codefit-cli / codefit

No fue posible recopilar el conjunto de dependencias resuelto para este informe: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository

{
  "data": {
    "repo": {
      "topics": [
        "ai",
        "cli",
        "code-quality",
        "code-review",
        "developer-tools",
        "go",
        "mcp",
        "open-source",
        "security",
        "static-analysis"
      ],
      "is_fork": false,
      "size_kb": 1367,
      "has_wiki": true,
      "homepage": null,
      "languages": {
        "Go": 1117229,
        "Makefile": 2098
      },
      "pushed_at": "2026-07-20T19:31:47Z",
      "created_at": "2026-06-20T01:49:35Z",
      "owner_type": "Organization",
      "updated_at": "2026-07-20T19:05:07Z",
      "description": "CLI + MCP server that audits what AI-generated code hides: security risks, algorithmic complexity, DB quality & code review.",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "Apache-2.0",
      "default_branch": "main",
      "license_spdx_raw": "Apache-2.0",
      "primary_language": "Go",
      "significant_languages": [
        "Go"
      ]
    },
    "owner": {
      "blog": null,
      "name": null,
      "type": "Organization",
      "login": "codefit-cli",
      "company": null,
      "location": null,
      "followers": 1,
      "avatar_url": "https://avatars.githubusercontent.com/u/295263347?v=4",
      "created_at": "2026-06-20T01:16:13Z",
      "is_verified": null,
      "public_repos": 1,
      "account_age_days": 32
    },
    "license": {
      "state": "standard",
      "spdx_id": "Apache-2.0",
      "raw_spdx": "Apache-2.0",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.2.3",
          "kind": "patch",
          "published_at": "2026-07-20T19:06:42Z"
        },
        {
          "tag": "v0.2.2",
          "kind": "patch",
          "published_at": "2026-07-17T21:51:17Z"
        },
        {
          "tag": "v0.2.1",
          "kind": "patch",
          "published_at": "2026-07-08T21:21:53Z"
        },
        {
          "tag": "v0.2.0",
          "kind": "minor",
          "published_at": "2026-07-05T14:51:17Z"
        },
        {
          "tag": "v0.1.5",
          "kind": "patch",
          "published_at": "2026-06-29T21:14:57Z"
        },
        {
          "tag": "v0.1.4",
          "kind": "patch",
          "published_at": "2026-06-29T16:44:00Z"
        },
        {
          "tag": "v0.1.3",
          "kind": "patch",
          "published_at": "2026-06-29T04:47:52Z"
        },
        {
          "tag": "v0.1.2",
          "kind": "patch",
          "published_at": "2026-06-28T22:09:15Z"
        },
        {
          "tag": "v0.1.1",
          "kind": "patch",
          "published_at": "2026-06-28T18:21:45Z"
        },
        {
          "tag": "v0.1.0",
          "kind": "minor",
          "published_at": "2026-06-27T22:32:34Z"
        },
        {
          "tag": "v0.1.0-alpha.2",
          "kind": "prerelease",
          "published_at": "2026-06-25T17:31:46Z"
        },
        {
          "tag": "v0.1.0-alpha.1",
          "kind": "prerelease",
          "published_at": "2026-06-24T17:51:01Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "ed80faba3a212fb045a5a5af5d2a84551d713f9b",
          "body": "feat(db): Phase 2.3 — routine-body rules (DB-030/031/040/041) on de-truncated T-SQL bodies",
          "is_bot": false,
          "headline": "Merge pull request #64 from codefit-cli/integrate/routine-body-0.2.3",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-20T19:03:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6104d305ba16550340423de23677d8c2748cce5a",
          "body": "Record the routine-body slice (DB-030/031/040/041 over de-truncated T-SQL\nbodies, ADRs 0027-0028) in CHANGELOG [0.2.3] and VERSIONING (row + Current\nstate). Move the go1.25.12 toolchain Security note from [Unreleased] into\n[0.2.3] Security — the 0.2.3 binaries compile against the patched crypto/tls,\nso the fix ships with this release. Deferred stated: index-vs-query, OLAP;\nDB-012 permanent.",
          "is_bot": false,
          "headline": "docs: close 0.2.3 — CHANGELOG [0.2.3] + VERSIONING",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-20T19:00:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b14545a72b4b63acdf472910e76d43d20913218f",
          "body": "…(DB-030/031/040/041) + fixtures + coverage doctrine (ADR 0028)",
          "is_bot": false,
          "headline": "merge: 0.2.3 routine-body rules — de-truncation (ADR 0027) + 4 rules …",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-20T18:42:32Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b0eb30b1835483e1183e222ae43a1e5f32c3d09b",
          "body": "…+ fixture gap policy)\n\nRecords the two doctrine decisions from the 0.2.3 routine-body family: (1) a\nthird coverage state, detectable-without-dogfood, distinct from covered and\nnot-covered (motivating case DB-041 on MySQL); (2) the fixture gap policy —\nreal where it exists, constructed-and-declared-\n[…]\n, not-covered only for structural impossibility. Corollary of ADR 0004/0005.\nThe four rules (DB-030/031/040/041) carry no individual ADR — they apply the\nexisting ADR-0017/DB-020 surface-scanner mold.",
          "is_bot": false,
          "headline": "docs(adr): 0028 — coverage honesty (detectable-without-dogfood state …",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-20T18:42:12Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c0992827f30a6ba15246b874de271887205238be",
          "body": "…er-dialect markers\n\nDB-030 surfaces a procedure/function that builds and runs SQL from a string at\nruntime — T-SQL sp_executesql / EXEC(<expr>), PL/pgSQL EXECUTE '<string>' /\nformat() / quote_literal / quote_ident, MySQL PREPARE ... FROM. The trap: a\nstatic EXEC/CALL of a named internal procedure (\n[…]\non PostgreSQL (Pagila rewards_report) + real\nnegatives every dialect; MySQL and T-SQL positives constructed (declared\nsynthetic). Completes the routine-body rule family (DB-030/031/040/041) for\n0.2.3.",
          "is_bot": false,
          "headline": "feat(dbrules): DB-030 — flag dynamic SQL construction in a routine, p…",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-20T11:42:28Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ad5dfea2ef90f9f5fa2cdf8a72d7298a5061fb0b",
          "body": null,
          "is_bot": false,
          "headline": "test(dbrules): red — DB-030 dynamic SQL construction in a routine",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-20T11:36:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "864e88ed424446ede87da548a78f7b11478b4bc8",
          "body": "… vocab\n\nDB-041 surfaces a trigger whose body invokes a call reaching OUTSIDE the\ndatabase — T-SQL xp_cmdshell/sp_OA*/sp_send_dbmail/OPENROWSET/OPENQUERY, PG\ndblink/NOTIFY/pg_notify/COPY...PROGRAM, MySQL sys_exec/sys_eval. STRICT\nvocabulary: an EXECUTE/CALL of an internal stored proc is NOT external\n[…]\n real NEG/trap; PG constructed POS (NOTIFY\nvia resolution) + real NEG; MySQL detectable-without-dogfood (declared, distinct\nfrom not-covered). Constructed fixtures declared synthetic in their headers.",
          "is_bot": false,
          "headline": "feat(dbrules): DB-041 — flag trigger external-effecting calls, strict…",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-20T11:28:07Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b6ec732f99771cd923104f4ee0b44d22960ab1e7",
          "body": null,
          "is_bot": false,
          "headline": "test(dbrules): red — DB-041 trigger external-effecting call",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-20T11:19:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b622dd5637502e56815fd2f487e0f7d4110a5303",
          "body": "…t body source\n\nDB-040 surfaces a trigger whose body writes DML to a table other than the one\nit fires on. Body source is per-dialect (ADR 0026): MySQL/T-SQL inline bodies\nare scanned directly; a PostgreSQL trigger is bodyless, so the rule resolves\nSchema.ExecutedProcedure to the executed function a\n[…]\n Real POS+NEG dogfood on\nT-SQL and MySQL (MySQL NEG constructed) and PostgreSQL (PG POS constructed,\nexercising the ADR-0026 resolution path); constructed fixtures declared\nsynthetic in their headers.",
          "is_bot": false,
          "headline": "feat(dbrules): DB-040 — flag trigger cross-table cascades, per-dialec…",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-20T04:36:25Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a4e63ddd3acd7cc3022e1c27379071898156f539",
          "body": null,
          "is_bot": false,
          "headline": "test(dbrules): red — DB-040 trigger cross-table cascade",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-20T04:28:48Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "435e6a915c52b2f85e3ba1ffeb96f1b16e6c8ee2",
          "body": "…-dialect vocab\n\nDB-031 surfaces a stored procedure/function whose complete body contains no\nexception-handling construct, matched per dialect as an adjacent keyword pair:\nT-SQL BEGIN TRY, MySQL HANDLER FOR, PL/pgSQL EXCEPTION WHEN. PostgreSQL RAISE\nEXCEPTION is a throw, not a handler — the scanner \n[…]\nrerequisite. Bounded string/comment-aware\nscanner (DB-020 discipline), not a SQL-expression parser. Real POS+NEG dogfood\non MySQL and T-SQL; PostgreSQL real POS + constructed (declared synthetic) NEG.",
          "is_bot": false,
          "headline": "feat(dbrules): DB-031 — flag routines without exception handling, per…",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-20T01:12:10Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "cf7f80e5c81c6ec29b311e259283ec351b771bf6",
          "body": null,
          "is_bot": false,
          "headline": "test(dbrules): red — DB-031 procedure without exception handling",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-20T00:42:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "eebfac14ba6f980914529110b3ff96726ecd920e",
          "body": "…T-SQL objects\n\nThe AdventureWorks fixture header said 'unaltered other than CRLF->LF' but the\nupstream file also carries a UTF-8 BOM that was stripped; a header that\nunder-declares its alterations is imprecise. List the BOM strip, and add the two\nobjects (uspUpdateEmployeePersonalInfo, dEmployee) the object list had omitted.",
          "is_bot": false,
          "headline": "test(sqlddl): header honesty — declare BOM strip + list all vendored …",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-20T00:32:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e8aa9e902e4aadf974f76ca152afd9dc34597532",
          "body": "…xture\n\nVendor the VERBATIM upstream Pagila rewards_report PL/pgSQL function\n(pagila-schema.sql, commit 5ba5a57, MIT) into a new\npagila_real_objects.sql. It builds a query string and runs it via\nEXECUTE tmpSQL (plus FOR rr IN EXECUTE '...') — the real DB-030\ndynamic-SQL positive that neither the MyS\n[…]\nle\n(Complete=true).\n\nKept in its own *_real_objects.sql file (not appended to\npagila_excerpt.sql) to keep that fixture's pinned golden and the many\nline-number-pinning trigger/index tests byte-stable.",
          "is_bot": false,
          "headline": "test(sqlddl): vendor Pagila dynamic-SQL function — DB-030 positive fi…",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-19T18:34:45Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b3ae708b199a4d165f185744b3e0e2710146e28a",
          "body": "Vendor VERBATIM upstream Sakila routines (official Oracle distribution\nsakila-schema.sql v1.5, New BSD) into sakila_real_objects.sql: the three\nfilm triggers ins_film/upd_film/del_film (each writes the separate\nfilm_text table — a DB-040 cascade positive, no external call — DB-041\nnegative), the rew\n[…]\nete=true).\n\nNote: neither the Oracle nor the jOOQ Sakila rewards_report uses dynamic\nSQL — the classic PREPARE/EXECUTE variant does not exist in current\nupstream, so MySQL has no real DB-030 positive.",
          "is_bot": false,
          "headline": "test(sqlddl): vendor real Sakila routines — DB-030/031/040 fixtures",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-19T18:34:36Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "29f5734d4140ae1a64a7c140ad7c3b36075d7d5a",
          "body": "…040/041 fixtures\n\nVendor two more VERBATIM upstream AdventureWorks objects (instawdb.sql,\ncommit 1ab31bc, MIT) into adventureworks_real_objects.sql: the\nuspUpdateEmployeePersonalInfo procedure (TRY/CATCH, no dynamic SQL — a\nDB-030 and DB-031 negative) and the dEmployee INSTEAD OF DELETE trigger\n(RA\n[…]\nixture now holds 2 procedures and 2 triggers, so the hypothesis\ntests select by name (findProc/findTrigger) instead of positional [0]\nindexing, and add full-capture assertions for the two new objects.",
          "is_bot": false,
          "headline": "test(sqlddl): vendor AdventureWorks clean-negative routines — DB-031/…",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-19T18:34:28Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6cd102268951d28757634cdc1eddcf9b3a55e1a2",
          "body": "…027)\n\nThe de-truncation (ADR 0027) made the coverage prose false: T-SQL routine\nbodies are no longer truncated at the first internal ';' — they are captured\ncomplete to the GO batch separator (or EOF). Correct two claims without\nover-stating coverage:\n- The 'captured truncated' text now reflects th\n[…]\n3' — the parser blocker is lifted.\nAlso retire the now-closed phantom-table known-limit (ADR 0022 (a)) and\ndeclare ADR 0027's trailing-GO trade in its place. No coverage of procs/\ntriggers is claimed.",
          "is_bot": false,
          "headline": "docs(coverage): sync T-SQL routine-body prose to de-truncation (ADR 0…",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-19T17:44:32Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7c4c4d5a72ae0462460143c72eafff476a063d86",
          "body": "…ADR 0027)",
          "is_bot": false,
          "headline": "feat(sqlddl): de-truncate T-SQL routine bodies at GO batch boundary (…",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-19T17:35:03Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f5444756a4c5e54cf5d38407ef2bae4ce9f580fc",
          "body": "…cate at ;",
          "is_bot": false,
          "headline": "test(sqlddl): red — T-SQL routine bodies must capture to GO, not trun…",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-19T17:31:11Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5583f084e3f85f623bb1f09153cb2e9672a732ba",
          "body": "…hain-bump\n\ndocs(changelog): note go1.25.12 toolchain bump (GO-2026-5856)",
          "is_bot": false,
          "headline": "Merge pull request #62 from codefit-cli/docs/changelog-security-toolc…",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-19T14:49:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e7ec85af65d53c92afbcc69dd533f6a23048b2de",
          "body": "…6-5856)",
          "is_bot": false,
          "headline": "docs(changelog): note go1.25.12 toolchain bump under Security (GO-202…",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-19T14:46:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "33c05ca7e117250faf95ea74a17c0b09d3f5218f",
          "body": "fix(security): bump Go toolchain to 1.25.12 — close GO-2026-5856 (crypto/tls)",
          "is_bot": false,
          "headline": "merge: bump Go toolchain to 1.25.12 — close GO-2026-5856 (#61)",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-19T05:31:32Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b89fb6b4bc1b64b68b44db38e5c9b497ca8383f7",
          "body": "…pto/tls)\n\nGO-2026-5856 (Encrypted Client Hello privacy leak in crypto/tls) is a Go\nstandard-library vulnerability the scheduled security scan flagged, reached via\nosv.go's HTTP client and cache.go's io.Copy. It is fixed in crypto/tls@go1.25.12.\nBump the toolchain in go.mod and all four workflow go-\n[…]\n5.12 (latest 1.25 patch; no minor jump). govulncheck ./... now exits clean.\n\n- go.mod toolchain: go1.25.11 -> go1.25.12\n- ci.yml (test & lint), security.yml, release.yml: go-version 1.25.11 -> 1.25.12",
          "is_bot": false,
          "headline": "fix(security): bump Go toolchain to 1.25.12 — close GO-2026-5856 (cry…",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-19T03:34:35Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "29b9a7b534dd00b1e64c71674366207110ef529f",
          "body": "feat(db): Phase 2.2 — DB debt Slice A (N+1/RF-04, DB-020 views, DB-011a/b index redundancy, neutral coverage source)",
          "is_bot": false,
          "headline": "Merge pull request #60 from codefit-cli/integrate/db-debt-0.2.2",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-17T21:47:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3849232904c37128c3a09d7c578863e665b5d670",
          "body": "Record the four Slice A architecture decisions (N+1 as endpoint surface,\nDB-012 permanently not covered, tokenizer-derived body Complete flag,\nPG trigger->function link as dialect datum) and update CHANGELOG [0.2.2]\nand VERSIONING (row + Current state) to the real delivered scope.",
          "is_bot": false,
          "headline": "docs: close 0.2.2 — ADRs 0023-0026 + CHANGELOG + VERSIONING",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-17T21:35:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "103278d0417afc2cb9f23a6233a588f03a524809",
          "body": null,
          "is_bot": false,
          "headline": "merge: Track 1 + DB-020 + DB-011a/b + coverage into 0.2.2 integration",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-16T22:31:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b6b79b135c4272b7e6a4cef72dbface6e88f86cf",
          "body": null,
          "is_bot": false,
          "headline": "merge: F2 N+1 detector into 0.2.2 integration",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-16T22:31:11Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a524fcaede7640e241fb2c4f80315b4398683992",
          "body": null,
          "is_bot": false,
          "headline": "merge: F1 N+1 core plumbing into 0.2.2 integration",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-16T22:31:05Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "bd2654ec1954d2dbbf7f670f07e8b6b6f4ec8c2a",
          "body": "…nt-parsing\n\nfix(sqlddl): parse ALTER TABLE ONLY — DB-050/DB-001 gave false results on pg_dump PostgreSQL schemas",
          "is_bot": false,
          "headline": "Merge pull request #59 from codefit-cli/fix/alter-table-only-constrai…",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-16T21:22:30Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "db6e87f65d542dd828863b1f852d652cc3b75f6e",
          "body": "One-token fix, mirroring the existing optional \"IF EXISTS\" match:\nreAlterTable now matches an optional \"ONLY\" keyword between \"ALTER\nTABLE\" and the table name, so PostgreSQL/pg_dump's standard\n\"ALTER TABLE ONLY <table> ADD CONSTRAINT ...\" idiom resolves to the\nreal table instead of a phantom table l\n[…]\nt \"ONLY\"; DB-001 now\nevaluates rental's real FK and correctly surfaces it (uncovered by any\nindex in this minimal case) instead of silently dropping it. All\nthree inline hotfix tests now pass (GREEN).",
          "is_bot": false,
          "headline": "fix(sqlddl): reAlterTable matches optional ONLY after ALTER TABLE",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-16T20:43:08Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "946ff67bfcff0852f99a61428c1ad08562daa0a8",
          "body": "Self-contained inline-DDL regression proving reAlterTable mis-parses\nPostgreSQL/pg_dump's \"ALTER TABLE ONLY <table> ...\" idiom: the literal\n\"ONLY\" token is captured as the table name, so a phantom \"ONLY\" table\nis fabricated and the real PK/FK constraint is silently dropped from\ncustomer/rental.\n\nAt \n[…]\nFK\n\nDeliberately named/scoped (different file, different test function\nnames) to not collide with alter_table_only_integration_test.go on\nfeat/db-body-capture, so both coexist once that branch merges.",
          "is_bot": false,
          "headline": "test(sqlddl): red — inline ALTER TABLE ONLY regression (isolated hotfix)",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-16T20:43:06Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "bd2d7cad6de5f95a55b5a9e13339147882042655",
          "body": "Update internal/core/dbcoverage (DB-011a/b matrix, DB-020, DB-012\npermanent gap, routine-body rules deferred with the truncation risk\nstated) and the TS provider's own N+1 (DB-201) endpoint-surface entry,\nmirror both into COVERAGE.md, and correct CLAUDE.md's documental map\nnow that the DB coverage source lives in internal/core/dbcoverage\ninstead of embedded in the TypeScript provider.",
          "is_bot": false,
          "headline": "docs(coverage): correct DB coverage prose to real 0.2.2 scope",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-16T16:25:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c22e6652f032ecb35ee2d733cb90b411a2137e0f",
          "body": "…ider\n\ninternal/core/dbcoverage is a new pure-leaf package beside dbrules holding\nthe DB dimension's coverage prose verbatim (Deterministic/Reasoning/\nNotCovered). typescript.CoverageManifest now appends it at the end of each\nlist instead of duplicating it inline, closing the documented squat (CLAUDE.md\ndocumental map) without changing the manifest's serialized shape or any\nprose content — a pure location move, byte-identical output confirmed.",
          "is_bot": false,
          "headline": "refactor(coverage): relocate DB coverage prose out of typescript prov…",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-16T10:21:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "282928c8ea5cf1149fde823f31b7e5634976c923",
          "body": "One-token fix, mirroring the existing optional \"IF EXISTS\" match:\nreAlterTable now matches an optional \"ONLY\" keyword between \"ALTER\nTABLE\" and the table name, so PostgreSQL/pg_dump's standard\n\"ALTER TABLE ONLY <table> ADD CONSTRAINT ...\" idiom resolves to the\nreal table instead of a phantom table l\n[…]\n22_01's real FK and\ncorrectly finds it covered by the real vendored indexes on\ncustomer_id. All four alter_table_only_integration_test.go tests now\npass (GREEN). Golden schema regenerated via -update.",
          "is_bot": false,
          "headline": "fix(sqlddl): reAlterTable matches optional ONLY after ALTER TABLE",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-16T06:36:54Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4dd9b64e4d4713dfd80ecef5a2072480050c4911",
          "body": "Vendor two real upstream Pagila \"ALTER TABLE ONLY ...\" statements\n(verbatim, commit 5ba5a57: customer's PK, payment_p2022_01's FK to\ncustomer) — pg_dump's standard idiom for every PK/FK/UNIQUE\nconstraint. reAlterTable (reduce.go) special-cased \"IF EXISTS\" but not\n\"ONLY\" after ALTER TABLE, so the lit\n[…]\noPhantomOnlyTableFinding,\nTestDB001_AlterTableOnly_EvaluatesRealFK all fail. Golden schema test\nalso fails (fixture changed, not yet regenerated) — fixed next commit\nalongside the one-token regex fix.",
          "is_bot": false,
          "headline": "test(sqlddl): red — ALTER TABLE ONLY makes DB-050/DB-001 lie",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-16T06:36:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a38be7e4acaaaafbdaf0c73a8965001b9cff3811",
          "body": "film's real CREATE TABLE was previously vendored with its trailing\n\"fulltext tsvector\" column silently omitted to dodge a confirmed\ncross-dialect parser bug (discovery/sqlddl-postgres-parser-gaps,\nHALLAZGO 2: an unmapped-type column named fulltext/key/index/spatial\ncollides with the MySQL inline-ind\n[…]\n the table\nexists. DB-011a/DB-011b/Unit E coverage on PostgreSQL is unaffected:\ncustomer/address/rental/payment_p2022_01 keep their real indexes,\nincluding the real duplicate pair on payment_p2022_01.",
          "is_bot": false,
          "headline": "fix(sqlddl): remove non-verbatim film table from Pagila fixture",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-16T06:31:15Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "59a3d9a413bc2bf5c71dace331a69cab24dbfff4",
          "body": "… the AdventureWorks/Sakila bar\n\nThe prior header only pointed at \"see repo LICENSE.txt\". Verified directly\n(not assumed from Pagila's README, which loosely says \"PostgreSQL license\")\nthat github.com/devrimgunduz/pagila's actual LICENSE.txt is the MIT\nLicense — reproduce it inline, attributing Devri\n[…]\nd updated body_test.go's\nfive hardcoded Pos.Line assertions (34/16/26/41/43 -> 65/47/57/72/74) to\nmatch. The appended real-index content stays at end-of-file, unaffected\nbeyond the same uniform shift.",
          "is_bot": false,
          "headline": "docs(sqlddl): pagila_excerpt.sql — full MIT permission text, matching…",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-16T05:52:00Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "76804fe78b6440769a16a81fd9ed162cbe2573dc",
          "body": "… being NotCovered\n\nAppend real, verbatim upstream Pagila (github.com/devrimgunduz/pagila,\ncommit 5ba5a57, pagila-schema.sql) CREATE TABLE/CREATE INDEX statements to\npagila_excerpt.sql, at end-of-file so no existing line-pinned assertion\nshifts. MIT-licensed (Devrim Gündüz); attribution already carr\n[…]\ngolden.json via -update; the diff is\npurely additive (670 added lines, 0 removed/changed) — the 5 new tables'\ncolumns/indexes, nothing about actor or the existing views/procedures/\ntriggers perturbed.",
          "is_bot": false,
          "headline": "feat(sqlddl): vendor real Pagila indexes — PG index-rule family stops…",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-16T05:49:33Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "0848bfcde4bf45128669aa20633bbc35f5c8dac4",
          "body": "Extend the DB-011a/DB-011b/Unit E PostgreSQL dogfood tests to assert the\nfixture no longer ships index-free: db011prefix_integration_test.go's\nNotCovered test is replaced by a real-fixture negative case (mirroring\nSakila/AdventureWorks), a new db011_integration_test.go asserts a real\nexact-duplicate\n[…]\n positive fire on the payment_p2022_01 partition-child\ntable, and pagila_test.go's table assertion is widened past the single\nactor table. Fails until pagila_excerpt.sql is extended with real indexes.",
          "is_bot": false,
          "headline": "test(sqlddl): red — PG index-rule tests expect real Pagila indexes",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-16T05:49:14Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1fa860930155698f8f9bfcde074b9bf1ea613ff6",
          "body": "db011.ID() now returns \"DB-011a\" (exact duplicate) and\ndb011prefix.ID() returns \"DB-011b\" (prefix-redundant), instead of both\ncollapsing to the bare \"DB-011\". Same sub-case letter-suffix\nconvention already used for DB-052b (rules_names.go:77). No category,\nlogic, or SurfaceItem message changes — bot\n[…]\nb-prefix-redundant-index) were\nalready distinct before this change. Rule.ID() is otherwise called\nonly from tests today (no production call site), so this rename has no\nother runtime effect this pass.",
          "is_bot": false,
          "headline": "feat(dbrules): DB-011a / DB-011b — suffix the shared DB-011 rule IDs",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-16T05:17:09Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a17dfb962ecbd361502ede25afd09e1aa5e5ea33",
          "body": "DB-011a (exact duplicate, db011) and DB-011b (prefix-redundant,\ndb011prefix) share one PRD number, DB-011 (docs/PRD-codefit-v1.4.md:371),\nbut must be individually addressable in findings/coverage — same\nsub-case convention as DB-052b (rules_names.go:77). Updates the two\nexisting All()-aggregate ID a\n[…]\nadds a direct test locking\nboth suffixed IDs plus the absence of the bare \"DB-011\" string. Fails\nagainst the current bare-\"DB-011\" ID() implementations (both rules\nstill collapse to the same map key).",
          "is_bot": false,
          "headline": "test(dbrules): red — DB-011 sub-cases must carry letter suffixes",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-16T05:17:02Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "59e1660cdba4e254dabde4df3a18cf413738edbd",
          "body": "db011's doc comment and its regression test said prefix-redundancy was\n\"deferred to slice 2b\" / would never fire — no longer true now that\ndb011prefix (Unit E) implements it under its own category. Point readers\nat db011prefix.go instead of leaving a false \"not implemented\" claim in\nthe same package that just implemented it (CLAUDE.md doc-sync rule).",
          "is_bot": false,
          "headline": "docs(dbrules): correct stale \"prefix-redundancy deferred\" comments",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-16T03:17:20Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4591679a8759bdfb714d025e882cdbb999bd4fd6",
          "body": "An index [a] whose columns are a strict leading prefix of another\nindex-like column list [a,b] on the same table (a composite index, or the\nprimary key treated as an implicit index, consistent with DB-001) is\nprefix-redundant: the composite already serves any lookup [a] alone would.\n\nImplemented as \n[…]\ne human's call.\n\nCloses the gap declared at typescript/coverage.go:34. Wired into\ndbrules.All() and the DB sensor's OwnedCategories() (ADR 0019), so it\nrides the existing scan-all DB section for free.",
          "is_bot": false,
          "headline": "feat(dbrules): DB-011 prefix-redundant index rule (Unit E)",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-16T03:17:12Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e0c5e9d6b6a9cdbae0221e12adcb7031c08ffe2c",
          "body": "Tests for the prefix-redundant half of DB-011 (an index [a] subsumed by a\ncomposite [a,b]) reference surface.CategoryDBPrefixRedundantIndex, which\ndoes not exist yet — genuine RED, build fails across dbrules, sensors/db,\nand sqlddl (the real-fixture dogfood: Sakila/MySQL and AdventureWorks/T-SQL\nrun clean, Pagila/PostgreSQL has no indexes at all and is locked as such).",
          "is_bot": false,
          "headline": "test(dbrules): red — DB-011 prefix-redundant-index tests (Unit E)",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-16T03:16:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "45020f13259fdc10c33feaa39b96e271f3a31283",
          "body": "…lect dogfood\n\nVendors internal/providers/sqlddl/testdata/mysql/sakila_real_objects.sql: the\nreal, VERBATIM `customer_list` VIEW from Oracle/MySQL's own canonical Sakila\ndistribution (downloads.mysql.com/docs/sakila-db.tar.gz, \"Sakila Sample\nDatabase Schema, Version 1.5\"), New BSD licensed per\ndev.m\n[…]\n (dbrules-level) rule — hypothesis-confirmation\nagainst real DDL, not feature development, honestly reported as such (same\nprecedent as Unit B/B2's T-SQL hypothesis-confirmation tests on this\nbranch).",
          "is_bot": false,
          "headline": "test(sqlddl): vendor real Sakila customer_list view + DB-020 real-dia…",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-16T02:15:28Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2f99ba8b70053fd37a23a3c67bb4c81c237a4361",
          "body": null,
          "is_bot": false,
          "headline": "fix(sensors/db): wire DB-020's category into OwnedCategories (ADR 0019)",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-16T02:15:05Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b0f5fa09362cdc1fc68ce11b8e774997a3a0d0b3",
          "body": "…gory\n\nGenuine RED (verbatim, captured before internal/sensors/db/db.go's fix):\n\n    db_test.go:181: OwnedCategories() missing \"db-view-sensitive-column\"\n      (have [db db-fk-no-index db-duplicate-index db-multivalued-column\n      db-fk-text-type db-no-timestamps db-sensitive-unencrypted\n      db-r\n[…]\n every other DB category, or its items can never be baselined or\npruned — forgetting this is \"the only way to corrupt an existing baseline\"\n(design §15, sdd/db-debt-views-and-nplus1/design obs #1048).",
          "is_bot": false,
          "headline": "test(sensors/db): red — OwnedCategories missing DB-020's surface cate…",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-16T02:14:58Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "fa48cc0db2d3c622413027d715991537825c4415",
          "body": "Implements DB-020 (view sensitive-column exposure, Phase 2.2, re-scoped\nUnit C — architecture/db-phase-2-2-scope obs #1042): a VIEW whose top-level\nSELECT column list exposes a column/alias matching a sensitive token\n(reuses matchSensitiveToken/names.go verbatim, the same vocabulary DB-053\nalready u\n[…]\nation\ncannot silently turn a partial capture into a false affirmation.\n\nWired into dbrules.All() — flows through the DB sensor and scan-all's\nalready-wired DB section for free (schema-only, ADR 0016).",
          "is_bot": false,
          "headline": "feat(dbrules): DB-020 view sensitive-column exposure rule",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-16T02:14:50Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c48c1a76bf74ac76eac49691a083e7bd51d79786",
          "body": "…t exist yet\n\nAdds the black-box behavior tests (db020_test.go) and the white-box\nextractor tests (db020_extractor_test.go) for DB-020 (view sensitive-column\nexposure, Phase 2.2, architecture/db-phase-2-2-scope obs #1042), plus the\nnew surface.CategoryDBViewSensitiveColumn category the tests referen\n[…]\n now added, db020_test.go compiles but db020_extractor_test.go\nstill fails: it calls splitProjectionItems/findTopLevelKeyword/extractSelectColumns,\nwhich do not exist until the next commit's db020.go.",
          "is_bot": false,
          "headline": "test(dbrules): red — DB-020 view sensitive-column tests, rule does no…",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-16T02:14:29Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "10aa5d2534bae3dda7f2db0afb379f63bf3716fd",
          "body": "reTrigger's trigger-NAME capture group was missing '.' from its character\nclass, unlike reView/reRoutine's name group and reTrigger's own TABLE-name\ngroup. A schema-qualified T-SQL trigger name (e.g. Purchasing.uPurchaseOrderDetail)\ncame back as just the schema (Purchasing), not the trigger's own na\n[…]\nqualifier from the full captured\nmatch, matching the existing convention every other name/table field in\nthis package already follows.\n\nDiscovered in Unit B2 (discovery/sqlddl-trigger-name-regex-bug).",
          "is_bot": false,
          "headline": "fix(sqlddl): reTrigger schema-qualified trigger name regex bug (Unit B3)",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-15T01:10:28Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e4da17c9040163023df6d616a23cf142eb3f5cf8",
          "body": "Unit B2 (db-debt-views-and-nplus1, architecture/tsql-golden-real-ddl,\nobs #1054): vendor a verbatim excerpt of upstream AdventureWorks DDL\n(HumanResources.vEmployee view, uspGetBillOfMaterials procedure,\nPurchasing.uPurchaseOrderDetail trigger) copied byte-for-byte from\nmicrosoft/sql-server-samples \n[…]\n style of\" fixtures Unit B\nused. All three confirmed behaviors hold unchanged against real DDL:\nview Complete=true, procedure/trigger Complete=false with Body.Text\ntruncated at the first internal ';'.",
          "is_bot": false,
          "headline": "test(sqlddl): re-point T-SQL hypothesis tests at real AdventureWorks DDL",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-15T00:23:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8345f03248482dc4814c91594fe634d397f8f241",
          "body": "Unit B (db-debt-views-and-nplus1): confirms, against realistic\nAdventureWorks-style T-SQL fixtures (not synthetic one-liners), the\nopen item from architecture/tsql-body-truncation-limit — that CREATE\nVIEW bodies are unaffected by the truncation limit while multi-\nstatement CREATE PROCEDURE/TRIGGER b\n[…]\nwas broken to fix): these are hypothesis-\nconfirmation tests, not feature-development tests, honestly reported\nas such rather than staged as a fake red/green cycle.\n\nHypothesis CONFIRMED, not assumed.",
          "is_bot": false,
          "headline": "test(sqlddl): confirm T-SQL view/proc/trigger body-truncation hypothesis",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-14T20:43:49Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "354fa7f763bdcc0aeec8aaefeb58fdc7bad6a91b",
          "body": "…t A2)\n\nAdd Dialect.TriggerHasInlineBody, a per-dialect DATUM (PostgreSQL: false,\nMySQL/T-SQL: true) consulted by a new builder.triggerBody instead of\nbranching on dialect.Name — the same one-shared-reducer/per-dialect-data\narchitecture ADR 0022 established. A PostgreSQL trigger has no body of its\no\n[…]\n: both real triggers (last_updated on actor,\nfilm_fulltext_trigger on film) flip Complete false->true and gain\nExecutesFunction; diff reviewed as touching only those two Body/\nExecutesFunction values.",
          "is_bot": false,
          "headline": "fix(sqlddl): PG trigger false-incomplete + trigger→function link (Uni…",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-14T17:10:28Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c90b774c784c1f67a0fee0a25cbdf6b9b36a0236",
          "body": "…nk, fields don't exist yet\n\nRED for Unit A2 (architecture/pg-trigger-body-link): db.Trigger has no\nExecutesFunction field and db.Schema has no ExecutedProcedure method yet, so\nevery assertion using them fails to compile. Covers both Condition 1 (a\nPostgreSQL trigger with no inline body must be Comp\n[…]\n2\n(the trigger→function link, proven against the real Pagila fixture: a\nresolved and an honestly-unresolved case). Also locks that MySQL/T-SQL\ntriggers keep their existing Complete behavior unchanged.",
          "is_bot": false,
          "headline": "test(sqlddl): red — PG trigger false-incomplete + trigger→function li…",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-14T17:10:07Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "091b44157cc4c5c79bb83218459b41847176354e",
          "body": "… fixtures\n\nPasses on first write (honest, not RED-able): the previous commit's Body\nderivation never touches Name/Pos/Table extraction, so this invariant already\nheld. Locked explicitly, independent of golden_test.go's byte-for-byte JSON\ncompare, per tasks item 6.",
          "is_bot": false,
          "headline": "test(sqlddl): lock — Name/Pos/Table unchanged by Body on real dogfood…",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-14T16:50:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e4e49e67d8a7d3c5c674da2484caec471f34a210",
          "body": "…trigger parsing\n\nPasses on first write (honest, not RED-able): the Prisma provider never\npopulates Views/Procedures/Triggers, so adding db.Body in the previous commit\nhas nothing to affect on this path. Locked as a regression per spec RF-03.6.",
          "is_bot": false,
          "headline": "test(typescript): lock — Body field does not change Prisma view/proc/…",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-14T16:49:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "01027ff0d763b7ca0bb715a707c9c99d5a3c1df4",
          "body": "Add db.Body{Text,Complete,Note} on View/Procedure/Trigger (core/db stays a\npure leaf, no new import). split() now exposes the two tokenizer facts\nreduce.go needs to derive completeness: the terminator kind that flushed a\nstatement (semicolon|customDelimiter|goBreak|eof) and whether a dollar-quoted\nb\n[…]\ny removed from this package.\n\nRegenerate the Pagila golden (the only fixture with real view/proc/trigger\ndata); Sakila/AdventureWorks goldens are byte-identical, confirming the field\nis additive only.",
          "is_bot": false,
          "headline": "feat(db): capture routine/view Body + per-dialect completeness signal",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-14T16:49:22Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7f83d7a4fae887ef74dad5f0fa899c3aec922b3b",
          "body": "… not exist yet",
          "is_bot": false,
          "headline": "test(sqlddl): red — per-dialect db.Body completeness tests, Body does…",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-14T16:49:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a5bf27d5f1a58f2e781ad75c9ed8759d33baa10f",
          "body": "…n DB section\n\nItems 15/16/18: all three pass on first write with no additional\nproduction code. Confirms the design's explicit prediction that N+1\nrides the existing idor/authz/overfetch wiring for free once registered\nin surfaceQueries() (item 13), and that scan-all's DB section is\nstructurally is\n[…]\nDBSection\nis a pure function of the parsed schema via dbsensor.Audit, never merged\nwith secRes.Surface). Same honest 'pure lock, nothing to fix' class as\nUnit F1 item 8 — documented, not papered over.",
          "is_bot": false,
          "headline": "test(mcp): lock — N+1 flows to scan-all/scan-endpoint, never echoes i…",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-14T16:36:41Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "830cb8390fae55b1bbebe5e119846a9fc3dc30b3",
          "body": "Registers ToolSurfaceNPlus1 + HandleSurfaceNPlus1, mirroring\ncodefit-surface-overfetch's discipline: order by structural certainty,\nnever filter (ADR 0005). Rank: local+sequential-await first, local+\nPromise.all-wrapped (concurrent) next, the cross-function frontier last\n— honest, never dropped.",
          "is_bot": false,
          "headline": "feat(mcp): codefit-surface-nplus1 tool + nplus1CertaintyRank ordering",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-14T16:30:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9bc514be312fa3a20a654b93b9c69d04ae5f0cff",
          "body": null,
          "is_bot": false,
          "headline": "test(mcp): red — codefit-surface-nplus1 does not exist yet",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-14T16:29:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8aa498bddb0cb0e6dec57a586c40b530fdeb9fb9",
          "body": "Implements nplus1Query, reusing auditTargets/walkTS/isPrismaCall/\nisServiceCall/calleeName verbatim from idor.go/overfetch.go. Loop node set:\nfor/for_in(of|in)/while/do plus callback iteration over\nforEach|map|flatMap|filter|reduce|some|every|find. Registered 4th in\nProvider.surfaceQueries(), so it \n[…]\ntPrismaAccesses/collectAppCalls already walk the whole handler body\nvia walkTS, including inside loops, so the same call that produces the N+1\nitem independently makes the handler sensitive for authz.",
          "is_bot": false,
          "headline": "feat(typescript): N+1 (DB-201) query-in-loop surface detector",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-14T16:28:52Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "771c2d59822665f19b1fffcfe2d73aea64ec179f",
          "body": "…xist yet",
          "is_bot": false,
          "headline": "test(typescript): red — nplus1 detector tests, nplus1Query does not e…",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-14T16:27:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "115f7b53566c2384390613c302667080a2441c93",
          "body": "Contract test (not a convention): internal/core/db and\ninternal/core/dbrules must never import internal/providers/typescript,\nand dbrules.All() must never gain an N+1 entry. N+1 detection is\ncode-derived and stays entirely in the TS provider (Unit F2).\n\nThis test passes on the first run — the invariant already holds and no\nproduction code change was needed to satisfy it; it exists to catch a\nfuture regression, not to fix a current one.",
          "is_bot": false,
          "headline": "test(dbrules): lock — core/db and dbrules never import the TS provider",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-14T13:10:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c56adcaef3af7e529ace2f0e989baa00d363e5e1",
          "body": "Locks that the unified baseline (ADR 0019) can track/prune N+1 items.",
          "is_bot": false,
          "headline": "feat(security): OwnedCategories += CategoryNPlus1",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-14T13:09:34Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7ab157cd2e9f7130fc435e9501bc6d7903585c98",
          "body": "The unified baseline (ADR 0019) cannot track/prune N+1 items until the\nsecurity sensor declares surface.CategoryNPlus1 in its owned scope.\nObserved failing before the category was added (F1 item 7).",
          "is_bot": false,
          "headline": "test(security): red — OwnedCategories missing CategoryNPlus1",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-14T13:09:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c56b617cdeb90201a0ea74fcc3df85d460348725",
          "body": "Add surface.CategoryNPlus1 (\"nplus1\") with titles/defaultSeverity\nentries. findingFrom now consults dimensionFor(category) instead of\nhard-coding DimensionSecurity; only \"nplus1\" overrides to DimensionDB,\nevery existing category keeps its unchanged security default.",
          "is_bot": false,
          "headline": "feat(surface): CategoryNPlus1 + dimensionFor(category)",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-14T13:08:29Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b158c061b6b5a307da32ff509da32ece2fee755a",
          "body": "An agent-confirmed surface item with category=nplus1 is stamped\nDimensionSecurity today because findingFrom hard-codes it. Observed\nfailing before dimensionFor(category) exists (F1 item 4).",
          "is_bot": false,
          "headline": "test(surface): red — findingFrom hard-codes DimensionSecurity for nplus1",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-14T13:07:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "64265afc8bb580bd2a878b567ab738097ec5a628",
          "body": "surfaceGap now recognizes category=nplus1 and returns the actionable\ngapEfficiency kind, fixing the false ResolvedClean affirmation. Ranked\nLAST in gapCounts/the endpoint sort (after exposure) so an N+1 never\noutranks an access-control gap, mirroring ADR 0006's exposure-vs-access\nrationale.",
          "is_bot": false,
          "headline": "feat(report): gapEfficiency — fourth gap kind for N+1 surface",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-14T13:07:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b63f3955efebc3d3db282f663afce876b1792ebf",
          "body": "An endpoint whose only surface item is category=nplus1 currently falls\ninto ResolvedClean because surfaceGap only recognizes idor/authz/\noverfetch, and verificationFact prints a false 'no gap found'\naffirmation over a real N+1. Observed failing before any production\ncode change (F1 item 1).",
          "is_bot": false,
          "headline": "test(report): red — N+1-only endpoint must never resolve clean",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-14T13:04:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3e86632ba13892f22f68279b528c989fec677ba3",
          "body": null,
          "is_bot": false,
          "headline": "docs(versioning): 0.2.1 — Phase 2.1 (multi-dialect SQL: MySQL, T-SQL)",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-08T21:31:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b6368257104cbf4fff1e33448ae654c66436ef34",
          "body": null,
          "is_bot": false,
          "headline": "docs(changelog): 0.2.1 — Phase 2.1 multi-dialect SQL (MySQL, T-SQL)",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-08T21:20:30Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "fc30666c3127421d52edc000645072928d4318b0",
          "body": "Ignora el dir local de memoria de Engram. La memoria NO se versiona en git;\nse porta fuera del repo (engram export a un JSON aparte).",
          "is_bot": false,
          "headline": "chore: gitignore .engram/",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-08T20:38:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "63afe3fa424b7ed067c90c5539262116645116af",
          "body": "feat(sqlddl): Fase 2.1 — parser SQL-DDL agnóstico de dialecto (MySQL + T-SQL)",
          "is_bot": false,
          "headline": "Merge pull request #58 from codefit-cli/feat/support-sql-dialects",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-08T19:43:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d2bcea93b14fc05577cbcafaff291402487f3084",
          "body": "docs(sqlddl): dialect coverage docs + ADR 0022",
          "is_bot": false,
          "headline": "Merge pull request #56 from codefit-cli/feat/sql-dialects-k-docs",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-08T18:07:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f13e9e12f807122d089def0f956d86078b477e48",
          "body": "fix(sqlddl): document dialect limits; remove unsound routine-body guard",
          "is_bot": false,
          "headline": "Merge pull request #55 from codefit-cli/feat/sql-dialects-i-limits",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-08T14:00:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0adfaa44fe415f7520456b5e5b4ea24f259d0074",
          "body": "feat(mcp): wire database.type to the SQL dialect (config + adapter)",
          "is_bot": false,
          "headline": "Merge pull request #54 from codefit-cli/feat/sql-dialects-h-wiring",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-08T13:59:03Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9194ecd44233146ff8a12968835c602e93128bd0",
          "body": "feat(sqlddl): T-SQL type/modifier vocabulary + AdventureWorks golden",
          "is_bot": false,
          "headline": "Merge pull request #53 from codefit-cli/feat/sql-dialects-fg-tsql-types",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-08T13:58:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0bb84c0ccd7f6c850c42f616e689347c92656488",
          "body": "…nize\n\nfeat(sqlddl): T-SQL tokenizing — [bracket] identifiers",
          "is_bot": false,
          "headline": "Merge pull request #52 from codefit-cli/feat/sql-dialects-e-tsql-toke…",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-08T13:57:47Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "77212cccdf5ec0a6617acf572db76091c772c291",
          "body": "feat(sqlddl): MySQL type/modifier vocabulary + Sakila golden",
          "is_bot": false,
          "headline": "Merge pull request #51 from codefit-cli/feat/sql-dialects-cd-mysql-types",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-08T13:57:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "266e702050608e9b94a7f57ca2094008c6bdff46",
          "body": "…enize\n\nfeat(sqlddl): MySQL tokenizing — backtick idents, #/-- comments (reemplaza #50)",
          "is_bot": false,
          "headline": "Merge pull request #57 from codefit-cli/feat/sql-dialects-b-mysql-tok…",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-08T13:29:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c0f9f6b237f8d1af611ffda5156af6ff7a69dd56",
          "body": "refactor(sqlddl): introduce per-dialect Dialect descriptor (scaffold, PG byte-identical)",
          "is_bot": false,
          "headline": "Merge pull request #49 from codefit-cli/feat/sql-dialects-a-scaffold",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-08T05:25:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d2f132e405902b2c7d6ee413829bcc22e00f6e17",
          "body": "DB-rule fuente-raíz is internal/core/dbrules/ (the 8 rules live there),\nnot internal/core/db/ (that is only the neutral model). Declare the\ncross-cutting-dimension exception: the DB dimension has no per-language\ncoverage.go; its coverage prose lives embedded (today in the typescript\nprovider manifest) as declared debt until a neutral DB-coverage source\nexists. The per-provider chain model does not cover a transversal dimension.",
          "is_bot": false,
          "headline": "docs: correct the documentation map in CLAUDE.md",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-07T20:03:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5304ef8c20f9cbdabfd965a27f160a5dd6ceb81f",
          "body": "…ine-body guard\n\nThe inRoutineBody/applyRoutineOrTriggerHead guard was removed in the Unit-I\nrework; the comment now describes the actual behavior — T-SQL GO-batched\nroutine bodies are a documented known limit (ADR 0022), not guarded.",
          "is_bot": false,
          "headline": "docs(sqlddl): fix stale split.go comment referencing the removed rout…",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-06T23:03:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ea2000930f139d0c6013eee5828bce6e96e0e92e",
          "body": "Record the architecture decision promoted from the change design: a\nper-dialect DATA descriptor consumed by one shared tokenizer and one\ndialect-free reducer (no per-dialect branches), quoting canonicalized to\nANSI at tokenization, dialect bound at construction with no ParseSchema\nsignature change, and the retreat-to-documented-limit call for the T-SQL\nroutine-body guard. Includes the four known limits and two assumptions.",
          "is_bot": false,
          "headline": "docs(adr): 0022 per-dialect DATA descriptor for SQL-DDL parsing",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-06T18:00:46Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a8bd3b9dd40fb5c6019053361fc2c10e624fffc3",
          "body": "…mits\n\nSync the DB coverage prose (source: the embedded manifest; mirror:\nCOVERAGE.md) to the three supported dialects (postgresql, mysql,\nsqlserver) with the honest TypeUnknown fallback, and disclose the four\nUnit-I known limits (T-SQL GO-batched routine-body spurious table;\nword-based DELIMITER no\n[…]\nSI_QUOTES-off\nand one-dialect-per-project assumptions. Fix sqlddl/doc.go's stale\n'PostgreSQL only' prose and COVERAGE.md's stale auto-generation header.\nREADME states the allowed database.type values.",
          "is_bot": false,
          "headline": "docs(sqlddl): document MySQL and T-SQL dialect coverage and Unit-I li…",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-06T18:00:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "021642e23f819f701515982c2567c8bac3bab9c2",
          "body": "DB-rule fuente-raíz is internal/core/dbrules/ (the 8 rules live there),\nnot internal/core/db/ (that is only the neutral model). Declare the\ncross-cutting-dimension exception: the DB dimension has no per-language\ncoverage.go; its coverage prose lives embedded (today in the typescript\nprovider manifest) as declared debt until a neutral DB-coverage source\nexists. The per-provider chain model does not cover a transversal dimension.",
          "is_bot": false,
          "headline": "docs: correct the documentation map in CLAUDE.md",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-06T18:00:46Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6451fec71a2d76591ca030ccf89a5633ce89973c",
          "body": "…CLAUDE.md",
          "is_bot": false,
          "headline": "docs: add documentation map (source→mirror chain) and methodology to …",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-06T17:06:33Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "523b05e1c0c1495721d7f9b67391838b8c947393",
          "body": "…CLAUDE.md",
          "is_bot": false,
          "headline": "docs: add documentation map (source→mirror chain) and methodology to …",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-06T17:05:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "64aa33627374451231ea783fb7a9c7c011c2fb06",
          "body": "Only punctuation-only DELIMITER arguments (//, $$) are recognized as a\nMySQL client directive, per C1's fix. A word-based custom delimiter\n(DELIMITER GO) is a narrow, accepted limit.",
          "is_bot": false,
          "headline": "docs(sqlddl): note word-based DELIMITER args are not recognized",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-06T16:24:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3dc419bf9ff9c75aa311f4ba6f0bc142a5b8618d",
          "body": "…ence\n\nhasParenColumnList/isAddKeyIndexForm used to route on the bare presence\nof a '(' anywhere in the item. That is wrong for a column legitimately\nnamed key/index/fulltext/spatial whose TYPE itself carries parens (key\nvarchar(255), index int(11), key numeric(10,2), key enum('a','b')): the\n'(' com\n[…]\ned) is a known type in the\ndialect's own TypeMap, it is a column of that type; otherwise it is the\ninline index FORM. Consults TypeMap data only, no dialect-name branch,\nso it stays dialect-free code.",
          "is_bot": false,
          "headline": "fix(sqlddl): discriminate inline KEY/INDEX by type, not by paren pres…",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-06T16:24:17Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "fb09dd6732a5f2592c9daf85793d38cdecbfcfcc",
          "body": "Adds RED-then-GREEN coverage for the type-map discriminator fix: key\nvarchar(255), index int(11), key numeric(10,2), key enum('a','b'),\nspatial varchar(255) as inline-CREATE-TABLE columns and via ALTER TABLE\nADD (with and without COLUMN), plus locks that the real inline\nKEY/INDEX index form still parses as an index, not a phantom column.",
          "is_bot": false,
          "headline": "test(sqlddl): lock key/index columns whose type carries parens",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-06T16:24:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2576e3ea5080dd67e7cbe187b4db1c9386744f5a",
          "body": "…lision\n\nRecords, in the package doc, the disclosed limit left by removing the\ninRoutineBody guard: a T-SQL GO-batched procedure/trigger body containing\na CREATE TABLE-shaped fragment may surface as a spurious top-level table.\nMySQL DELIMITER-protected bodies are unaffected. Also notes the narrow\ncollision between the GO batch-separator recognition and a column\nliterally named \"go\" standing alone on its own line.",
          "is_bot": false,
          "headline": "docs(sqlddl): document the T-SQL routine-body limit and GO-column col…",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-06T16:11:18Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c8733081362babad93eca959afcbde8c92db9483",
          "body": "The builder.inRoutineBody BEGIN/END guard (Unit I) was insound: it matched\nBEGIN/END as raw text (including inside string literals such as\n\"PRINT 'Reached END state'\"), was not depth-counted (a nested BEGIN...END\nclosed it early), and was never reset between files (a stuck-open guard\nfrom one file's\n[…]\ns-dialect hazards (no\ncross-file leak, nested BEGIN/END and END-in-string no longer crash),\nand updates the existing GO-batch test to assert the honest current\nbehavior instead of the removed guard's.",
          "is_bot": false,
          "headline": "fix(sqlddl): remove the fragile T-SQL inRoutineBody guard",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-06T16:11:12Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "dcd356f28bbcd48a81665803a77e4d7df54633c0",
          "body": "…nizer\n\nDELIMITER directive recognition now requires a punctuation-only argument\n(e.g. //, $$, ;) instead of any non-space token, so a line-start column\nnamed \"delimiter\" is no longer misread as a MySQL client directive (C1).\n\nKEY/INDEX/FULLTEXT/SPATIAL inline routing (both in CREATE TABLE column\nit\n[…]\nith a phantom index (C2),\nand ALTER TABLE ADD KEY/INDEX no longer creates a phantom column (MINOR).\n\nLocks a well-formed MySQL DELIMITER // ... DELIMITER ; block still parses\nboth sides correctly (M).",
          "is_bot": false,
          "headline": "fix(sqlddl): stop DELIMITER/KEY column names from corrupting the toke…",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-06T16:08:02Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d5b51a8a97778c5aeabc8e77269c03644228b421",
          "body": "Runs the 4 existing DB rules (DB-050, DB-001, DB-011, DB-002 —\ninternal/core/dbrules/rules.go) against the real MySQL Sakila and\nT-SQL AdventureWorks golden fixtures, parsed through this change's\nMySQL() and SQLServer() dialects, and asserts the hand-verified\nstructural result (0/0/0/0 for Sakila; 0\n[…]\n that zero core\nenrichment was needed: dbrules never imports sqlddl or knows a dialect\nexists, and reads only fields (PrimaryKey, ForeignKeys, Indexes,\nColumns[].List) that existed before this change.",
          "is_bot": false,
          "headline": "test(sqlddl): lock core-no-enrichment proof for MySQL/T-SQL (I8)",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-06T15:22:31Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "83d558d9a7ce053c02b92c68e1cb7a691ce7713a",
          "body": "Two independent reducer fixes (design §8, Unit I):\n\n1. Phantom-table guard, T-SQL half: a GO-batched proc/trigger body\n   (plain BEGIN...END, no dollar-quote or DELIMITER protection) still\n   has its internal ';'s cut into separate statements by split(). The\n   builder now opens inRoutineBody when a\n[…]\nit.\n\nUpdated the sakila_excerpt.sql fixture's trailing comment (now stale)\ndocumenting the KEY-shorthand limit as fixed — the golden JSON itself\nis untouched (git diff --stat confirms byte-identical).",
          "is_bot": false,
          "headline": "fix(sqlddl): guard T-SQL routine bodies; fix inline KEY/INDEX shorthand",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-06T15:22:21Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6d1548ce3a4cde56ab734c7022cd9e223300ed0b",
          "body": "MySQL's \"DELIMITER //\" ... \"DELIMITER ;\" convention and T-SQL/sqlcmd's\nstandalone \"GO\" batch separator are client-tool markers, not part of\nthe SQL:1992 grammar in any dialect split() supports. Without\nawareness of either, split()'s hardcoded ';' terminator would cut a\nproc/trigger body into fragmen\n[…]\n This alone fully closes the\nMySQL DELIMITER case: the whole body becomes ONE merged statement\nwhose head is still captured by reduce.go's anchored regex, and no\ninner fragment can be produced at all.",
          "is_bot": false,
          "headline": "fix(sqlddl): add DELIMITER/GO phantom-table guard to the tokenizer",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-06T15:21:51Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2a9e05ddd177fca65dda8e5ae2138016bcef249f",
          "body": "Adds limits_test.go covering the phantom-table guard (MySQL DELIMITER\nbodies, T-SQL GO batches), the inline KEY/INDEX secondary-index\nshorthand mis-parse, partitioning, computed/generated columns, T-SQL\nCREATE TYPE, and one-dialect-per-project. Phantom-table and inline\nKEY/INDEX tests fail (RED) at this commit; the rest already pass\nagainst today's existing honest fallbacks (dropped parens, TypeUnknown,\nanchored-regex skip) — confirmed and documented, not assumed.",
          "is_bot": false,
          "headline": "test(sqlddl): capture RED evidence for Unit I documented limits",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-06T15:21:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c8b46aef1a399397194add2c6b020d7c1dda90a7",
          "body": "…nput\n\nsqlDialectParser's default case returned the Postgres parser for ANY\nunrecognized dbType, not just \"\"/\"none\". Unreachable via config.validate\ntoday, but the function takes a bare string, so this was implicit coupling\nthat violated the \"never silently guess\" doctrine already honored by the\nsql\n[…]\nsniff stub unchanged); any other non-empty,\nunrecognized dbType now returns (nil, note-naming-the-type), mirroring the\nsqlite branch. No behavior change for mysql/sqlserver/postgresql/sqlite/\n\"\"/none.",
          "is_bot": false,
          "headline": "fix(mcp): make sqlDialectParser's default branch honest for garbage i…",
          "author_name": "LukaxPai",
          "author_login": "lucaspaez",
          "committed_at": "2026-07-06T14:31:21Z",
          "body_truncated": true,
          "is_coding_agent": false
        }
      ],
      "releases_count": 12,
      "commits_last_year": 265,
      "latest_release_at": "2026-07-20T19:06:42Z",
      "latest_release_tag": "v0.2.3",
      "releases_from_tags": false,
      "days_since_last_push": 1,
      "active_weeks_last_year": 5,
      "days_since_latest_release": 1,
      "mean_days_between_releases": 2.5
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": true,
      "health_percentage": 100,
      "has_issue_template": false,
      "has_code_of_conduct": true,
      "has_pull_request_template": true
    },
    "ecosystem": {
      "packages": [
        {
          "name": "github.com/codefit-cli/codefit",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": true,
          "registry_url": "https://pkg.go.dev/github.com/codefit-cli/codefit",
          "is_deprecated": false,
          "latest_version": "v0.2.3",
          "repository_url": "https://github.com/codefit-cli/codefit",
          "versions_count": 12,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-20T19:03:19Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 1
        }
      ]
    },
    "popularity": {
      "forks": 0,
      "stars": 0,
      "watchers": 0,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 0
      },
      "star_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_stars": 0
      },
      "open_issues_and_prs": 4
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [],
      "has_llms_txt": false,
      "has_dockerfile": false,
      "has_mcp_signal": true,
      "bootstrap_files": [
        "Makefile"
      ],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [
        "internal/scaffold/testdata/sample-next/tsconfig.json"
      ],
      "toolchain_manifests": [
        "go.mod"
      ],
      "largest_source_bytes": 92023,
      "source_files_sampled": 247,
      "oversized_source_files": 1,
      "agent_instruction_files": [
        "CLAUDE.md"
      ],
      "agent_instruction_max_bytes": 19988
    },
    "dependencies": {
      "manifests": [
        "go.mod"
      ],
      "advisories": {
        "error": null,
        "scope": null,
        "source": null,
        "findings": [],
        "collected": false,
        "malicious": [],
        "truncated": false,
        "by_severity": {},
        "advisory_count": 0,
        "affected_count": 0,
        "assessed_count": 0,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "go"
      ],
      "dependencies": [
        {
          "name": "github.com/bmatcuk/doublestar/v4",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v4.10.0"
        },
        {
          "name": "github.com/google/jsonschema-go",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.4.3"
        },
        {
          "name": "github.com/modelcontextprotocol/go-sdk",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.6.1"
        },
        {
          "name": "github.com/odvcencio/gotreesitter",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.20.2"
        },
        {
          "name": "github.com/spf13/cobra",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.10.2"
        },
        {
          "name": "gopkg.in/yaml.v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.0.1"
        }
      ],
      "all_dependencies": {
        "error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
        "source": null,
        "packages": [],
        "collected": false,
        "truncated": false,
        "total_count": null,
        "direct_count": null,
        "indirect_count": null
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 59,
        "open_issues": 4,
        "closed_ratio": 0,
        "closed_issues": 0,
        "closed_unmerged_prs": 1
      },
      "bus_factor": 1,
      "bot_contributors": 0,
      "top_contributors": [
        {
          "type": "User",
          "login": "lucaspaez",
          "commits": 265,
          "avatar_url": "https://avatars.githubusercontent.com/u/7564926?v=4"
        }
      ],
      "contributors_sampled": 1,
      "top_contributor_share": 1
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "ci.yml",
        "release.yml",
        "security.yml"
      ],
      "has_docs_dir": true,
      "linter_configs": [
        ".golangci.yml"
      ],
      "has_editorconfig": false,
      "has_linter_config": true,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "go.sum",
        "package-lock.json"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 10,
            "reason": "5 out of 5 merged PRs checked by a CI test -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/5 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 0,
            "reason": "project has 0 contributing companies or organizations -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 0,
            "reason": "no update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 0,
            "reason": "project was created within the last 90 days. Please review its contents carefully",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": 10,
            "reason": "packaging workflow detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 0,
            "reason": "dependency not pinned by hash detected -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "SAST tool is not run on all commits -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 4,
            "reason": "security policy file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": 0,
            "reason": "Project has not signed or included provenance with any releases.",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 0,
            "reason": "12 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "ed80faba3a212fb045a5a5af5d2a84551d713f9b",
        "ran_at": "2026-07-22T02:16:22Z",
        "aggregate_score": 2.8,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": true,
      "has_dependabot_config": false
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-20T19:06:46Z",
      "oldest_open_prs": [],
      "last_merged_pr_at": "2026-07-20T19:03:19Z",
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": [
        {
          "number": 1,
          "created_at": "2026-06-20T08:43:28Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 2,
          "created_at": "2026-06-20T08:43:30Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 31,
          "created_at": "2026-06-28T18:31:34Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 63,
          "created_at": "2026-07-19T14:46:51Z",
          "last_comment_at": null,
          "last_comment_author": null
        }
      ]
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/codefit-cli/codefit",
    "host": "github.com",
    "name": "codefit",
    "owner": "codefit-cli"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "moderate",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 54,
      "inputs": {
        "security": 28,
        "vitality": 71,
        "community": 43,
        "governance": 41,
        "engineering": 84
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "good",
        "name": "Vitality",
        "value": 71,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "moderate",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 58,
            "inputs": {
              "commits_last_year": 265,
              "human_commit_share": 1,
              "days_since_last_push": 1,
              "active_weeks_last_year": 5
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 1 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 1
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "5/52 weeks with commits",
                "points": 3.5,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 5
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "265 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 265
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": null,
            "notes": [],
            "value": 90,
            "inputs": {
              "releases_count": 12,
              "latest_release_tag": "v0.2.3",
              "releases_from_tags": false,
              "days_since_latest_release": 1,
              "mean_days_between_releases": 2.5
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "12 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 12
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 1 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 1
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~2.5 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 2.5
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "at_risk",
        "name": "Community & Adoption",
        "value": 43,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 1,
            "inputs": {
              "forks": 0,
              "stars": 0,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "0 stars",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "0 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "excellent",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 92,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": true,
              "has_issue_template": false,
              "has_code_of_conduct": true,
              "has_pull_request_template": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (Apache-2.0)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "Apache-2.0"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 18,
                "status": "met",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 13.5,
                "status": "met",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 6.3,
                "status": "met",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "at_risk",
        "name": "Sustainability & Governance",
        "value": 41,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 10,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 1,
              "top_contributor_share": 1
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 100% of commits",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 100
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "1 contributors",
                "points": 1.4,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 0 contributing companies or organizations -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "at_risk",
            "name": "Issue & PR responsiveness",
            "note": null,
            "notes": [],
            "value": 38,
            "inputs": {
              "merged_prs": 59,
              "open_issues": 4,
              "closed_issues": 0,
              "issue_closed_ratio": 0,
              "closed_unmerged_prs": 1
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "0% of issues closed",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "issues_closed_share",
                    "params": {
                      "share": 0
                    }
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "59/60 decided PRs merged",
                "points": 37.6,
                "status": "partial",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 59,
                      "decided": 60
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/5 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "at_risk",
            "name": "Ownership & stewardship",
            "note": null,
            "notes": [],
            "value": 35,
            "inputs": {
              "followers": 1,
              "owner_type": "Organization",
              "is_verified": null,
              "owner_login": "codefit-cli",
              "public_repos": 1,
              "account_age_days": 32
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "organization-owned",
                "points": 30,
                "status": "met",
                "details": [
                  {
                    "code": "owner_organization",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "1 followers of codefit-cli",
                "points": 2.2,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 1,
                      "login": "codefit-cli"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "1 public repos, account ~0 yr old",
                "points": 2.4,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 1
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 0
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "github.com/codefit-cli/codefit"
              ],
              "ecosystems": "go",
              "any_deprecated": false,
              "min_days_since_publish": 1
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on go",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "go"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 1 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 1
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "12 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 12
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "good",
        "name": "Engineering Quality",
        "value": 84,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "good",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 84,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": true,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "3 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 3
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": ".golangci.yml",
                "points": 16,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yml"
                    }
                  }
                ],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "5 out of 5 merged PRs checked by a CI test -- score normalized to 10",
                "points": 20,
                "status": "met",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "excellent",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "topics": [
                "ai",
                "cli",
                "code-quality",
                "code-review",
                "developer-tools",
                "go",
                "mcp",
                "open-source",
                "security",
                "static-analysis"
              ],
              "has_wiki": true,
              "homepage": null,
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": "10 topics",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "topics_count",
                    "params": {
                      "count": 10
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "critical",
        "name": "Security",
        "value": 28,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "critical",
            "name": "Security posture",
            "note": null,
            "notes": [],
            "value": 28,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 18,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 0,
              "scorecard_aggregate": 2.8
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "5 out of 5 merged PRs checked by a CI test -- score normalized to 10",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/5 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 0 contributing companies or organizations -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "no update tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool is not run on all commits -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file detected",
                "points": 2,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "12 existing vulnerabilities detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "good",
        "name": "AI Readiness",
        "value": 72,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "excellent",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 1,
              "agent_instruction_files": [
                "CLAUDE.md"
              ],
              "agent_instruction_max_bytes": 19988
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "CLAUDE.md",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "CLAUDE.md"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "100 of 100 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 100,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "good",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 72,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "go.sum",
                "package-lock.json"
              ],
              "has_dockerfile": false,
              "typed_language": true,
              "bootstrap_files": [
                "Makefile"
              ],
              "has_devcontainer": false,
              "has_linter_config": true,
              "typecheck_configs": [
                "internal/scaffold/testdata/sample-next/tsconfig.json"
              ],
              "agent_commit_share": 0,
              "toolchain_manifests": [
                "go.mod"
              ],
              "dependency_bot_commit_share": 0
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "Makefile",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Makefile"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": ".golangci.yml",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yml"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "internal/scaffold/testdata/sample-next/tsconfig.json",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "internal/scaffold/testdata/sample-next/tsconfig.json"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "no agent-authored commits among the last 100",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_authored_commits",
                    "params": {
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "no automated dependency updates observed",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_dependency_automation",
                    "params": {}
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "Go",
              "largest_source_bytes": 92023,
              "source_files_sampled": 247,
              "oversized_source_files": 1
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Go (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "1/247 source files over 60KB",
                "points": 54.8,
                "status": "partial",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 247,
                      "oversized": 1
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "critical",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 20,
            "inputs": {
              "example_dirs": [],
              "has_mcp_signal": true,
              "api_schema_files": []
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 20,
                "status": "met",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-22T02:16:37.898578Z",
  "schema_version": "0.26.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/c/codefit-cli/codefit.svg",
  "full_name": "codefit-cli/codefit",
  "license_state": "standard",
  "license_spdx": "Apache-2.0"
}