOpenAI-shaped API, so they run on the existing loop via a base-URL.\n\n- makeOpenAIProvider({ baseURL, apiKeyEnv, defaultModel }) factory; openaiProvi\n[…]\nint\nwizard path). Loop integration still green; endpoint wizard smoked.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Eb2KPgFieBjUKvpbLCEAXi",
"is_bot": false,
"headline": "feat(v0.3 M4): universal OpenAI-compatible endpoints + provider docs",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-14T19:21:44Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "b9a561df085e6b2c7f1ae2c1646037e32a73c0ca",
"body": "The guided wizard now asks which provider (Anthropic Claude / OpenAI) and stores\na provider/model ref, so OpenAI is a first-class choice, not just a config edit.\n\n- config v2: `model` holds a \"provider/model\" ref; credentials.json keyed by env\n var name so multiple providers' keys coexist (0600, st\n[…]\nizard path).\nClaude REPL + OpenAI wizard smoked; doctor shows provider.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Eb2KPgFieBjUKvpbLCEAXi",
"is_bot": false,
"headline": "feat(v0.3 M3): config v2 + wizard provider selection",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-14T19:10:07Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "9e30d73a88c16de5ce2c2217502ea670d9a0e66b",
"body": "…-model)\n\nProves the Provider abstraction with a second backend. Non-Claude providers run\non our own loop over the MCP client — the enclosure is by construction (the only\ntools the model ever sees are the contract-ops MCP tools, exposed under the\nmcp__contract-ops__ prefix; no built-ins to strip), e\n[…]\nachine);\n`config.model = \"openai/<model>\"` + OPENAI_API_KEY selects it.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Eb2KPgFieBjUKvpbLCEAXi",
"is_bot": false,
"headline": "feat(v0.3 M2): raw tool-calling loop + OpenAIProvider (bring-your-own…",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-14T19:02:23Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "444beacaeafc2b64bfcffee37d38bcfa21aa0b0b",
"body": "…ps Agent SDK\n\nThe seam for bring-your-own-model. A `Provider` starts a normalized `Session`\n(events: enclosure | text | tool_use | turn_end); the REPL is now provider-\nagnostic and drives that. ClaudeProvider keeps the Agent SDK — the ONLY path\nthat inherits a Claude Code *subscription* login (the \n[…]\nve tests green;\nbin smoke passes. Next: M2 = raw loop + OpenAIProvider.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Eb2KPgFieBjUKvpbLCEAXi",
"is_bot": false,
"headline": "refactor(v0.3 M1): introduce Provider abstraction; ClaudeProvider wra…",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-14T18:55:37Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "1aa6061282fdd0938d3a81722abf444d4ab01194",
"body": null,
"is_bot": false,
"headline": "release: v0.2.1 — polished onboarding + fill_template/sign fixes",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-14T18:19:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b1f3d57422100f69000d92f55c7ed1b3d6ff7644",
"body": "A local dev run (node bin/...) leaves 'contract-ops-agent' off PATH, so the\n'Run `contract-ops-agent` to start' message produced 'command not found'. The\nsetup-complete message now points at the source-run alternatives (node bin, or\nnpm link once). Real installs (npx / npm i -g) already have the command.",
"is_bot": false,
"headline": "fix(setup): explain how to start when running from source (not on PATH)",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-14T16:46:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "77229db92b917771389df9e83cb1a116edfe75e4",
"body": "Feedback: wizard worked but wasn't clear enough. Adds plain-language context:\n- banner explains what the enclosure means for the user (does contract work and\n nothing else on your machine)\n- Step 1 notes the tools are local; missing = free, installs via pip/npm\n- Step 2 explains the workspace is th\n[…]\n / never-signs promise\n\nAsk-sequence unchanged; 27 offline tests green.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Eb2KPgFieBjUKvpbLCEAXi",
"is_bot": false,
"headline": "feat(setup): clearer guidance at every step",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-14T16:40:02Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "769d8b001c27fbc102b0a15248c9913ced186ca6",
"body": "…nu, summary\n\nPolishes the first-run/`setup` wizard to read as a guided onboarding:\n- welcome banner + one-line \"what this is\"\n- explicit Step 1/3 · Environment, 2/3 · Workspace, 3/3 · Authentication\n- environment check shown even when clean (✓ all N CLIs · ✓ PDF backend)\n- richer install menu: [A]l\n[…]\novider line reads \"Claude\" (multi-provider is the separate v0.3 scope).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Eb2KPgFieBjUKvpbLCEAXi",
"is_bot": false,
"headline": "feat(setup): OpenClaw-style guided wizard — banner, steps, install me…",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-14T13:50:46Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "b0d4f9c3d0590c6fad7a3aa290a038b8fc7c0ef3",
"body": "Renames the harness to fit the contract-ops family (the contract-ops CLIs +\ncontract-ops-mcp server). Command, package name, config dir\n(~/.config/contract-ops-agent), env override (CONTRACT_OPS_AGENT_MCP_PATH), REPL\nprompt, bin file, scope doc, and workflows all updated. The published\ncontract-ops-mcp package is unaffected. 27 offline tests green.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Eb2KPgFieBjUKvpbLCEAXi",
"is_bot": false,
"headline": "rename: legal-harness → contract-ops-agent",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-13T17:05:06Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "52c56b51a4c4dd57ca2d281ba5170f39dcc13c8d",
"body": "- .github/workflows/ci.yml — offline test suite on push/PR\n- .github/workflows/publish.yml — tag-triggered `npm publish --provenance`\n via GitHub OIDC Trusted Publishing (no NODE_AUTH_TOKEN), gated on tests +\n a tag-vs-package.json version check\n- remove `private: true` so the package can publ\n[…]\neleasing.md);\nafter that, releases are a tag push. No new tag cut here.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Eb2KPgFieBjUKvpbLCEAXi",
"is_bot": false,
"headline": "ci: add CI + OIDC npm-publish workflows; make package publishable",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-13T16:48:18Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "b5f71f7787fec7150a9e43657dc7aac8a11a2b26",
"body": "…scope doc\n\nThe authoring path (fill_template) now works on a fresh install — 0.1.7 ships\nthe draft --params <file> fix. Moves the Tier 3 scope doc into this repo's docs/.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Eb2KPgFieBjUKvpbLCEAXi",
"is_bot": false,
"headline": "chore: bump contract-ops-mcp to ^0.1.7 (fill_template fix); relocate …",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-13T16:43:09Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "d0daa5fb3148619ff34206bf53390d7bf53f0ff7",
"body": "…tence\n\nInstall → set up → point at credentials → use. First run walks a one-time\nwizard (install missing CLIs, pick workspace, choose auth), persists config,\nthen drops into the REPL; later runs go straight to it. Adds `setup` and\n`doctor` subcommands.\n\n- src/config.mjs config + 0600 credentials,\n[…]\noarding tests;\n27 offline tests green. Scope: docs/onboarding-scope.md.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Eb2KPgFieBjUKvpbLCEAXi",
"is_bot": false,
"headline": "feat: OpenClaw-style onboarding — setup wizard, doctor, config persis…",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-13T16:32:07Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "11a871fe38f72110766bd858bee7ab9d15ee09db",
"body": "…w + convert)\n\nCloses the gap between \"wired in\" and \"proven in a real session\" for the whole\nsuite. Adds L8–L12 to the live suite, each seeding a real fixture and driving\nthe actual CLI through the enclosure:\n\n L8 compare_versions — two contract versions, real drift reported\n L9 template_vault\n[…]\nte 12/12 green; sign stays the sole deliberate carve-out (verify-only).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Eb2KPgFieBjUKvpbLCEAXi",
"is_bot": false,
"headline": "test: live turns for every curated tool (compare + all vaults + revie…",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-13T16:00:19Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "a3364214f40f457f5c0d1a6802f3bc90a4f35ad9",
"body": "An interactive smoke session found that a closed stdin (EOF / Ctrl-D / a\nclosed pipe) threw ERR_USE_AFTER_CLOSE from the next readline question. The\nprompt mutex now resolves to {closed:true} on readline 'close', and every\ncall site treats that as a graceful /quit (a closed gate declines). Adds a\nre\n[…]\n\nreactive interactive session (extract→lint, fill gate approve, /quit).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Eb2KPgFieBjUKvpbLCEAXi",
"is_bot": false,
"headline": "fix: exit cleanly on stdin EOF instead of ERR_USE_AFTER_CLOSE",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-13T14:57:01Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "b0c8b40a23f80dd522eabe99f9b40223c93d423c",
"body": "A Claude Agent SDK terminal agent whose only tools are the contract-ops MCP\nsuite: no shell, no filesystem, no web, no signing — enforced by three layers\n(disallowedTools context stripping, a canUseTool deny/confirm policy, and a\nfail-closed startup assertion on the mounted tool list).\n\nBuilt per do\n[…]\nn env-leak to the CLI boundary, and transcript location/crash handling.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Eb2KPgFieBjUKvpbLCEAXi",
"is_bot": false,
"headline": "legal-harness v0.1.0 — enclosed contract-ops agent",
"author_name": "Baher Al Hakim",
"author_login": "DrBaher",
"committed_at": "2026-07-13T14:10:25Z",
"body_truncated": true,
"is_coding_agent": true
}
],
"releases_count": 17,
"commits_last_year": 56,
"latest_release_at": "2026-07-17T10:40:16Z",
"latest_release_tag": "v0.11.1",
"releases_from_tags": true,
"days_since_last_push": 4,
"active_weeks_last_year": 2,
"days_since_latest_release": 4,
"mean_days_between_releases": 0.2
},
"community": {
"has_readme": true,
"has_license": false,
"has_description": true,
"has_contributing": false,
"health_percentage": 28,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "contract-ops-agent",
"exists": true,
"license": "MIT",
"keywords": [],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/contract-ops-agent",
"is_deprecated": false,
"latest_version": "0.11.1",
"repository_url": "https://github.com/DrBaher/contract-ops-agent",
"versions_count": 14,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 2085,
"first_published_at": "2026-07-14T10:33:52.838000Z",
"latest_published_at": "2026-07-17T10:40:43.492000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 4
}
]
},
"popularity": {
"forks": 0,
"stars": 0,
"watchers": 0,
"fork_history": {
"days": [],
"complete": true,
"collected": 0,
"total_forks": 0
},
"star_history": {
"days": [],
"complete": true,
"collected": 0,
"total_stars": 0
},
"open_issues_and_prs": 0
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": true,
"has_mcp_signal": true,
"bootstrap_files": [],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [],
"largest_source_bytes": 27604,
"source_files_sampled": 33,
"oversized_source_files": 0,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"package.json"
],
"advisories": {
"error": null,
"scope": null,
"source": null,
"findings": [],
"collected": false,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 0,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"npm"
],
"dependencies": [
{
"name": "@anthropic-ai/claude-agent-sdk",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^0.3.207"
},
{
"name": "contract-ops-mcp",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^0.3.0"
},
{
"name": "openai",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^6.46.0"
},
{
"name": "zod",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^4.4.3"
}
],
"all_dependencies": {
"error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"source": null,
"packages": [],
"collected": false,
"truncated": false,
"total_count": null,
"direct_count": null,
"indirect_count": null
}
},
"maintainership": {
"issues": {
"open_prs": 0,
"merged_prs": 0,
"open_issues": 0,
"closed_ratio": null,
"closed_issues": 0,
"closed_unmerged_prs": 0
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "DrBaher",
"commits": 56,
"avatar_url": "https://avatars.githubusercontent.com/u/1499131?v=4"
}
],
"contributors_sampled": 1,
"top_contributor_share": 1
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"ci.yml",
"container.yml",
"publish.yml"
],
"has_docs_dir": true,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"package-lock.json"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 0,
"reason": "branch protection not enabled on development/release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": null,
"reason": "no pull request found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/30 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 3,
"reason": "project has 1 contributing companies or organizations -- score normalized to 3",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 0,
"reason": "license file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 0,
"reason": "project was created within the last 90 days. Please review its contents carefully",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": 10,
"reason": "packaging workflow detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 0,
"reason": "dependency not pinned by hash detected -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "no SAST tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 8,
"reason": "2 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "fdd59021eeaa2ebff76d051cf3e9dfb0eb382359",
"ran_at": "2026-07-22T09:47:48Z",
"aggregate_score": 3.1,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-17T10:40:47Z",
"oldest_open_prs": [],
"last_merged_pr_at": null,
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": []
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/DrBaher/contract-ops-agent",
"host": "github.com",
"name": "contract-ops-agent",
"owner": "DrBaher"
},
"metrics": {
"overall": {
"key": "overall",
"band": "at_risk",
"name": "Overall health",
"note": null,
"notes": [],
"value": 45,
"inputs": {
"security": 31,
"vitality": 67,
"community": 23,
"governance": 35,
"engineering": 66
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "moderate",
"name": "Vitality",
"value": 67,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "moderate",
"name": "Development activity",
"note": null,
"notes": [],
"value": 53,
"inputs": {
"commits_last_year": 56,
"human_commit_share": 1,
"days_since_last_push": 4,
"active_weeks_last_year": 2
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 4 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 4
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "2/52 weeks with commits",
"points": 1.4,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 2
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "56 commits in the last year",
"points": 15.8,
"status": "partial",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 56
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 88,
"inputs": {
"releases_count": 17,
"latest_release_tag": "v0.11.1",
"releases_from_tags": true,
"days_since_latest_release": 4,
"mean_days_between_releases": 0.2
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "17 version tags (no GitHub releases)",
"points": 16.2,
"status": "partial",
"details": [
{
"code": "version_tags_no_releases",
"params": {
"count": 17
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 4 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 4
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~0.2 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 0.2
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "unverified",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": "repository_too_young",
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": null,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "maintenance record not established from the collected data",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_unverified",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "critical",
"name": "Community & Adoption",
"value": 23,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 1,
"inputs": {
"forks": 0,
"stars": 0,
"watchers": 0,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "0 stars",
"points": 0,
"status": "missed",
"details": [
{
"code": "stars",
"params": {
"count": 0
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "0 forks",
"points": 0,
"status": "missed",
"details": [
{
"code": "forks",
"params": {
"count": 0
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "0 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 0
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "critical",
"name": "Community health",
"note": null,
"notes": [],
"value": 25,
"inputs": {
"has_readme": true,
"has_license": false,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "no license file detected",
"points": 0,
"status": "missed",
"details": [
{
"code": "license_absent",
"params": {}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
},
{
"key": "ecosystem_adoption",
"band": "moderate",
"name": "Ecosystem adoption (downloads)",
"note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"registry_dependents"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 55,
"inputs": {
"packages": [
"contract-ops-agent"
],
"dependents": null,
"ecosystems": "npm",
"total_downloads": null,
"monthly_downloads": 2085
},
"components": [
{
"key": "monthly_downloads",
"name": "Monthly downloads",
"detail": "2,085 downloads/month across npm",
"points": 44.3,
"status": "partial",
"details": [
{
"code": "downloads_monthly",
"params": {
"count": 2085,
"ecosystems": "npm"
}
}
],
"max_points": 80
},
{
"key": "registry_dependents",
"name": "Registry dependents",
"detail": "not reported by this ecosystem",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_reported_by_this_ecosystem",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "at_risk",
"name": "Sustainability & Governance",
"value": 35,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 13,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 1,
"top_contributor_share": 1
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 100% of commits",
"points": 0,
"status": "missed",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 100
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "1 contributors",
"points": 1.4,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 1
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 1 contributing companies or organizations -- score normalized to 3",
"points": 3,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "critical",
"name": "Issue & PR responsiveness",
"note": "Excluded from scoring (no data or not applicable): Issue resolution, PR acceptance. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"issue_resolution",
"pr_acceptance"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 1,
"inputs": {
"merged_prs": 0,
"open_issues": 0,
"closed_issues": 0,
"issue_closed_ratio": null,
"closed_unmerged_prs": 0
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "no issues or no data",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_issues_or_data",
"params": {}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "no decided pull requests or no data",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_decided_prs_or_data",
"params": {}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "at_risk",
"name": "Ownership & stewardship",
"note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"verified_domain"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 43,
"inputs": {
"followers": 1,
"owner_type": "User",
"is_verified": null,
"owner_login": "DrBaher",
"public_repos": 27,
"account_age_days": 5252
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "personal (user) account",
"points": 10,
"status": "partial",
"details": [
{
"code": "owner_personal",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": "not applicable to user accounts",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_applicable_to_user_accounts",
"params": {}
}
],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "1 followers of DrBaher",
"points": 2.2,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 1,
"login": "DrBaher"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "27 public repos, account ~14 yr old",
"points": 22.5,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 27
}
},
{
"code": "account_age_years",
"params": {
"years": 14
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"contract-ops-agent"
],
"ecosystems": "npm",
"any_deprecated": false,
"min_days_since_publish": 4
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on npm",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "npm"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 4 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 4
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "14 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 14
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "moderate",
"name": "Engineering Quality",
"value": 66,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "moderate",
"name": "Engineering practices",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_ci_tests"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 60,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "3 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 3
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "no pull request found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "good",
"name": "Documentation",
"note": null,
"notes": [],
"value": 75,
"inputs": {
"topics": [],
"has_wiki": true,
"homepage": null,
"has_readme": true,
"has_docs_dir": true,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 25,
"status": "met",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "at_risk",
"name": "Security",
"value": 31,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "at_risk",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): CI-Tests, Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"ci_tests",
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 31,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 16,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 2,
"scorecard_aggregate": 3.1
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection not enabled on development/release branches",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "no pull request found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 1 contributing companies or organizations -- score normalized to 3",
"points": 0.8,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "no SAST tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "2 existing vulnerabilities detected",
"points": 6,
"status": "partial",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 2
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "at_risk",
"name": "AI Readiness",
"value": 40,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 1,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "56 of 56 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 56,
"sampled": 56
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "at_risk",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 42,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"package-lock.json"
],
"has_dockerfile": true,
"typed_language": false,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [],
"agent_commit_share": 0.75,
"toolchain_manifests": [],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "Dockerfile, lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Dockerfile, lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "42 of the last 56 commits agent-authored or agent-credited",
"points": 10,
"status": "met",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 42,
"sampled": 56
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "moderate",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 55,
"inputs": {
"primary_language": "JavaScript",
"largest_source_bytes": 27604,
"source_files_sampled": 33,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "JavaScript without a type-check config",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_typecheck_config_language",
"params": {
"language": "JavaScript"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/33 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 33,
"oversized": 0
}
}
],
"max_points": 55
}
]
},
{
"key": "ai_interfaces",
"band": "critical",
"name": "Machine-readable interfaces",
"note": null,
"notes": [],
"value": 20,
"inputs": {
"example_dirs": [],
"has_mcp_signal": true,
"api_schema_files": []
},
"components": [
{
"key": "api_schema_openapi_graphql_proto",
"name": "API schema (OpenAPI/GraphQL/proto)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 40
},
{
"key": "mcp_server",
"name": "MCP server",
"detail": null,
"points": 20,
"status": "met",
"details": [],
"max_points": 20
},
{
"key": "runnable_examples",
"name": "Runnable examples",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 40
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"deps.dev does not index npm:contract-ops-agent@0.11.1; advisories assessed against the repository dependency graph instead"
],
"report_type": "repository",
"generated_at": "2026-07-22T09:47:53.336428Z",
"schema_version": "0.26.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/d/DrBaher/contract-ops-agent.svg",
"full_name": "DrBaher/contract-ops-agent",
"license_state": "absent",
"license_spdx": null
}Las puntuaciones son señales, no garantías. Reflejan prácticas públicamente visibles en GitHub; no son una auditoría de código ni una garantía de seguridad.
Los datos ausentes se excluyen y los pesos se renormalizan; nunca se puntúan como cero. La metodología es versionada y abierta: métricas v1.13.0, esquema v0.26.0 — metodología completa · wiki de métricas.
Cómo se sitúa un resultado dentro del registro general: estadísticas agregadas — npm.