InverseAltruism / cairn-cli

No fue posible recopilar el conjunto de dependencias resuelto para este informe: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository

Instalar npm:@inversealtruism/cairn-cli@0.3.23 arrastra 6 paquetes, directos y transitivos: 0 tienen avisos conocidos, de los cuales 0 son dependencias directas.

Ningún aviso conocido afecta a las dependencias evaluadas.

Un aviso significa que la versión registrada en el grafo de dependencias cae dentro del rango afectado de un aviso. No se analiza la alcanzabilidad, y el grafo incluye fijaciones de desarrollo y prueba: un hallazgo puede referirse al utillaje y no al software distribuido.

{
  "data": {
    "repo": {
      "topics": [],
      "is_fork": false,
      "size_kb": 174,
      "has_wiki": true,
      "homepage": "https://cairn-substrate.com",
      "languages": {
        "Shell": 2340,
        "JavaScript": 133734,
        "TypeScript": 41091
      },
      "pushed_at": "2026-07-23T18:02:03Z",
      "created_at": "2026-05-28T22:55:53Z",
      "owner_type": "User",
      "updated_at": "2026-07-23T18:02:16Z",
      "description": "Command-line client for Cairn on Compute Substrate -- browse, verify, propose, and attest directly in the CLI.",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "MIT",
      "default_branch": "master",
      "license_spdx_raw": "MIT",
      "primary_language": "JavaScript",
      "significant_languages": [
        "JavaScript",
        "TypeScript"
      ]
    },
    "owner": {
      "blog": "https://cairn-substrate.com",
      "name": "Inverse",
      "type": "User",
      "login": "InverseAltruism",
      "company": null,
      "location": null,
      "followers": 16,
      "avatar_url": "https://avatars.githubusercontent.com/u/129900527?v=4",
      "created_at": "2023-04-04T20:12:40Z",
      "is_verified": null,
      "public_repos": 12,
      "account_age_days": 1211
    },
    "license": {
      "state": "standard",
      "spdx_id": "MIT",
      "raw_spdx": "MIT",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.3.1",
          "kind": "patch",
          "published_at": "2026-06-06T21:18:34Z"
        },
        {
          "tag": "v0.3.0",
          "kind": "minor",
          "published_at": "2026-06-04T17:41:23Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "87830654087685ea06b3c99a5d736777c614c0fb",
          "body": "…REBIND LTS baseline",
          "is_bot": false,
          "headline": "docs(FU-C): refresh the AGENTS State snapshot to the 2026-07-23 post-…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-23T18:02:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a7678986b453a56e1d4e8c4b2c03a3979346d91f",
          "body": null,
          "is_bot": false,
          "headline": "release: cairn-cli 0.3.23 (re-pin 0.1.40)",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-21T12:41:23Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "45affbdc142c926ed062013435eca3e80696d441",
          "body": "- State snapshot to S-06: version 0.3.22 @ 6af70df, pin truth (cairnx-core\n  0.1.38; the 0.1.40 re-pin + patch release = runbook), stale cairn-sdk\n  neighbor note dropped (it re-pinned long ago).\n- Plan 71 LTS perimeter: cairn-cli NAMED not-deep-audited per the residual\n  register, with its standing documented trust residuals (CLI-C1, CLI-C5/F10)\n  restated so the exclusion is written, not silent.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "B8-docs (REBIND): cairn-cli AGENTS/truth pass",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-21T00:36:00Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "6af70df9c23c5af2c549efbd9c68d42d6e41d873",
          "body": "Plan 70 consumer re-pin (handoff 71). Published @inversealtruism/cairn-cli@0.3.22\nnow pins the freshly published cairnx-core 0.1.38, satisfying the strict\ncheck-consumer-pins consumer. resolve()/records() byte-identical 0.1.37 to\n0.1.38 (only FILL_TIP_MARGIN + verifyfill changed, neither imported by the CLI),\nso the CLI runtime is identical. clean+tsc build and the full test suite\n(security, cairnx, e2e) green on the new pin.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(release): re-pin cairnx-core 0.1.38 for the v0.3.22 publish",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-17T18:05:56Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "768edbf5ba6082ff7fe8f40eee6d5df05d80cacb",
          "body": "Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_017h7GYgP2JsDnoVu5uP1VAH",
          "is_bot": false,
          "headline": "Merge Plan 70 R2/R3 into master (branch plan70-r2)",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-17T09:07:01Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "6a051a4999e000efadf185e42f8d1e10c947a8b1",
          "body": "…argv)\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_017h7GYgP2JsDnoVu5uP1VAH",
          "is_bot": false,
          "headline": "release: cairn-cli 0.3.22 (Plan 70 R2: F10 --base-units + L7 key off …",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-17T09:06:14Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "cd3e3377c28894b552c7c5726de0d096fb20ef70",
          "body": "…s addr derive\n\nF10 (CLI-C5): token-send scaled a human amount by the untrusted `decimals`\nfrom the CairnX read API; a hostile/pinned/MITM'd gateway over-reporting\ndecimals inflated the magnitude, and --yes/piped runs skip the y/N confirm,\nso automation could silently over-send. Additive, no honest-\n[…]\nnoEmit clean.\nNo version bump/tag/publish (maintainer release actions).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_017h7GYgP2JsDnoVu5uP1VAH",
          "is_bot": false,
          "headline": "Plan 70 R2 Batch E: F10 --base-units/--expect-decimals + L7 in-proces…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-17T00:53:58Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "c65870113cb847b01ef36c038d2220a8c8fb0a02",
          "body": "V28 fclaim is a consensus-gate release, so the CLI re-pins per the standing rule. cairnx-core 0.1.37\ncarries the V28 fclaim rules (gate 60,000, inert below); the CLI consensus shapes stay imported. Tests 38/0.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: re-pin cairnx-core 0.1.36 -> 0.1.37 (V28 gate); release v0.3.21",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-13T14:03:26Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "28cf94ced4ad06a40045e45298a7bb389ad646c5",
          "body": "Consensus-identical helper bump (0.1.35..0.1.36 resolve/records/types diff\nempty; CLI imports only stable consensus-surface exports). Lockfile\nregenerated; suite 38/0.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: re-pin cairnx-core 0.1.35 -> 0.1.36; release v0.3.20",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-10T20:11:47Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "68d6e335b2f2a926791210966bf37016d256a3b3",
          "body": "AGENTS.md is the canonical repo briefing for coding agents and outside\ncontributors; CLAUDE.md imports it via @AGENTS.md (edit AGENTS.md only).\nProduction and operations specifics are intentionally out of scope and\nmaintained privately.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: add public agent onboarding briefing (AGENTS.md + CLAUDE.md)",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-09T22:59:17Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "f08b067a6f46cfb123dc7377ae54018990c2344a",
          "body": "…mer-pins passes)\n\ncairn-cli uses only stable exports (epochOf/EPOCH_LEN/MIN_FEE_*/NAME_RE, all present since 0.1.34)\nso this is backward-compatible; the re-pin keeps the ecosystem on one canonical cairnx-core. 38/38.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: re-pin cairnx-core 0.1.35 (post-publish coherence; check-consu…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-06T17:41:09Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "dcab050732cb196c3a14ef218351a203ffe8e509",
          "body": "… CLI feeCap marked KEEP-DISTINCT\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "release: v0.3.19 — fee/epoch constants imported from pinned packages;…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-06T17:21:47Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "aab8ea518ad817bcabff990548a1a89951c88b6f",
          "body": "…e CLI fee bound as deliberately distinct\n\n- src/lib/config.ts: MIN_FEE_PROPOSE/MIN_FEE_ATTEST re-exported from @inversealtruism/csd-codec\n  (the local literals were a duplicate of an import that already existed 10 lines away).\n- src/cli.ts: the three Math.floor(tip / 30) hardcodes now use epochOf/E\n[…]\neCap - this is a deliberate CLI-level\n  25%-of-value sanity bound, not the consensus-side input cap; do not dedupe.\n\nnpm test green (38 passed).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "quality: import fee/epoch constants from the pinned packages; mark th…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-06T15:25:05Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "88d19187f6fdd96d1ed2c5204a3308557e946278",
          "body": null,
          "is_bot": false,
          "headline": "0.3.18",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-05T00:11:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2b7f6a4e01ae39d8f7abba5c9468f4ad109410f1",
          "body": "…l-closed)",
          "is_bot": false,
          "headline": "cli: re-pin cairnx-core 0.1.34 / csd-registry 0.1.16 (M2 registry fai…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-05T00:11:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "538819be94ee31c9877547ddb6e6dd15955c2cf2",
          "body": "…,440 / V26 46,480 / V27 46,520)\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "cli 0.3.17: re-pin cairnx-core 0.1.33 (gate move: V24 46,400 / V25 46…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-03T13:21:03Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "3320d3fed01841c18c1c44c36baf989f70b2098a",
          "body": "Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "cairn-cli 0.3.16: re-pin cairnx-core 0.1.32 (V27 sale-embargo gate)",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-03T07:48:16Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "fb819e938e92dd249a0ffa4cafc41f8b5a48da13",
          "body": "…); ships the P8 --fee fallback warning\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "cairn-cli 0.3.15: re-pin cairnx-core 0.1.31 + csd-* 0.1.15 (published…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-02T23:00:42Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "50048d817874e7979b1fa1c2a591d53ff316ebe8",
          "body": "…8, Plan 57)\n\nSafe direction already (the fee only falls DOWN to the default/minimum since 0.3.14's exact\nparsing), but silently: a typo like --fee 2e-2 looked accepted while a different fee was used.\nOne shared warnBadFee helper, all six fee sites covered.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(cli): warn when an unparseable --fee falls back to the default (P…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-02T22:58:08Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "e89ee84819b0cdbca241894a852f3420a35f07cf",
          "body": "…oney seam) + transfer() via cairnx-core\n\nPlan 57 B5a (Plan 56 items 17 + micro-9). CSD() now reuses the token path's\nexact humanToBase (8 dp): both money paths speak the same input language.\nCloses real input footguns the old Number() path accepted: a bare --amount\nflag sent 1 CSD, '1e2' sent 100 C\n[…]\nlus a\n5,000-case fuzz in review. Suite 38/38. Independent review: SHIP (3 NITs,\n2 applied, fee-fallback warn declined to keep old UX semantics).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(cli): exact decimal-string CSD parsing (kills the last float-on-m…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-02T20:00:49Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "164ccd571996d021c80f51239f6bc2fb5be04207",
          "body": "…ames (H1); 0.3.14\n\nA v2.5/v2.6 reservation (revealed, not yet finalized) was listed indistinguishably from an owned name. Display-only\n(the CLI has no name-write path, so no burn), but it misled the reserver. Now `tokens` and `names` mark a reservation\n\"(finalizing)\" using the new /cairnx/address n\n[…]\ntails.pending flag (cairnx 0.4.14+); defensive against an older\nresolver that omits nameDetails (empty set). --json output unchanged. tsc clean.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(cli): mark `pending` name reservations \"(finalizing)\" in tokens/n…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-01T21:35:14Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "f899599d81a7d2a7dee1826ee57c511e4740e5c5",
          "body": "Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "cairn-cli 0.3.13: re-pin cairnx-core 0.1.30 (V25/V26 close gates)",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-01T19:33:22Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "8b1bd41cad7f8a732d8b5ce30e2bdfc22500114b",
          "body": "Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "0.3.12: re-pin cairnx-core 0.1.28",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-01T18:32:35Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "987936073e666fbce32c4aa711bc16cd2e2a1c10",
          "body": "Read-only names (no register flow), so no nfinalize command needed. Builds + tests green\n(security 37/0, cairnx 89/0). Published @inversealtruism/cairn-cli 0.3.10.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "0.3.10: re-pin cairnx-core 0.1.26 (V25-aware core)",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-07-01T17:46:06Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "7ca73555a1e5b73a878095730186ed04202c28d6",
          "body": "… v0.3.9\n\nRe-pinned to the V24 core so the cli resolves names against the same fee schedule as the\nresolver. Below V24 (49200) byte-identical; no name-fee build path in the cli (read/verify).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(cli): re-pin cairnx-core 0.1.23 -> 0.1.24 (v2.4 name-fee gate);…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-30T20:08:51Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "3c4aeab40d92c25c0714784535b7f8ea6abc4923",
          "body": "…dTo); v0.3.8\n\nLockstep with the published V23 core. Byte-identical below the gate; the CLI signs payment\nfields itself, so this is a transparent dependency refresh.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(cli): re-pin cairnx-core 0.1.20 -> 0.1.23 (V23 nset-clear + pai…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-27T14:55:41Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "a9a41cc264a4b9d014f26032fcfadc3b491cb5e3",
          "body": "Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: remove em dashes from READMEs and docs (house style, no AI-slop)",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-26T19:38:45Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "f2aa5c7777caa9a7cf72b908ea0a7e9608b2c25f",
          "body": "Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(cli): re-pin cairnx-core 0.1.19 -> 0.1.20 (V22 un-cap); v0.3.7",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-26T15:43:34Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "67b3a3797a556035cae1ed50566558369427e91d",
          "body": "…er publish)\n\n0.1.19 is published; align the CLI pin so every consumer references one coherent contract version\n(audit Batch-3 version-skew finding). Byte-identical regexes/limits (0.1.19 is purely additive over 0.1.18);\nbuild + test/cairnx 89/0 + test/security 37/0 green.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(cli): re-pin cairnx-core 0.1.18 → 0.1.19 (version-coherence aft…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-24T19:10:43Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "c427e46c681d5239f069cae67852d308fea1d89d",
          "body": "…e missed CLI mirror (Phase 3)\n\ncairn-cli/src/lib/cairnx.ts hand-declared NAME_RE/TICKER_RE/ADDR_RE/MAX_AMOUNT/MAX_RECORD_BYTES and used\nthem to validate a record BEFORE the CLI spends the 0.25-CSD anchor fee — a genuine fork-class (a drifted\nregex builds a record the resolver no-ops → lost fee) tha\n[…]\nmjs 37/0. Byte-identical: the imported regexes/\nlimits equal the old hand-decls (the published 0.1.18 dist exports them verbatim).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(cli): import the consensus shapes from cairnx-core — collapse th…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-24T18:05:03Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "4d72518581d15256f538286ba2ac2308dd9e8187",
          "body": "…p 0.1.14\n\nRemediates the Wave-3 deep audit (cairn/docs/security/cairn-cli-deep-audit-2026-06-21.md).\nFunds-safe as audited (no recipient redirection possible — csd signs the payment fields);\nall fixes reject-more / fail-closed on the hostile path, honest path unchanged. Suites green\n(security 37 +C\n[…]\nn (single source; byte-identical).\n\nSupply chain: 0.3.5->0.3.6, csd-codec/registry 0.1.3->0.1.14 (lockstep), lockfile regenerated.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "security(wave3-audit): v0.3.6 — C3/C1 HIGH fixes + C4/C5/C2 + lockste…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-21T02:14:19Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "bc7fe36f69b90b778eeea256ce7f7a5bdf05f4bf",
          "body": "Adds .github/workflows/ci.yml running npm ci/build/test on push and PR.\nThe e2e suite skips cleanly offline (exit 0) by design.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "ci: add GitHub Actions workflow (build + test on Node 22)",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-21T00:58:04Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "6e316dcb4289f29bf05c87bee2c861808eb78927",
          "body": "…v0.3.5",
          "is_bot": false,
          "headline": "merge: cli H-1/H-2 key handling + UTXO-VALUE-1 cross-source + H-7 -> …",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-15T00:32:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ac0f46c8ea1b7f991e6dd1bd7f269fc0aa1ad9d0",
          "body": "…+ H-7 (v0.3.5)\n\nCloses the cairn-cli audit findings the prior max-fee guard (v0.3.4) did not:\n\nH-1 — `csd` binary was a bare $PATH lookup (a planted csd steals the wallet key on\n  any write, even --dry-run). Now resolved from CANONICAL absolute locations first\n  (defeats PATH-order hijack), PATH on\n[…]\n cross-source mismatch refusal, H-7 wording);\ncairnx 89, e2e 38 — all green. Live happy-path verified (\"✓ verified vs your node\").\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "security(cli): H-1/H-2 key handling + UTXO-VALUE-1 cross-source cure …",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-15T00:32:51Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "bc01dc97517f160c17d9b0060ac5eba8d27ebf5d",
          "body": "Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "release: v0.3.4 — UTXO-VALUE-1 max-fee guard",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-14T23:34:33Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "c802719f32ff542de4b5eda1302ef1caafd0faf6",
          "body": "…arning\n\ncairn-cli shells out to `csd` with a proxy-fetched UTXO and has no codec to recompute\nreal input values, so a lying RPC could under-report a value and silently burn the gap\nas fee. Add a max-fee sanity guard (refuse a fee > max(1 CSD, 25% of value moved), with\na --max-fee override) on send/\n[…]\nsend, plus a collapsed-\nchange warning (the under-report signature); --dry-run surfaces it without spending.\nsecurity suite 25→29.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "security(cli): UTXO-VALUE-1 max-fee sanity guard + collapsed-change w…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-14T23:34:33Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "f58440ef1a4ad92b48eaa4871dfc0d7ca6275ad1",
          "body": "…g-addr + verify-badge (v0.3.3)\n\n2026-06-14 audit remediation (see /opt/cairn_substrate/HANDOFF-HARDENING-2026-06-14.md):\n- R17 — submit success is EVIDENCE-BASED: a non-acked submit confirms OUR exact txid on-chain\n  (api.confirmTxMined) rather than trusting a forgeable \"already present/conflict\" s\n[…]\nndent; the payload_hash recompute\n  is unchanged.\n\nTests: 152 passed (security 25 + cairnx 89 + e2e 38), 0 regressions; tsc clean.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "security(hardening): evidence-based submit, RPC freshness gate, confi…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-14T06:06:52Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "21dca0871904066b09750a8e9d3853842ee7f9e7",
          "body": "Block commits that introduce secrets (private keys, API tokens). Scans\nstaged diff only; never edits files. .gitleaks.toml extends the default\nruleset and allowlists public on-chain data, conformance vectors, vendored\nforge-std, and doc placeholders (verified 0 false positives over full\nhistory). Missing-binary degrades to warn-and-skip; bypass a confirmed FP\nwith --no-verify. Activate on clone: bash .githooks/install.sh\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: add gitleaks pre-commit secret-scan hook",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-12T22:27:42Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "0e6b3c9c34782b86f9f4b2b7277666905c3e38d6",
          "body": "Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: ignore .claude/ worktrees",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-12T15:36:50Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "5bf0be41d9221b298aee75fa3039d57147a421ea",
          "body": "…info / token-send / names / name)\n\n- src/lib/cairnx.ts: CairnX read client (base order: $CAIRNX_API → local\n  127.0.0.1:8794/cairnx → public gateway, GET-only, fallback on network\n  failure only) + hand-rolled canonical transfer record builder (no dep on\n  the private cairnx repo; byte-exact vs cai\n[…]\nired into npm test; full suite 142 green (15 security + 89\n  cairnx + 38 e2e).\n- README: CairnX section + command table + CAIRNX_API config row.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(cairnx): first-class token + .csd name commands (tokens / token-…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-12T15:18:12Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "8151815f26d28e05e4432fb46b3ead411bc779dd",
          "body": "Updated README formatting for clarity and consistency.",
          "is_bot": false,
          "headline": "Fix formatting and punctuation in README.md",
          "author_name": "Inverse",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-09T08:37:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9a863a86270aa210dacf78c7d09679da035dee0f",
          "body": "…cess key-load (C-L3)\n\nFor send/propose/support the user's key stays inside the external `csd` wallet and\nnever enters the cairn-cli process. The L3 registry commands (gateway register /\npeer announce / identity claim) are the exception: they read the key from\n`csd wallet config` and sign the regist\n[…]\nreen\n(e2e 38, security 15); 0 vulns.\n\nBumps @inversealtruism/cairn-cli 0.3.1 -> 0.3.2. Found by the 2026-06-08 baseline (C-L3/D2).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "security(cli): pin L3 deps to exact versions + document the L3 in-pro…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-08T19:24:37Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "b6a1893c95088b666ef70b8199fb97592f2f5b24",
          "body": "cairn gateway register --url …/{hash}   → csd:gateways record\ncairn peer announce --peer-id --addr …   → csd:peers record\ncairn identity claim <handle> [--commit-only|--reveal --salt] → csd:identity (commit-reveal)\n\nEach builds a SIGNED record via @inversealtruism/csd-registry (binding sig computed\n\n[…]\nytes to the content origin (self-certified).\nMirrors the live-proven publish loop. --dry-run on all. Existing 53 tests still pass.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "L3 P6.0: cairn registry publish commands (gateway/peer/identity)",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-07T01:09:21Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "c64cb0279e0c9af946a78ead5e238b150d4cde3c",
          "body": "tsc never deletes outputs for removed sources, so a dirty local dist could ship\nstale artifacts (the discarded own-key keygen build left csdcore/key/txclient.js\nbehind). Clean dist first — portable, dependency-free (node fs.rmSync) — so every\nbuild/publish/clone produces only current sources. npm 0.3.1 was already published\nwith a clean (manually-wiped) dist; this prevents recurrence.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "build(cli): clean dist before tsc (build/prepare/prepublishOnly)",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-06T21:27:33Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "705ffaf5d006c2d178ee57a4ddf962619612b0f0",
          "body": "- decode-reveal banner, elapsed spinner, flicker-free watch countdown\n- security: san()/ANSI-injection strip, verify trust-claim downgrade, txid/\n  redirect validation, always-submit-via-proxy fix, privkey-off-argv\n- --dry-run on propose/support/wall place; e2e 20→38 + new security suite (15)\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Merge: v0.3.1 — terminal animations + security hardening + full e2e",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-06T21:18:17Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "2c271ccd1cb8d10aa2a4825b284e330b88f94015",
          "body": "…ll e2e\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "release: v0.3.1 — terminal animation polish + security hardening + fu…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-06T21:18:07Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "68a1bea2aa15f02aa313b311146dc1f81cbb56c7",
          "body": "signAndSubmit no longer returns early trusting csd's own auto-submit — csd\ntargets its configured node (e.g. 8789), which may not be the node the board +\nminer read (8790), so a tx could sit in the wrong mempool. Now always POST the\nsigned tx to the Cairn proxy; a benign 'already present / mempool c\n[…]\ncess (safe for a single-key wallet). Drops the unusable\ntxKnown() (the node /tx endpoint only indexes mined txs, not the mempool).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(cli): always submit via the Cairn proxy (miner-connected node)",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-06T20:46:48Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "61544e252cd9b4e6194eb33888b50fca9f837015",
          "body": "animations (TTY-gated, clig.dev preserved):\n- decode-reveal banner now scrambles each glyph then locks L→R behind a green\n  cursor (~420ms); spinner shows an elapsed counter on slow ops + clean stop;\n  new typeOut() typewriter + cursorHome() flicker-free repaint\n- watch repaints from cursor-home (no\n[…]\n (ANSI injection across 9 commands, forged-item verify, junk-txid rejection,\n  token-redirect leak, san unit); wired into npm test\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(cli): richer terminal animations + security hardening + full e2e",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-06T20:06:58Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "a5a12d4e81d0bbe0956ec2a329c2885390fc1a8c",
          "body": "cairn-cli can now transact, without ever holding a key: it drives the user's own\n`csd` wallet for signing and adds the Cairn layer on top.\n\n- New `src/lib/csd.ts`: wraps the installed `csd` binary (resolve, run, wallet config,\n  derive addr). Writes shell out to `csd` (easy-path propose/attest/spend\n[…]\n functional against the user's csd wallet. e2e 20/20\n(CAIRN_CSD forced absent in tests so they never sign). README + help updated.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: v0.3.0 — non-custodial wallet over your installed `csd`",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-04T17:40:58Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "b5c3be00fdee36225f10764213188af3e1b9cf60",
          "body": "….2.0\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Merge: CLI read commands (wall/network/quests/profile/leaderboard) v0…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-02T14:16:32Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "ed12c2dc3c59f29b989e50cde08aa524fb0736e8",
          "body": "Round out the CLI to match the site's surfaces — all read-only GET wrappers over existing board endpoints, monochrome phosphor theme preserved: cairn wall (King + top stones), cairn network/stats (live telemetry), cairn quests, cairn profile <addr> (identity + reputation), cairn leaderboard. README + version bumped to 0.2.0.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(cli): wall, network, quests, profile, leaderboard commands (v0.2.0)",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-02T14:16:32Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "fca6316fa34f9f4b982f73ac9138a0807f309f38",
          "body": "Scoped package name + public access + repo/homepage metadata; README install updated. v0.1.0 published.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Merge: publish to npm as @inversealtruism/cairn-cli",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-02T13:41:56Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "5c1c063059e29883331a1676ca6c1522495864d4",
          "body": "The bare name \"cairn-cli\" is owned by an unrelated third party, so publish under\nour own scope. Set the scoped package name, mark it public, and add repository +\nhomepage metadata. Install is now: npm i -g @inversealtruism/cairn-cli\n(README + the Cairn site updated to match). Published v0.1.0.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: publish to npm as @inversealtruism/cairn-cli",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-06-02T13:38:46Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "74c302cd28e8fe369810360c16215c258c041961",
          "body": "…-green); clig.dev\n\nRetheme the UI layer to match the website + wallet: black-and-white terminal with a\nsingle phosphor-green accent (#6ee7a0), bright-white emphasis, soft-red errors —\ndropping the old neon cyan/magenta. New banner is a fast (~360ms) decode-reveal of\nthe CAIRN wordmark with a blinki\n[…]\nrade\n- help documents the display flags\n\nLegacy color role-names remapped to the theme, so call sites are unchanged. CLI E2E\nstill 18/18 green.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "style: align CLI theme + animations with Cairn (monochrome + phosphor…",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-05-30T12:17:20Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "92acad57f8b767b6d3a6f8aa17930ebe4720db40",
          "body": "test/e2e.mjs runs the built CLI as a subprocess against a live Cairn instance and\nasserts on real output — every command (domains, ls, lenses, show, verify, recent,\nhelp) plus error/edge paths (bad id, unreachable API, missing token). Read-only by\ndefault and skips cleanly when no instance is reacha\n[…]\n). 18 read/error assertions + the gated write probe — all green\nagainst the live board; verified the full propose→index→show→verify round-trip.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "test: black-box E2E harness for the CLI",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-05-30T11:55:43Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "798313c63e7d11e33ad8bd7c6c72afc10f9a8eaa",
          "body": "- `cairn domains` now also lists open (discovered) domains, not just featured.\n- `cairn ls --sort <lens>` ranks by any lens the board precomputes\n  (totalWeight|quadratic|repWeight|conviction|supporterCount|createdHeight),\n  matching the web UI; sealed/revealed items are flagged.\n- help + README cla\n[…]\ntodial posting + sealed claims.\n\nReads + token-posting verified against the live API; the CLI was not broken, just\nbehind on the newer surface.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: open domains in `domains`, lens `--sort` for `ls`, accurate help",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-05-30T11:47:16Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "5a2f648d872ac689e3ba62d05d159a50a6607dcf",
          "body": null,
          "is_bot": false,
          "headline": "add MIT LICENSE file",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-05-30T00:46:33Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2991a868a5126bec014b2f1361072aea5a8523df",
          "body": "Pure HTTP client (no csd binary/keys needed to browse): ls/top/watch/recent/show\nread the board API; verify recomputes the content hash and (with CAIRN_RPC) checks\nit on-chain; propose/support post through the instance with CAIRN_TOKEN. Cyberpunk\nANSI UI, npm bin (cairn), tsc build via prepare. Config: CAIRN_API/TOKEN/RPC.",
          "is_bot": false,
          "headline": "cairn-cli v0.1.0 — installable terminal client for a Cairn board",
          "author_name": "InverseAltruism",
          "author_login": "InverseAltruism",
          "committed_at": "2026-05-28T22:55:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        }
      ],
      "releases_count": 2,
      "commits_last_year": 58,
      "latest_release_at": "2026-06-06T21:18:34Z",
      "latest_release_tag": "v0.3.1",
      "releases_from_tags": false,
      "days_since_last_push": 6,
      "active_weeks_last_year": 9,
      "days_since_latest_release": 52,
      "mean_days_between_releases": 2.2
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": false,
      "health_percentage": 42,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "@inversealtruism/cairn-cli",
          "exists": true,
          "license": "MIT",
          "keywords": [
            "cairn",
            "compute-substrate",
            "cli"
          ],
          "ecosystem": "npm",
          "matches_repo": true,
          "registry_url": "https://www.npmjs.com/package/@inversealtruism/cairn-cli",
          "is_deprecated": false,
          "latest_version": "0.3.23",
          "repository_url": "https://github.com/InverseAltruism/cairn-cli",
          "versions_count": 21,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": 1,
          "monthly_downloads": 2644,
          "first_published_at": "2026-06-02T13:34:00.690000Z",
          "latest_published_at": "2026-07-21T12:41:47.389000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 8
        }
      ]
    },
    "popularity": {
      "forks": 0,
      "stars": 0,
      "watchers": 0,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 0
      },
      "star_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_stars": 0,
        "collected_at": null
      },
      "open_issues_and_prs": 0
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [],
      "has_llms_txt": false,
      "has_dockerfile": false,
      "has_mcp_signal": false,
      "bootstrap_files": [],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [
        "tsconfig.json"
      ],
      "toolchain_manifests": [],
      "largest_source_bytes": 76515,
      "source_files_sampled": 10,
      "oversized_source_files": 1,
      "agent_instruction_files": [
        "AGENTS.md",
        "CLAUDE.md"
      ],
      "agent_instruction_max_bytes": 13082
    },
    "dependencies": {
      "manifests": [
        "package.json"
      ],
      "advisories": {
        "error": null,
        "scope": "published_package",
        "source": "osv",
        "findings": [],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {},
        "advisory_count": 0,
        "affected_count": 0,
        "assessed_count": 6,
        "malicious_count": 0,
        "assessed_package": "npm:@inversealtruism/cairn-cli@0.3.23",
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "npm"
      ],
      "dependencies": [
        {
          "name": "@inversealtruism/cairnx-core",
          "manifest": "package.json",
          "ecosystem": "npm",
          "version_constraint": "0.1.40"
        },
        {
          "name": "@inversealtruism/csd-codec",
          "manifest": "package.json",
          "ecosystem": "npm",
          "version_constraint": "0.1.15"
        },
        {
          "name": "@inversealtruism/csd-crypto",
          "manifest": "package.json",
          "ecosystem": "npm",
          "version_constraint": "0.1.15"
        },
        {
          "name": "@inversealtruism/csd-registry",
          "manifest": "package.json",
          "ecosystem": "npm",
          "version_constraint": "0.1.16"
        }
      ],
      "all_dependencies": {
        "error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
        "source": null,
        "packages": [],
        "collected": false,
        "truncated": false,
        "total_count": null,
        "direct_count": null,
        "indirect_count": null
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 0,
        "open_issues": 0,
        "closed_ratio": null,
        "closed_issues": 0,
        "closed_unmerged_prs": 0
      },
      "bus_factor": 1,
      "bot_contributors": 0,
      "top_contributors": [
        {
          "type": "User",
          "login": "InverseAltruism",
          "commits": 58,
          "avatar_url": "https://avatars.githubusercontent.com/u/129900527?v=4"
        }
      ],
      "contributors_sampled": 1,
      "top_contributor_share": 1
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "ci.yml"
      ],
      "has_docs_dir": false,
      "linter_configs": [],
      "has_editorconfig": false,
      "has_linter_config": false,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "package-lock.json"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": null,
            "reason": "no pull request found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/30 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 0,
            "reason": "project has 0 contributing companies or organizations -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 0,
            "reason": "no update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 0,
            "reason": "project was created within the last 90 days. Please review its contents carefully",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": null,
            "reason": "packaging workflow not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 3,
            "reason": "dependency not pinned by hash detected -- score normalized to 3",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "no SAST tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 0,
            "reason": "security policy file not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": null,
            "reason": "no releases found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 9,
            "reason": "1 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "87830654087685ea06b3c99a5d736777c614c0fb",
        "ran_at": "2026-07-29T19:56:31Z",
        "aggregate_score": 3.1,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": false,
      "has_dependabot_config": false
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-23T18:02:31Z",
      "oldest_open_prs": [],
      "last_merged_pr_at": null,
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": []
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/InverseAltruism/cairn-cli",
    "host": "github.com",
    "name": "cairn-cli",
    "owner": "InverseAltruism"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "moderate",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 50,
      "inputs": {
        "security": 45,
        "vitality": 75,
        "community": 32,
        "governance": 34,
        "engineering": 62
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "good",
        "name": "Vitality",
        "value": 75,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "moderate",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 58,
            "inputs": {
              "commits_last_year": 58,
              "human_commit_share": 1,
              "days_since_last_push": 6,
              "active_weeks_last_year": 9
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 6 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 6
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "9/52 weeks with commits",
                "points": 6.2,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 9
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "58 commits in the last year",
                "points": 15.9,
                "status": "partial",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 58
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "releases_count": 2,
              "latest_release_tag": "v0.3.1",
              "releases_from_tags": false,
              "days_since_latest_release": 52,
              "mean_days_between_releases": 2.2
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "2 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 52 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 52
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~2.2 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 2.2
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "at_risk",
        "name": "Community & Adoption",
        "value": 32,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 1,
            "inputs": {
              "forks": 0,
              "stars": 0,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "0 stars",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "0 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "moderate",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 50,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": false,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (MIT)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "MIT"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          },
          {
            "key": "ecosystem_adoption",
            "band": "moderate",
            "name": "Ecosystem adoption (downloads)",
            "note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "registry_dependents"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 57,
            "inputs": {
              "packages": [
                "@inversealtruism/cairn-cli"
              ],
              "dependents": null,
              "ecosystems": "npm",
              "total_downloads": null,
              "monthly_downloads": 2644
            },
            "components": [
              {
                "key": "monthly_downloads",
                "name": "Monthly downloads",
                "detail": "2,644 downloads/month across npm",
                "points": 45.6,
                "status": "partial",
                "details": [
                  {
                    "code": "downloads_monthly",
                    "params": {
                      "count": 2644,
                      "ecosystems": "npm"
                    }
                  }
                ],
                "max_points": 80
              },
              {
                "key": "registry_dependents",
                "name": "Registry dependents",
                "detail": "not reported by this ecosystem",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_reported_by_this_ecosystem",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "at_risk",
        "name": "Sustainability & Governance",
        "value": 34,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 10,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 1,
              "top_contributor_share": 1
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 100% of commits",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 100
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "1 contributors",
                "points": 1.4,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 0 contributing companies or organizations -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "critical",
            "name": "Issue & PR responsiveness",
            "note": "Excluded from scoring (no data or not applicable): Issue resolution, PR acceptance. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "issue_resolution",
                    "pr_acceptance"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 1,
            "inputs": {
              "merged_prs": 0,
              "open_issues": 0,
              "closed_issues": 0,
              "issue_closed_ratio": null,
              "closed_unmerged_prs": 0
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "no issues or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_issues_or_data",
                    "params": {}
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "no decided pull requests or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_decided_prs_or_data",
                    "params": {}
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "at_risk",
            "name": "Ownership & stewardship",
            "note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "verified_domain"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 42,
            "inputs": {
              "followers": 16,
              "owner_type": "User",
              "is_verified": null,
              "owner_login": "InverseAltruism",
              "public_repos": 12,
              "account_age_days": 1211
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "personal (user) account",
                "points": 10,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_personal",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": "not applicable to user accounts",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_applicable_to_user_accounts",
                    "params": {}
                  }
                ],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "16 followers of InverseAltruism",
                "points": 8.8,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 16,
                      "login": "InverseAltruism"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "12 public repos, account ~3 yr old",
                "points": 14.7,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 12
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 3
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "@inversealtruism/cairn-cli"
              ],
              "ecosystems": "npm",
              "any_deprecated": false,
              "min_days_since_publish": 8
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on npm",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "npm"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 8 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 8
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "21 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 21
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "moderate",
        "name": "Engineering Quality",
        "value": 62,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "moderate",
            "name": "Engineering practices",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_ci_tests"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 60,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": false,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "1 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "moderate",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 65,
            "inputs": {
              "topics": [],
              "has_wiki": true,
              "homepage": "https://cairn-substrate.com",
              "has_readme": true,
              "has_docs_dir": false,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": "https://cairn-substrate.com",
                "points": 15,
                "status": "met",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "at_risk",
        "name": "Security",
        "value": 45,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "at_risk",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): CI-Tests, Packaging, Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "ci_tests",
                    "packaging",
                    "signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 31,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 15,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 3,
              "scorecard_aggregate": 3.1
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 0 contributing companies or organizations -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "no update tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow not detected",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 3",
                "points": 1.5,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "no SAST tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file not detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "1 existing vulnerabilities detected",
                "points": 6.8,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "excellent",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): No advisories left outstanding. Remaining weights renormalized. Matched the npm:@inversealtruism/cairn-cli@0.3.23 runtime dependency closure — what installing the published package pulls in — 6 packages. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "no_advisories_left_outstanding"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_published",
                "params": {
                  "package": "npm:@inversealtruism/cairn-cli@0.3.23",
                  "assessed": 6
                }
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "source": "osv",
              "advisories": 0,
              "affected_packages": 0,
              "assessed_packages": 6,
              "unassessed_packages": 0,
              "affected_by_severity": "none",
              "direct_affected_packages": 0
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "no direct dependency carries a known advisory",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "no_direct_advisories",
                    "params": {}
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "no indirect dependency carries a known advisory",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "no_indirect_advisories",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory carries a publication date",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_no_publication_date",
                    "params": {}
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 6,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "good",
        "name": "AI Readiness",
        "value": 70,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "excellent",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 0.879,
              "agent_instruction_files": [
                "AGENTS.md",
                "CLAUDE.md"
              ],
              "agent_instruction_max_bytes": 13082
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "AGENTS.md, CLAUDE.md",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "AGENTS.md, CLAUDE.md"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "51 of 58 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 51,
                      "sampled": 58
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "moderate",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 56,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "package-lock.json"
              ],
              "has_dockerfile": false,
              "typed_language": false,
              "bootstrap_files": [],
              "has_devcontainer": false,
              "has_linter_config": false,
              "typecheck_configs": [
                "tsconfig.json"
              ],
              "agent_commit_share": 0.862,
              "toolchain_manifests": [],
              "dependency_bot_commit_share": 0
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "tsconfig.json",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "tsconfig.json"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "50 of the last 58 commits agent-authored or agent-credited",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "agent_authored_commits",
                    "params": {
                      "count": 50,
                      "sampled": 58
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "no automated dependency updates observed",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_dependency_automation",
                    "params": {}
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 3",
                "points": 3,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "good",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 76,
            "inputs": {
              "primary_language": "JavaScript",
              "largest_source_bytes": 76515,
              "source_files_sampled": 10,
              "oversized_source_files": 1
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "JavaScript with type-check config (tsconfig.json)",
                "points": 27,
                "status": "partial",
                "details": [
                  {
                    "code": "typecheck_config_language",
                    "params": {
                      "files": "tsconfig.json",
                      "language": "JavaScript"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "1/10 source files over 60KB",
                "points": 49.5,
                "status": "partial",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 10,
                      "oversized": 1
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-29T19:56:34.983650Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/i/InverseAltruism/cairn-cli.svg",
  "full_name": "InverseAltruism/cairn-cli",
  "license_state": "standard",
  "license_spdx": "MIT"
}