revelara-ai / rvl-cli

Conjunto completo de dependencias resueltas según el grafo de dependencias de GitHub: 6 paquetes directos y 34 indirectos (transitivos). El cierre transitivo es completo cuando el repositorio incluye un lockfile.

Este repositorio no publica ningún paquete que el índice resuelva, así que se evaluó su propio grafo de dependencias — 40 paquetes, que incluyen también fijaciones de desarrollo y prueba que nunca se distribuyen: 3 tienen avisos conocidos, de los cuales 1 son directas.

Un aviso significa que la versión registrada en el grafo de dependencias cae dentro del rango afectado de un aviso. No se analiza la alcanzabilidad, y el grafo incluye fijaciones de desarrollo y prueba: un hallazgo puede referirse al utillaje y no al software distribuido.

{
  "data": {
    "repo": {
      "topics": [
        "reliability",
        "reliability-engineering",
        "software-design",
        "software-development",
        "software-engineering",
        "sre",
        "ai",
        "ai-agents",
        "ai-tools",
        "resilience"
      ],
      "is_fork": false,
      "size_kb": 1061,
      "has_wiki": true,
      "homepage": "https://revelara.ai",
      "languages": {
        "Go": 816725,
        "Makefile": 945
      },
      "pushed_at": "2026-07-26T07:12:35Z",
      "created_at": "2026-02-22T20:39:25Z",
      "owner_type": "Organization",
      "updated_at": "2026-07-26T07:10:52Z",
      "description": "Revelara CLI — connect your codebase to the Revelara reliability risk platform",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "Apache-2.0",
      "default_branch": "main",
      "license_spdx_raw": "Apache-2.0",
      "primary_language": "Go",
      "significant_languages": [
        "Go"
      ]
    },
    "owner": {
      "blog": "https://revelara.ai",
      "name": "Revelara.ai",
      "type": "Organization",
      "login": "revelara-ai",
      "company": null,
      "location": "United States of America",
      "followers": 0,
      "avatar_url": "https://avatars.githubusercontent.com/u/262465071?v=4",
      "created_at": "2026-02-19T00:03:42Z",
      "is_verified": null,
      "public_repos": 4,
      "account_age_days": 159
    },
    "license": {
      "state": "standard",
      "spdx_id": "Apache-2.0",
      "raw_spdx": "Apache-2.0",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.10.1",
          "kind": "patch",
          "published_at": "2026-07-25T07:41:02Z"
        },
        {
          "tag": "v0.10.0",
          "kind": "minor",
          "published_at": "2026-07-25T00:29:43Z"
        },
        {
          "tag": "v0.9.2",
          "kind": "patch",
          "published_at": "2026-07-22T23:02:47Z"
        },
        {
          "tag": "v0.9.1",
          "kind": "patch",
          "published_at": "2026-07-20T18:17:48Z"
        },
        {
          "tag": "v0.9.0",
          "kind": "minor",
          "published_at": "2026-07-19T18:29:07Z"
        },
        {
          "tag": "v0.8.19",
          "kind": "patch",
          "published_at": "2026-07-19T16:44:54Z"
        },
        {
          "tag": "v0.8.18",
          "kind": "patch",
          "published_at": "2026-07-08T01:18:04Z"
        },
        {
          "tag": "v0.8.17",
          "kind": "patch",
          "published_at": "2026-07-06T06:51:09Z"
        },
        {
          "tag": "v0.8.16",
          "kind": "patch",
          "published_at": "2026-07-02T05:03:27Z"
        },
        {
          "tag": "v0.8.15",
          "kind": "patch",
          "published_at": "2026-06-30T01:02:55Z"
        },
        {
          "tag": "v0.8.14",
          "kind": "patch",
          "published_at": "2026-06-26T22:11:03Z"
        },
        {
          "tag": "v0.8.13",
          "kind": "patch",
          "published_at": "2026-06-23T23:52:34Z"
        },
        {
          "tag": "v0.8.12",
          "kind": "patch",
          "published_at": "2026-05-30T21:46:31Z"
        },
        {
          "tag": "v0.8.11",
          "kind": "patch",
          "published_at": "2026-05-30T05:15:51Z"
        },
        {
          "tag": "v0.8.10",
          "kind": "patch",
          "published_at": "2026-05-30T00:28:46Z"
        },
        {
          "tag": "v0.8.9",
          "kind": "patch",
          "published_at": "2026-05-29T03:49:55Z"
        },
        {
          "tag": "v0.8.8",
          "kind": "patch",
          "published_at": "2026-05-25T19:20:34Z"
        },
        {
          "tag": "v0.8.7",
          "kind": "patch",
          "published_at": "2026-05-20T17:59:35Z"
        },
        {
          "tag": "v0.8.6",
          "kind": "patch",
          "published_at": "2026-05-17T18:28:59Z"
        },
        {
          "tag": "v0.8.5",
          "kind": "patch",
          "published_at": "2026-05-16T21:27:44Z"
        },
        {
          "tag": "v0.8.4",
          "kind": "patch",
          "published_at": "2026-05-15T02:26:14Z"
        },
        {
          "tag": "v0.8.3",
          "kind": "patch",
          "published_at": "2026-05-08T06:18:16Z"
        },
        {
          "tag": "v0.8.2",
          "kind": "patch",
          "published_at": "2026-05-07T04:57:13Z"
        },
        {
          "tag": "v0.8.1",
          "kind": "patch",
          "published_at": "2026-05-07T04:26:01Z"
        },
        {
          "tag": "v0.8.0",
          "kind": "minor",
          "published_at": "2026-05-06T02:13:46Z"
        },
        {
          "tag": "v0.7.10",
          "kind": "patch",
          "published_at": "2026-05-01T23:43:54Z"
        },
        {
          "tag": "v0.7.9",
          "kind": "patch",
          "published_at": "2026-04-30T06:23:55Z"
        },
        {
          "tag": "v0.7.8",
          "kind": "patch",
          "published_at": "2026-04-27T04:23:10Z"
        },
        {
          "tag": "v0.7.7",
          "kind": "patch",
          "published_at": "2026-04-27T02:06:15Z"
        },
        {
          "tag": "v0.7.6",
          "kind": "patch",
          "published_at": "2026-04-26T21:56:16Z"
        },
        {
          "tag": "v0.7.5",
          "kind": "patch",
          "published_at": "2026-04-26T18:09:23Z"
        },
        {
          "tag": "v0.7.4",
          "kind": "patch",
          "published_at": "2026-04-26T17:37:17Z"
        },
        {
          "tag": "v0.7.3",
          "kind": "patch",
          "published_at": "2026-04-25T07:20:38Z"
        },
        {
          "tag": "v0.7.2",
          "kind": "patch",
          "published_at": "2026-04-21T03:10:45Z"
        },
        {
          "tag": "v0.7.1",
          "kind": "patch",
          "published_at": "2026-04-19T02:51:42Z"
        },
        {
          "tag": "v0.7.0",
          "kind": "minor",
          "published_at": "2026-04-15T00:32:36Z"
        },
        {
          "tag": "v0.6.2",
          "kind": "patch",
          "published_at": "2026-04-13T06:27:03Z"
        },
        {
          "tag": "v0.6.1",
          "kind": "patch",
          "published_at": "2026-04-13T06:02:25Z"
        },
        {
          "tag": "v0.6.0",
          "kind": "minor",
          "published_at": "2026-04-10T05:28:27Z"
        },
        {
          "tag": "v0.5.2",
          "kind": "patch",
          "published_at": "2026-04-07T18:48:19Z"
        },
        {
          "tag": "v0.5.1",
          "kind": "patch",
          "published_at": "2026-03-31T19:53:46Z"
        },
        {
          "tag": "v0.5.0",
          "kind": "minor",
          "published_at": "2026-03-31T17:02:42Z"
        },
        {
          "tag": "v0.4.2",
          "kind": "patch",
          "published_at": "2026-03-23T15:22:44Z"
        },
        {
          "tag": "v0.4.1",
          "kind": "patch",
          "published_at": "2026-03-23T03:48:42Z"
        },
        {
          "tag": "v0.4.0",
          "kind": "minor",
          "published_at": "2026-03-22T06:28:40Z"
        },
        {
          "tag": "v0.3.8",
          "kind": "patch",
          "published_at": "2026-03-15T22:12:22Z"
        },
        {
          "tag": "v0.3.7",
          "kind": "patch",
          "published_at": "2026-03-15T21:01:35Z"
        },
        {
          "tag": "v0.3.6",
          "kind": "patch",
          "published_at": "2026-03-15T20:31:36Z"
        },
        {
          "tag": "v0.3.5",
          "kind": "patch",
          "published_at": "2026-03-11T20:46:53Z"
        },
        {
          "tag": "v0.3.4",
          "kind": "patch",
          "published_at": "2026-03-11T03:04:02Z"
        },
        {
          "tag": "v0.3.3",
          "kind": "patch",
          "published_at": "2026-03-10T06:09:26Z"
        },
        {
          "tag": "v0.3.2",
          "kind": "patch",
          "published_at": "2026-03-10T05:09:31Z"
        },
        {
          "tag": "v0.3.1",
          "kind": "patch",
          "published_at": "2026-03-10T03:35:32Z"
        },
        {
          "tag": "v0.3.0",
          "kind": "minor",
          "published_at": "2026-03-10T02:22:50Z"
        },
        {
          "tag": "v0.2.2",
          "kind": "patch",
          "published_at": "2026-03-09T20:20:33Z"
        },
        {
          "tag": "v0.2.1",
          "kind": "patch",
          "published_at": "2026-03-03T00:37:24Z"
        },
        {
          "tag": "v0.2.0",
          "kind": "minor",
          "published_at": "2026-02-28T03:21:25Z"
        },
        {
          "tag": "v0.1.3",
          "kind": "patch",
          "published_at": "2026-02-27T20:26:29Z"
        },
        {
          "tag": "v0.1.2",
          "kind": "patch",
          "published_at": "2026-02-26T16:29:19Z"
        },
        {
          "tag": "v0.1.1",
          "kind": "patch",
          "published_at": "2026-02-24T17:50:26Z"
        },
        {
          "tag": "v0.1.0",
          "kind": "minor",
          "published_at": "2026-02-22T21:41:42Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "efd80b3373eae6b47ec7005e5b9eda2037203491",
          "body": "perf(agentscan): chunk by file count to bound per-lens runtime",
          "is_bot": false,
          "headline": "Merge pull request #32 from revelara-ai/feat/agent-scan-perfile-chunking",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-26T07:10:46Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a2e63aa85fdf178e8ecaad384bccdbda5ad3a281",
          "body": "…rjz)\n\nPer-lens scan runtime is driven by the number of files a lens reasons over,\nnot diff line count: a medium multi-file change (7 files / ~180 lines) runs a\nsingle lens close to the 180s per-lens timeout even though it is well under the\n1500-line chunking threshold, and a timeout fails that lens\n[…]\n=1; groups of 3-4 keep the gate at baseline.\n\nConfig: scanner.agent.chunk_max_files. Tests: file-count chunking, passthrough\nat the cap, settings validation. Adversarial review (3 lenses): no defects.",
          "is_bot": false,
          "headline": "perf(agentscan): chunk by file count to bound per-lens runtime (po-ks…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-25T23:02:07Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "843721c22300720737908b8d1b18f2baf70514af",
          "body": "feat(agentscan): new-code gating — gate only on findings on changed lines (po-7si2t)",
          "is_bot": false,
          "headline": "Merge pull request #31 from revelara-ai/feat/agent-scan-newcode-gating",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-25T21:46:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0fa32f0525801bcc69b52ce88fd385ca80d4b79d",
          "body": "…ines (po-7si2t)\n\nAddresses the treadmill's detection-variance layer: scoring is deterministic,\nbut the agent samples real issues non-deterministically, so re-runs surface\nnew findings and re-litigate pre-existing code in files you merely touched.\n\nNew-code gating parses ChangeSet.Diff into per-file\n[…]\n), in-scope classification\n(exact/tolerance/file-level/untouched), classifyNewCode, ComputeGate-skips-\nadvisory. Validated e2e against prod: new-file findings correctly gate (path\nmatching confirmed).",
          "is_bot": false,
          "headline": "feat(agentscan): new-code gating — gate only on findings on changed l…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-25T21:41:03Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4640dc0e0cf4a655f1a238de54e824f917b99135",
          "body": "fix(agentscan): bound runtime + retry so lenses stop timing out (po-ksrjz)",
          "is_bot": false,
          "headline": "Merge pull request #30 from revelara-ai/fix/agent-scan-lens-resilience",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-25T21:37:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2ae5d5f71c143b8e4114a7406c3accae9e2e98f5",
          "body": "…ksrjz)\n\nDiagnosis: ~20% of claude -p calls fail fast (~3s) with a transient upstream\nAPI error (is_error, api_error_status=500), not a timeout and not the user's\nchange. With 3 lenses, ~half of scans lose a lens -> fail-open.\n\n- Global per-lens budget shared across attempts (LensBudget, = adapter t\n[…]\n — so a\n  fail-open never reads as the user's fault.\n\nTests: transient-retry-then-succeed, retry-up-to-max, no-retry on success /\nunavailable / budget-exhausted; ErrAgentAPI in the retryable taxonomy.",
          "is_bot": false,
          "headline": "fix(agentscan): budget-aware retry + surface upstream API errors (po-…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-25T18:14:43Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "bcb78aa37f0e168dd2229980c139c1baff69a7e8",
          "body": "…srjz)\n\nOccasional lens failures traced to three unhandled conditions in the fan-out:\nno turn cap (a lens could crawl the tree until the 180s wall), unbounded\nconcurrency (up to 12 claude processes at once, contending/rate-limiting each\nother), and no retry (one transient timeout = a lost lens, find\n[…]\ne semantics (success-after-retry, no-retry on success/\nunavailable, retry-also-fails keeps the error), isRetryableLensErr taxonomy,\nand a RunPipeline concurrency-limit test (6 invocations, peak <= 2).",
          "is_bot": false,
          "headline": "fix(agentscan): bound runtime + retry so lenses stop timing out (po-k…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-25T15:58:35Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "eb6a9a5b0645ced9c39278fb81f014d27f3f8cfb",
          "body": "feat(agentscan): gate on server-computed data-grounded severity (po-7si2t.6)",
          "is_bot": false,
          "headline": "Merge pull request #29 from revelara-ai/feat/agent-scan-server-severity",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-25T07:34:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "37a8de85dd3986566842a5593ef137b64e8fa23a",
          "body": "…si2t.6)\n\nThe agent scan now replaces each finding's LLM-assigned severity with the\nabsolute, deterministic band from POST /api/v1/findings/score before the gate,\nso the gate reflects a server-computed score rather than the model's relative,\nnon-convergent label (the treadmill).\n\n- agentscan.Scorer \n[…]\ning the lens prompts to drop severity is a follow-up.\n\nValidated: unit tests (band mapping, fail-open, pipeline wiring) + live prod\nendpoint returns grounded bands (critical/medium) with the prod key.",
          "is_bot": false,
          "headline": "feat(agentscan): gate on server-computed data-grounded severity (po-7…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-25T07:04:16Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1446d1f81ca89b254a2e4ed1ff24b4d39c02c642",
          "body": "feat: rvl scan --agent (agentic git-hook gate) + retire local matcher scanner (po-66evv)",
          "is_bot": false,
          "headline": "Merge pull request #28 from revelara-ai/feat/agent-scan-git-hook",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-25T00:21:08Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "066ab59d2caa5d5e28d60fcc28b30c4d4c62a20d",
          "body": "…g fields\n\nDocs (README, revelara-yaml, maturity, quickstart): remove rvl scan\n--local usage and matcher config, point to rvl scan --agent and\ndocs/agent-scan-hooks.md; retier the scanner: section to beta.\n\nconfig: remove the now-dead ScannerConfig fields that only fed the\nretired local scanner (exc\n[…]\ne, profile, profiles) and the orphaned ToleranceConfig type. Keep\nbase_ref (feeds --agent --changed-only), waivers (agent rule slugs),\nand agent. Verified zero non-test readers for each removed field.",
          "is_bot": false,
          "headline": "docs+config: retire local-scanner references; drop dead scanner confi…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-24T23:51:47Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e0d86107c3d5d4e3a6898d7eda686ccb3df8c252",
          "body": "…ces it\n\nRemoves rvl scan --local and the entire Go pattern-matcher engine\n(internal/scanner/matchers + the scan engine, loader, profiles,\nredaction, fingerprinting, grouping) and the local-scan command surface\n(scan_local*.go, sticky_comment*.go, the --local/--list-matchers/\n--source/--matchers/--p\n[…]\n_waivers, service_tolerance, or matcher_version, and no longer\nemits -org scans (the 'generated matcher' UI badge goes dormant). All\nfields are omitempty so the API is unaffected; filed as follow-ups.",
          "is_bot": false,
          "headline": "refactor(scanner): retire the local matcher scanner; agent scan repla…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-24T23:45:03Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3a4b850139922b2ac1e877497675617801391b7d",
          "body": "…push hook\n\nCovers rvl hook install (lefthook-aware snippet + .git/hooks shim) and\ndoctor, enforce vs eval, .revelara.yaml scanner.agent config, waivers,\nforce-through, manual invocation incl. the pre-push stdin protocol,\nexit codes, and the custom-agent escape hatch.",
          "is_bot": false,
          "headline": "docs(agentscan): how to install rvl scan --agent as a pre-commit/pre-…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-24T23:22:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0396d9ccf0af0be6d48b5f0fd70ce37a3a390e50",
          "body": "The human report printed nothing for ~90s then dumped everything at\nonce, so a run looked hung (the same confusion --pre-push had). Add a\nProgress callback to the pipeline (nil-safe, serialized since lens-done\nfires from parallel goroutines) emitting change-set size, selected\nlenses, and each lens a\n[…]\nscripting), leading with the\nchange-set count and a '~1-2 min' expectation, then a line per lens as\nit finishes. The final report no longer repeats the per-lens summary\n(it streamed live). Race-clean.",
          "is_bot": false,
          "headline": "feat(agentscan): live progress affordances during the human scan run",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-24T23:02:08Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b52180816bdf7e37e22ba93778d7bcf2ba85485e",
          "body": "…t a flat 42 (po-fc2qs)\n\nmapAgentFindings put the LLM severity in Impact and left Likelihood\nempty, but the server's Path 5 scorer reads likelihood (risk_service.go\n:2367 feeds Severity: likelihood). Combined with Confidence='agent'\n(0.85 default modulator) and no business criticality, every agent\nf\n[…]\ne grounding (incident freq,\nblast radius, MTTR) stays unset for now, so findings take the same\nseverity-fallback branch as an ungrounded matcher - consistent, and\nenrichment is the separate follow-on.",
          "is_bot": false,
          "headline": "fix(agentscan): score agent findings on the existing Path 5 model, no…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-24T22:46:23Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "dd1ef3ede4e58f03f17adbe0c158175866ff95e8",
          "body": "…l spend)\n\nclaude -p reports total_cost_usd as an API-list-price figure that does\nnot reflect actual spend on a subscription plan (and is inflated by\nprompt-cache-creation pricing), so showing it as 'cost' is misleading.\nRemove the per-lens and total cost from the human report and the\ncost fields from --format json. The adapter still parses it and the\npipeline still sums it internally, so a trustworthy cost surface can be\nreintroduced later, but nothing is displayed for now.",
          "is_bot": false,
          "headline": "fix(agentscan): stop surfacing agent cost (claude's number is not rea…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-24T21:13:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "823121309a970e36cd51e7c4e87070def06937c1",
          "body": "--pre-push reads git's ref lines from stdin. Run by hand in a terminal\nit blocked forever on the stdin read with no output, and because the\nSIGINT handler is installed before the read, Ctrl+C was swallowed\n(it cancels a context the blocking read does not watch) so the process\ncould not be interrupte\n[…]\nce) up\nfront and exit with guidance instead of blocking; a pipe or file (the\nreal hook) is unaffected. Verified: TTY/dev-null stdin prints guidance\nand exits 2; piped ref lines still process normally.",
          "is_bot": false,
          "headline": "fix(agentscan): --pre-push hangs when run interactively (stdin is a TTY)",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-24T20:28:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "27e827144ebc09cb9db6f2555b096f0ce6b27ee2",
          "body": "… boundary (po-66evv.10)\n\nSelectAdapter resolves a preset by name (claude default, custom) and\nenforces the trust boundary: a preset NAME may come from repo-tracked\n.revelara.yaml (it selects built-in code), but a custom COMMAND string\ncomes ONLY from RVL_AGENT_CMD, a user-level source a cloned repo\n[…]\n mode\nneeds a different inlined-prompt path (not the Read-based claude flow),\na JSONL envelope parser, and billing-aware single-lens defaults, none\nverifiable without the binary. Filed as a follow-up.",
          "is_bot": false,
          "headline": "feat(agentscan): custom command adapter + preset selection with trust…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-24T19:55:38Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f2990980c77ba06d70ec543ea57230a92869537d",
          "body": "rvl scan --agent --pre-push reads githooks(5) ref lines from stdin and\nresolves each pushed ref to a concrete base...sha range, fixing the\nred-team blockers that a naive base...HEAD scan hit:\n- deletes (zero local-sha) and refs/tags/* are skipped (a tag push is a\n  prod deploy in some workflows; nev\n[…]\nref pipeline runs aggregate to the worst exit code. Added the\nbase...head change-set primitive and a SnapshotTreeish pipeline option.\nLive-smoked: delete+tag push skips both, exit 0, no agent invoked.",
          "is_bot": false,
          "headline": "feat(agentscan): pre-push stdin ref protocol (po-66evv.9)",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-24T19:49:54Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5f6f36bd1e81a23b128addd9a228cc7efb6502f6",
          "body": "…int (po-66evv.11)\n\nOpt-in POST of aggregated agent findings to /api/v1/risks/scan, reusing\nthe local scanner's submitScan transport. Mapping: Slug<-Rule,\nImpact<-Severity, Confidence=agent, Category<-Lens, Status=new (agent\nfindings are change-scoped by construction), one code Evidence entry,\nrecom\n[…]\nnges the exit code, and a failure is a\nwarning. Documented gap: the ScanRequest schema cannot represent the\ngate outcome (blocked/fail-open) or force-through events; filed as a\npolaris-side follow-up.",
          "is_bot": false,
          "headline": "feat(agentscan): --submit maps agent findings to the risks scan endpo…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-24T19:43:08Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b34173b9072ab530ae61f0d7eeceb2cc8574df10",
          "body": "install is lefthook-aware: when lefthook.yml is present it prints a\npaste-ready snippet (pre-push carries use_stdin: true for po-66evv.9's\nref protocol, and a post-secret-scan ordering note) instead of fighting\nlefthook for .git/hooks. Otherwise it writes a POSIX shim into the dir\nfrom git rev-parse\n[…]\n PATH, headless-auth\nguidance, lefthook wiring, secret-scan ordering, and conflicting hooks;\nwarnings pass, only a missing binary or bad config fails. Live-verified\nagainst polaris (snippet + doctor).",
          "is_bot": false,
          "headline": "feat(hook): rvl hook install + doctor for agent-scan gates (po-66evv.8)",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-24T19:39:18Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "37cde224c56dc88c6c12830cfe4f5d7e1cb17109",
          "body": "…cal audit trail (po-66evv.6)\n\nEmergency override that SKIPS the gate entirely (spec: Gate policy), so\nit pays neither wall-clock nor cost - the point is shipping a lesser\nrisk to fix a greater one. Two mechanisms: RVL_FORCE=1 env, and a\none-shot marker armed by 'rvl scan force-next' for GUI git cli\n[…]\nonce,\neven when env also forced, so it cannot silently apply to a later run.\nChecked at the top of runAgentScan, before any scan work. Live-smoked:\narm -> skip+audit+consume, exit 0, no agent invoked.",
          "is_bot": false,
          "headline": "feat(agentscan): force-through via RVL_FORCE and one-shot marker + lo…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-24T19:35:31Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9855640f1a5d88c25bbf35f0d77fd73eb5943945",
          "body": "ApplyWaivers suppresses aggregated findings before the gate, keyed on\nlens rule slug (not the nondeterministic LLM title) plus file glob,\nwith optional YYYY-MM-DD expiry (expired waivers are inert). Glob\nsemantics mirror the local scanner's waiverMatchesPath exactly\n(path.Match plus a **/ basename p\n[…]\nehaves identically for both scanners. Shared slugs across\nlanguage lenses mean one waiver spans every lens that can emit the\nrule. Waived findings are reported (human + JSON) and noticed, never\ngated.",
          "is_bot": false,
          "headline": "feat(agentscan): waivers on rule + file glob with expiry (po-66evv.7)",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-24T19:31:19Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5bc66587707a0bc72b9f01463a5489ef0123e70d",
          "body": "…ent CLI (po-66evv.5)\n\nRunPipeline wires the full stage chain (skip states -> change set ->\ngenerated filter -> secrets refusal -> budget -> lens selection ->\navailability probe -> snapshot -> parallel chunk-x-lens fan-out capped\nat 12) and ComputeGate decides pure-functionally: fail_on threshold\n(d\n[…]\nine banner; degraded file-list scans are flagged on the gate\nline. New scanner.agent config subsection; agent binary is flag-only\nby design (po-66evv.10 trust boundary). Seams marked for .6/.7/.9/.11.",
          "is_bot": false,
          "headline": "feat(agentscan): pipeline orchestration + gate policy + rvl scan --ag…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-24T19:20:54Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ba72f18789df850a57278e8f6cdf6f2b8c34525f",
          "body": "… refusal, skip states (po-66evv.2)\n\nFilterGenerated: gitattributes linguist-generated (both directions,\nfirst authority) -> builtin globs -> config globs; drops strip both\nthe file list and the diff section. ApplyBudget: 1500-line soft limit\nwith per-file chunking, 6000 hard limit degrading to file\n[…]\nks-style detection (file:line,\nnever the value) unwrapping to ErrSecretsDetected — must never route\nthrough the fail-open path. SkipReason: merge/rebase/cherry-pick\ndetection, linked-worktree correct.",
          "is_bot": false,
          "headline": "feat(agentscan): diff hygiene — generated filter, size budget, secret…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-24T19:01:01Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "65dd37d3db86f9f7338e16444df79bf251616a01",
          "body": "… (po-66evv.4)\n\nAdapter contract + claude preset: claude -p via stdin (never argv),\n--output-format json --allowedTools Read, pinned model (default\nsonnet), cwd = snapshot dir, per-invocation timeout with WaitDelay\nkill. Sentinel errors ErrAgentUnavailable/ErrAgentTimeout classify\ninfra failures for\n[…]\norces\nthe prompt's promises — rule slug in lens vocab, severity normalized,\nfile inside the change set — and stamps the lens ID. Costs preserved\neven on parse failure; drops recorded for auditability.",
          "is_bot": false,
          "headline": "feat(agentscan): claude adapter preset + tolerant findings extraction…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-24T18:58:59Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "86b9172a9d4a36c7addab954e2d50a7cd5bef3dd",
          "body": "…(po-66evv.1)\n\nStagedChangeSet/RangeChangeSet compute the diff + classified file list\n(rename-deterministic via -M; po-t8acf arg order + dash guards; empty\ndiff = non-nil empty Files). SnapshotIndex/SnapshotTree materialize\nindex or tree blobs — never the worktree — so partial staging gates\nwhat is actually being committed; GIT_INDEX_FILE is inherited so temp-\nindex commits (git commit -a) diff the index the commit will use.\nFail-closed on any per-file snapshot error; path-escape guarded.",
          "is_bot": false,
          "headline": "feat(agentscan): staged/range change sets + snapshot materialization …",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-24T18:52:11Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "280f91b5cedbc272ce9f352f440e7b65398e011a",
          "body": "…vv.3)\n\nFive built-in lenses (go, javascript, python, observability, general),\neach with a closed 12-slug rule vocabulary (waiver keys — never rename).\nSelectLenses picks at most one language lens by majority, always adds\nobservability+general, caps at 4. RenderPrompt embeds the strict-scope\ncontract that produced the measured 60s commit scan: diff inlined,\nsnapshot-dir Reads only, no exploration, minimal turns, JSON-only\noutput with rule slugs constrained to the vocabulary.",
          "is_bot": false,
          "headline": "feat(agentscan): lens catalog + strict-scope prompt templates (po-66e…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-24T18:50:11Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6dbfe46c4f0ae5c3524d146cb112214411e25b51",
          "body": "…o-66evv)\n\nPackage skeleton + the types shared between pipeline stages (change\nset, lens, finding, lens result) so the stage implementations can land\nin parallel without colliding on shared definitions.",
          "is_bot": false,
          "headline": "feat(agentscan): shared contract types for the agent-scan pipeline (p…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-24T18:44:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "60a0a489d218c9192bbc92d99687e3c4fa22594a",
          "body": "…ly diffs (po-t8acf)\n\nResolveChangedFiles and ResolveChangedHunks passed the range after '--',\nmaking git parse 'base...HEAD' as a pathspec: the diff was always empty,\n--changed-only silently fell back to a full scan, and every finding\nclassified pre-existing — the gate never fired.\n\n- Range before \n[…]\n guard\n- nil OnlyFiles = scan everything vs non-nil empty = scan nothing,\n  enforced in the engine with an explicit 'nothing to scan' notice\n- 6 regression tests incl. the end-to-end vacuous-gate case",
          "is_bot": false,
          "headline": "fix(scanner): put revision range before '--' so --changed-only actual…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-24T18:42:51Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "dd04e358d3f6efcfa8e0d8f7cd0fc66d8b3fb66e",
          "body": "chore: relicense rvl CLI from BSL 1.1 to Apache License 2.0",
          "is_bot": false,
          "headline": "Merge pull request #27 from revelara-ai/chore/relicense-apache-2.0",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-22T23:04:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "769d429f6f68340c542cefe52298eeb38636d175",
          "body": "The CLI is the commodity access surface plus local static matchers. The\nmoat (incident corpus, skilleval fixtures, tuned agent prompts, org\ngrounding) is served from the backend at runtime and never shipped in the\nclient; audit confirmed no fixtures/prompts/secrets are bundled. BSL's\n\"no competing h\n[…]\nless on-ramp and lets any harness embed it.\n\n- LICENSE: BSL 1.1 -> Apache License 2.0 (canonical text, (c) 2026 Revelara AI LLC)\n- NOTICE: added per Apache convention\n- README: license section updated",
          "is_bot": false,
          "headline": "chore: relicense rvl CLI from BSL 1.1 to Apache License 2.0",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-22T22:55:20Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4f28bb34f83b396d61214d6e3ce570267828070e",
          "body": "fix(cli): rvl risk context mirrors the Risk Detail page",
          "is_bot": false,
          "headline": "Merge pull request #26 from revelara-ai/feat/risk-context-parity",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-22T22:54:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e5a6cb4117c18a564b36ac74ea097f5e92cd2040",
          "body": "Adds header extras (trend, matcher, severity, class, read-only), score-math\nreceipt, grounding + narrative, related findings, corroborating incidents\n(inc-xxx + source link), substantiation, defense-layer coverage, STPA\nprovenance, history (resolution/dismissal/stale/metadata), and assessment\ncoverage gap. Fixes: control-evidence URLs now print; STPA headings use the\n'STPA-inspired' language with the Leveson/MIT disclaimer.",
          "is_bot": false,
          "headline": "feat(cli): render all Risk Detail parity sections in risk context",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-22T21:08:29Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b238090e51b67c71ba08fb364e2eb104079b7501",
          "body": "…renderer\n\nFetches detail (primary), context, and stats concurrently and composes a\nRiskContextView. Moves rendering into a testable string-returning renderer.\n--format=json emits the context body (top-level score_factors/controls/\ngraph_multiplier preserved for /rvl:fix) plus the detail payload under\n\"detail\" and coverage under \"coverage_gap\".",
          "is_bot": false,
          "headline": "feat(cli): re-base risk context on detail endpoint; string-returning …",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-22T21:02:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e408caed324f4c7a46413ddeff7c219c934c2e65",
          "body": "…o-main\n\nfix(plugin): land PR #24 on main (stacked-merge stranded it on the base branch)",
          "is_bot": false,
          "headline": "Merge pull request #25 from revelara-ai/fix/claudemd-backend-served-t…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-20T18:15:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "bd6f5a6cb3049b8ab85f243c941f6c189a51da61",
          "body": "fix(plugin): prefer backend-served context templates, single-sourced fallback (po-pw4p6)",
          "is_bot": false,
          "headline": "Merge pull request #24 from revelara-ai/fix/claudemd-single-source",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-20T18:04:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "bdc34c9362e406ecab7fd36af7e1c16d987231bf",
          "body": "fix(init): report CLAUDE.md in completion summary; honest context-file docs (po-dhtnw, po-pw4p6)",
          "is_bot": false,
          "headline": "Merge pull request #23 from revelara-ai/fix/init-context-file-reporting",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-20T18:02:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ebaaa753a6bf5d0b365745c2231782ce08d33a38",
          "body": "…on is the fallback (po-pw4p6)\n\nPer review: keep template content versioned on the backend for loose\ncoupling between the CLI and agent-context wording. The writers now\nread AGENTS.md and CLAUDE.md template bodies from the installed plugin\ncontent (~/.revelara/marketplace/plugins/revelara) when pres\n[…]\ns the backend's own composition. Tests are\nhermetic against the developer's real installed plugin content via a\nTestMain HOME override, with served-template precedence and empty-file\nfallback covered.",
          "is_bot": false,
          "headline": "fix(plugin): prefer backend-served context templates; baked compositi…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-20T17:37:08Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "16524c55c31cc18a61b4b1f8afa6ae26858b7efe",
          "body": "…e (po-pw4p6)\n\nAGENTS.md content came from a hard-coded CLI constant while CLAUDE.md\ncame from a template bundled in the plugin tarball; the shared sections\nhad drifted since nothing kept them in sync. The CLAUDE.md block is now\ncomposed in the CLI as agentsMdTemplate (shared, agent-neutral) plus an\n[…]\ns the AGENTS.md template\nappears verbatim in the CLAUDE.md block and that Claude extras never\nleak into AGENTS.md. The backend-bundled template remains only for\nolder CLIs and is re-synced separately.",
          "is_bot": false,
          "headline": "fix(plugin): single-source CLAUDE.md block from the AGENTS.md templat…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-20T16:57:33Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c7450e790c71633cc94009abba0cb596597893ff",
          "body": "…ext-file docs (po-dhtnw, po-pw4p6)\n\nThe init summary only ever mentioned AGENTS.md: the CLAUDE.md action was\ncomputed in Step 5 but never reached printInitSummary, and the commit\nhint omitted CLAUDE.md. New-user feedback read this as CLAUDE.md being\nunhandled. Thread the action through, print it, a\n[…]\nE: stop claiming AGENTS.md and CLAUDE.md get 'the same block' (the\nCLAUDE.md block is intentionally Claude-specific), document that files\nare created when missing, and warn against symlinking the two.",
          "is_bot": false,
          "headline": "fix(init): report CLAUDE.md action in completion summary; honest cont…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-20T16:49:36Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b04f60b11ad133b3025f35416cc16c0090711c87",
          "body": "fix(docs): macOS install uses explicit brew tap + trust + --cask (po-h6qc0)",
          "is_bot": false,
          "headline": "Merge pull request #22 from revelara-ai/fix/brew-cask-install-docs",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-20T16:45:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8d05fa47890077e1676ef571e3a3f4ad049115f2",
          "body": "The fully-qualified cask token 'brew install revelara-ai/tap/rvl' fails\non some Homebrew setups until the tap exists; new-signup feedback\nconfirmed it. Document the tap step and the cask-explicit install.",
          "is_bot": false,
          "headline": "fix(docs): macOS install uses explicit brew tap + --cask (po-h6qc0)",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-20T16:40:23Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c6629901f93be256d1f6a3a01b4da08bad40fd8a",
          "body": "feat(status): recommend the upgrade command matching the install method",
          "is_bot": false,
          "headline": "Merge pull request #21 from revelara-ai/feat/upgrade-hint-install-method",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-19T18:25:32Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "35ca7e9178ccd55bf990ea6f62b646ecdab9e5b4",
          "body": "…od (po-t1mu7)\n\nrvl status hardcoded 'go install ...@latest' as the upgrade hint even for\nbrew-installed binaries. Classify the resolved executable path instead:\nHomebrew markers (Caskroom/Cellar/homebrew/.linuxbrew, symlinks resolved\nsince the cask links bin/rvl into the Caskroom) suggest\n'brew upg\n[…]\nra-ai/tap/rvl'; a GOBIN / GOPATH bin / ~/go/bin\nlocation keeps the go install hint. Unrecognized paths print no command and\nfall back to the releases link, which is printed unconditionally either way.",
          "is_bot": false,
          "headline": "feat(status): recommend the upgrade command matching the install meth…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-19T18:21:30Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "43f74017dd94707489fb1e73461e38de42111c1b",
          "body": "fix(plugin): track rvl- prefixed skill dirs for cleanup on non-Claude editors (po-czlr0)",
          "is_bot": false,
          "headline": "Merge pull request #20 from revelara-ai/fix/po-czlr0-namespace-skills",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-17T18:07:03Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6f5e61b3448c9e551c755a01e52e41652af838b3",
          "body": "… editors (po-czlr0)\n\nPaires with polaris #po-czlr0: non-Claude installs now drop skills as\nrvl-scan/, rvl-ask/, etc. instead of bare scan/, ask/. Add a\nCurrentSkillNames set (the 9 rvl- prefixed current skills) used both for\ninstall detection and as the head of the PolarisSkillNames cleanup list.\nK\n[…]\nreview so 'rvl plugin remove/update' from an older\ninstall cleans up the un-prefixed directories.\n\nAlso replaces the fragile PolarisSkillNames[:7] install probe with the\nnamed CurrentSkillNames slice.",
          "is_bot": false,
          "headline": "fix(plugin): track rvl- prefixed skill dirs for cleanup on non-Claude…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-17T17:05:39Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ef0ad6898d8bbf1a7cfca50eaf192c0ef0e6e96c",
          "body": "docs: complete .revelara.yaml reference + feature maturity page",
          "is_bot": false,
          "headline": "Merge pull request #19 from revelara-ai/docs/revelara-yaml-reference",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-15T19:09:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2f00e6ccd0b50b7b9a70e9f3be5290b7e217c652",
          "body": "Adds docs/revelara-yaml.md: an exhaustive, field-by-field reference for\n.revelara.yaml (stable identity fields + the alpha scanner section),\nwith valid values, defaults, and precedence chains.\n\nAdds docs/maturity.md: single source of truth for command/feature\nmaturity (production / beta / alpha) with tier definitions.\n\nUpdates local-scanner.md (alpha banner + config summary linking the\nreference), README.md (maturity + config pointers), and quickstart.md\n(maturity link).",
          "is_bot": false,
          "headline": "docs: add complete .revelara.yaml reference and feature maturity page",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-15T19:06:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c3e222dc8d2a97184c377cece976e5366d34b8d7",
          "body": "fix: hedge STPA help text as STPA-inspired, add scope note",
          "is_bot": false,
          "headline": "Merge pull request #18 from revelara-ai/fix/stpa-inspired-language",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-08T01:15:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c0cd54115c092b183d5c41f9df346f37198f491d",
          "body": "…a usage\n\nPart of the STPA/CAST language pass (polaris po-rr99a): CLI help, zsh/fish\ncompletions, and rvl stpa usage footer now say STPA-inspired and note that\nfindings are candidates for engineer review, not a substitute for expert\nhazard analysis of safety-critical systems.",
          "is_bot": false,
          "headline": "fix: hedge STPA help text as STPA-inspired, add scope note to rvl stp…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-07T21:45:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "db30217d4a90fa09fa485f168a1a786d4a0a69dc",
          "body": "Pre-launch fixes: secret redaction, https-only api_url, CLI contract consistency",
          "is_bot": false,
          "headline": "Merge pull request #17 from revelara-ai/fix/launch-review-batch",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-05T21:31:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b04a4fa293461028961d134a54ac023aaa77307e",
          "body": "…mands (po-i24do.11)",
          "is_bot": false,
          "headline": "fix(cli): accept --flag value syntax and validate --format across com…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-05T20:52:50Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3723729a7e6ca28d7a31bfe15bede0e689059b98",
          "body": "…ns (po-i24do.8)",
          "is_bot": false,
          "headline": "fix(completion): add report, review, stpa, migrate to shell completio…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-05T20:45:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f2decf18a2b24a9c144f6c0cdcf50e70686abb25",
          "body": "… (po-i24do.7)",
          "is_bot": false,
          "headline": "fix(plugin): accept --format=json on plugin agents, keep --json alias…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-05T20:43:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9cea78d54bf905b4f70c974a11508912786211d6",
          "body": null,
          "is_bot": false,
          "headline": "fix(config): reject non-https api_url except localhost (po-i24do.20)",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-05T20:42:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ea5b068701e2379768936f1299534dff60064971",
          "body": "…4do.19)",
          "is_bot": false,
          "headline": "fix(scanner): redact credentials in submitted finding snippets (po-i2…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-05T20:41:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b25d85bce4d8d1c30300a8ee1280e618fb63a6b4",
          "body": "feat(report): rvl report — SOC 2 readiness scorecard (po-0b7l7.3)",
          "is_bot": false,
          "headline": "Merge pull request #16 from revelara-ai/feat/soc2-readiness-report",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-05T16:51:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d802f1d7f6debac515eae8973fd5ef7b4f82939d",
          "body": "New `rvl report --framework soc2 [--set starter|full]` command: renders the\ncompliance readiness scorecard from GET /api/v1/compliance/{framework}/readiness.\nShows the in-scope controls with per-control state and an overall readiness %,\nplus a starter-vs-full toggle. Readiness/supporting framing only — never\ncertification. --format json passes the raw server body through for scripting.",
          "is_bot": false,
          "headline": "feat(report): rvl report — SOC 2 readiness scorecard (po-0b7l7.3)",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-05T06:05:37Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b26acff1fe82460281e5560bfafc88a6fc94065b",
          "body": "…les-57bd245098\n\nchore(deps): bump golang.org/x/net from 0.38.0 to 0.55.0 in the go_modules group across 1 directory",
          "is_bot": false,
          "headline": "Merge pull request #15 from revelara-ai/dependabot/go_modules/go_modu…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-04T21:18:23Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a67bb08e391167681a0f9c21fa522c619f6872f2",
          "body": "Bumps the go_modules group with 1 update in the / directory: [golang.org/x/net](https://github.com/golang/net).\n\n\nUpdates `golang.org/x/net` from 0.38.0 to 0.55.0\n- [Commits](https://github.com/golang/net/compare/v0.38.0...v0.55.0)\n\n---\nupdated-dependencies:\n- dependency-name: golang.org/x/net\n  dependency-version: 0.55.0\n  dependency-type: indirect\n  dependency-group: go_modules\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump golang.org/x/net",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-04T06:04:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8c4630863d49fc5abf3ed2d8b7d9ad5ed0c6abc2",
          "body": "fix(cli): remove user-facing Polaris codename from PR comment",
          "is_bot": false,
          "headline": "Merge pull request #14 from revelara-ai/chore/codename-cleanup",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-03T23:57:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9f482f890e4f437d8731ae95eea288c9eedb5bdc",
          "body": "The sticky PR comment rendered '[View full report in Polaris]' and the\ninput field was named PolarisRiskListURL. Polaris is an internal-only\ncodename; the product is Revelara. Rename the field to\nRevelaraRiskListURL and update the link text + example URL.\n\nPart of the cross-repo codename/brand cleanup (Relynce/Polaris -> Revelara).",
          "is_bot": false,
          "headline": "fix(cli): remove user-facing Polaris codename from PR comment",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-03T23:45:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a41dc8a4b400663f178a6e45a56ccbdca8336b7d",
          "body": "… install for all editors (po-esuqh)",
          "is_bot": false,
          "headline": "merge: feat/agents-md-all-editors — managed AGENTS.md block on plugin…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-02T03:51:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a4876db26d80cadb82842ab27c4ab8f45831f665",
          "body": "… unknown-flag errors, --limit, env auth, key masking, exit-code contract (po-cj4s7)\n\n* fix/agent-contract-bugs:\n  test(cli): cover missing-value, bad-numeric, and enrich total-failure contracts (po-cj4s7)\n  fix(cli): reject invalid numeric flags and fail enrich on total fetch failure (po-cj4s7)\n  f\n[…]\nr help, exit codes, and secret masking (po-cj4s7)\n  fix(cli): enforce agent contract across all command groups (po-cj4s7)\n  feat(cliutil): shared help detection and usage-error exit helpers (po-cj4s7)",
          "is_bot": false,
          "headline": "merge: fix/agent-contract-bugs — uniform help, phantom flags removed,…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-02T03:50:00Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "db187e188872970e7ca214448ec8171829845f1b",
          "body": "… contracts (po-cj4s7)\n\nAdd space-form missing-value cases for scan/review, invalid numeric\nflag cases for stpa and knowledge (graph, graph-search, foresight,\nenrich) to TestUsageErrorContract, and a new test asserting\n'knowledge enrich' exits 1 when every fetch fails.",
          "is_bot": false,
          "headline": "test(cli): cover missing-value, bad-numeric, and enrich total-failure…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-02T03:43:47Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "73ddb2d59cf8592a4924194083a7f931f03e2ffe",
          "body": "… failure (po-cj4s7)\n\nReplace the seven remaining fmt.Sscanf flag parses (stpa list-ucas\n--limit; knowledge graph --depth; foresight --depth/--min-strength;\ngraph-search --limit/--depth; enrich --limit) with the strconv +\nExitUsage pattern already used in evidence list and incident search,\nso invali\n[…]\nPI key) instead of printing warnings and returning a\nfalse success; partial failures still warn and exit 0. Document the\ngraceful-degradation behavior in the README and root-help exit-code\nexceptions.",
          "is_bot": false,
          "headline": "fix(cli): reject invalid numeric flags and fail enrich on total fetch…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-02T03:43:40Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b0f45ebe0a6cdc1c4dcd96417e54b933b6f96f91",
          "body": "…po-cj4s7)\n\nAll 'requires a value' branches in scan (12 sites) and review (5 sites)\nexited 1, contradicting the documented contract (exit 2 = usage error)\nand, for 'rvl scan --local' / 'rvl review --enforce' CI gates, falsely\nsignaling a blocking finding. Route them through cliutil.ExitUsage,\nalong with review's --format text|json validation (same class).",
          "is_bot": false,
          "headline": "fix(cli): missing-flag-value usage errors exit 2 in scan and review (…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-02T03:43:30Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c83d24caaffbb04fb8039217c2bf02825bef3996",
          "body": "…o-cj4s7)",
          "is_bot": false,
          "headline": "docs(readme): document env-var auth and the CLI exit-code contract (p…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-02T03:26:03Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5e4c2c8ef4acbdb273f7f47c2bef075dfa8b6d4a",
          "body": "…d secret masking (po-cj4s7)\n\nBuilds the real binary and drives it with an isolated HOME and an\nunroutable API URL: help forms (--help/-h/help) for every group must\nexit 0 with usage on stdout and no config/network dependency; unknown\ncommands/flags and invalid arguments must exit 2 with a diagnostic on\nstderr; 'config set api_key' must never echo the plaintext key.",
          "is_bot": false,
          "headline": "test(cli): end-to-end agent-contract harness for help, exit codes, an…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-02T03:26:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f4a17e7f76cf162bc0618c63a25e07aacc725579",
          "body": "- Uniform help: every group (risk, incident, evidence, plugin, status,\n  scan, review, control, knowledge, stpa, config, completion, commands,\n  init, migrate, login, logout) handles help/-h/--help by printing usage\n  to stdout and exiting 0 with zero network calls. status --help no\n  longer runs th\n[…]\n; not-configured error now\n  mentions RVL_API_KEY for headless/CI use.\n- Secret echo: 'rvl config set api_key' echoes a masked value (first 8\n  chars + ... or [set]) instead of the full plaintext key.",
          "is_bot": false,
          "headline": "fix(cli): enforce agent contract across all command groups (po-cj4s7)",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-02T03:25:49Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9f36ab98889e5f1ec330f3f60bbe3d82d5ae08e2",
          "body": "…-cj4s7)\n\nNew leaf package used by every command dispatcher so help handling and\nusage errors behave identically: WantsHelp short-circuits before any\nconfig/network work, ExitUnknownFlag standardizes the unknown-flag\ndiagnostic, and the 0/1/2 exit-code convention is documented in one\nplace.",
          "is_bot": false,
          "headline": "feat(cliutil): shared help detection and usage-error exit helpers (po…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-02T03:25:33Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a3c964eff43cd2d48bec2cdc4b34d04f7c10e838",
          "body": "Review finding: rvl init's Step 3 called plugin.InstallPlugin, whose\npost-install step wrote the managed AGENTS.md block with yesAll=true\nbefore Step 4's 'AGENTS.md exists but has no Revelara section. Append?'\nprompt could fire. Users with an unmanaged AGENTS.md were never asked,\nthen saw a misleadi\n[…]\n\n  the --no-context-files notice moved to CmdPlugin where the flag is\n  parsed, so init's programmatic skip prints nothing misleading\n- TestInstallContextFiles_OptOut updated to assert the silent skip",
          "is_bot": false,
          "headline": "fix(init): keep init's AGENTS.md consent prompt authoritative (po-esuqh)",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-02T03:15:11Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "cd17cfbb9d77ff0433e2658f299c34398cdeaba7",
          "body": "…uqh)\n\nAmbient reach v2: the managed Revelara block is no longer Claude-only.\nrvl plugin install <editor> and install --all now write a marker-delimited\nAGENTS.md block (read natively by 23+ agent runtimes) into the enclosing\ngit repo for every editor; Claude Code additionally keeps its CLAUDE.md\nbl\n[…]\ns both\n  AGENTS.md and CLAUDE.md writes; documented in plugin usage text\n- outside a git repo the context-file step skips with a notice\n- README: note the AGENTS.md/CLAUDE.md behavior and opt-out flag",
          "is_bot": false,
          "headline": "feat(plugin): install managed AGENTS.md block for every editor (po-es…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-07-02T03:05:17Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e032f07295b209e5ec647b37e8d81b6dea1bb52b",
          "body": "…arch [po-frt6z] (#13)\n\nEpic po-7s368 (rvl-cli). KnowledgeSearchResult carries practice_class/consensus/\nsources (Polaris now returns them on /api/knowledge/search); the table render shows\n'Practice: BEST (settled) N source(s)'; --min-class=best|good|emerging filters to\ngraded items (passed as a query param). Fields are optional -> back-compat with older\nPolaris (no grade rendered, no error). --format=json passes the verdict fields\nstraight through for the scan/ask/fix skills.",
          "is_bot": false,
          "headline": "feat(knowledge): render practice grades + --min-class in knowledge se…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-06-29T22:22:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "66ace73a33cbc3dcb1351860f1a4a785ae19d415",
          "body": "…-theme\n\nfix(init): post cli_setup milestone + high-contrast prompt theme",
          "is_bot": false,
          "headline": "Merge pull request #12 from revelara-ai/fix/init-milestone-and-prompt…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-06-26T20:08:46Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ad6bc046778f86e191e3ae0307ba76da20ff562c",
          "body": "…c0, po-bs7jx)\n\npo-vfzc0: rvl init posted onboarding milestone 'cli_init', which the API rejected as invalid, so the 'Set up the Revelara CLI' onboarding step never auto-completed. Post 'cli_setup' (the name the backend tracks) instead. po-bs7jx: huh's default ThemeCharm renders the focused button as near-white on fuchsia (low contrast). Apply a shared high-contrast theme (ThemeBase16 + black-on-light-gray focused button) to every interactive prompt in init.",
          "is_bot": false,
          "headline": "fix(init): post cli_setup milestone and raise prompt contrast (po-vfz…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-06-26T17:21:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "04aca3c1550bd203bee62ecea32ce90243b58d8a",
          "body": "fix(release): migrate archives.format to formats list",
          "is_bot": false,
          "headline": "Merge pull request #11 from revelara-ai/fix/goreleaser-archives-formats",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-06-23T22:45:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "191f39baaf5aabe756c3ad401ee9a489cd0bec94",
          "body": "goreleaser check flagged the existing `archives.format` and\n`format_overrides.format` as deprecated (renamed to list-valued `formats`).\nUnrelated to the homebrew_casks addition but it fails `goreleaser check`, so\nfix it here to keep the validation gate green before tagging.",
          "is_bot": false,
          "headline": "fix(release): migrate archives.format to formats list",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-06-23T22:44:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "21edf6c3ba15be3f81c8b2a413f464b57f71b1a6",
          "body": "feat(release): distribute rvl via Homebrew tap",
          "is_bot": false,
          "headline": "Merge pull request #10 from revelara-ai/feat/homebrew-distribution",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-06-23T22:32:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "fc7f686f4ac4fa52302ee6f09244111c20ef60a6",
          "body": "Add a `brew install revelara-ai/tap/rvl` path so users no longer need a Go\ntoolchain to install the CLI (po-8lawk; follows signup feedback po-qsnul).\n\n- .goreleaser.yml: add a homebrew_casks block targeting revelara-ai/homebrew-tap.\n  Uses casks (the brews/formula path is deprecated as of goreleaser\n[…]\n.\n- README: lead with the Homebrew install path.\n\nRequires a HOMEBREW_TAP_TOKEN secret (PAT with contents:write on the tap repo)\nbefore the next tag. Validate with `goreleaser check` prior to tagging.",
          "is_bot": false,
          "headline": "feat(release): distribute rvl via Homebrew tap",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-06-23T22:30:09Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "fd8c8837ad6c6d2c17808d98461c9dc14f3ddc1a",
          "body": "Fire-and-forget POST to /api/v1/onboarding/milestone with {\"milestone\":\"cli_init\"}\nat the end of a successful init flow. Only fires when credentials are configured;\nsilently discards errors so the user is never blocked on a telemetry call.",
          "is_bot": false,
          "headline": "feat(init): post cli_init milestone after successful rvl init",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-05-30T20:00:37Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "57ba347799686b62ec18030ba562bf683eb4a14e",
          "body": "…minology",
          "is_bot": false,
          "headline": "docs(cli): rewrite README and AGENTS with current skill names and ter…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-05-30T19:11:20Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9600d715d0572fc0fa16ae2f1154b758ae88146f",
          "body": "B1: Replace prescriptive \"run git init\" with explanation of why git is needed.\nB2: Add component explanation before the \"add components manually?\" prompt;\n    relabel choices and add path example guidance.\nB3: Propagate huh.ErrUserAborted through buildProjectConfig so Ctrl-C prints\n    \"Cancelled. N\n[…]\n, manager, and auth (struct/function names unchanged).\nB6: Replace all /rvl:detect-risks references with /rvl:scan in init.go,\n    AGENTS.md, README.md, docs/quickstart.md, and project config comment.",
          "is_bot": false,
          "headline": "fix(cli): reduce onboarding friction across 6 reported issues",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-05-30T18:43:53Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f9c7a46e5a3171bf1b6854a971823e11c2722c4d",
          "body": "context, show, and resolve commands now detect CR-XXX codes and route\nto /api/v1/compound-risks instead of /api/v1/risks, which rejected\nCR-XXX with a 400 validation error.\n\n- isCompoundCode() helper detects CR- prefix\n- fetchCompoundRiskDetail() resolves CR-XXX to UUID via list endpoint,\n  then fet\n[…]\numan-readable output shows triggering rule, rationale, and constituent\n  risk table with codes, scores, controls, and titles\n- --format=json emits the raw compound detail payload (rule + constituents)",
          "is_bot": false,
          "headline": "feat(risk): add compound risk support for CR-XXX codes",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-05-30T05:02:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9edf0ecec1ef6df689db2865cd9cb2d72731e668",
          "body": "…us, --limit, --format\n\nrvl risk list/ready only parsed --flag value (space form). The rvl:risks\nskill emits --service=${SERVICE} which the shell expands to --service=crawler\nas a single token — silently ignored, returning all risks regardless of\nservice. Fixed CmdRiskList and CmdRiskReady to accept both forms.",
          "is_bot": false,
          "headline": "fix(risk): accept --flag=value form for --service, --category, --stat…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-05-30T00:24:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4de8f9149dc15f242238a14549a8f5225c84b6ae",
          "body": "DeduplicateFindings keyed on {Slug, Evidence[0].Path, LineNumber}.\nLLM-generated findings from --scan-dir carry no Slug, so every finding\nresolved to the same key {\"\",\"\",0} and the entire batch collapsed to the\nsingle highest-scored winner. A 62-finding crawler scan became 1 risk.\n\nThe regression wa\n[…]\non) but broken for AI agent findings (Slug is always\nempty string).\n\nFix: slugOrTitle() returns Slug when set, falls back to Title. The dedup\nkey, tiebreak comparator, and comment updated accordingly.",
          "is_bot": false,
          "headline": "fix(scanner): use Title as dedup key fallback when Slug is empty",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-05-29T03:27:19Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5359c2e19e22f866cb47c68ce013e020ecf0eddc",
          "body": "Claude Code's `plugin install` creates a new versioned directory each time\nbut never removes old ones. Stale directories accumulate and can confuse\nskill loading (old scan.md, old agent definitions alongside the current ones).\n\nAdd pruneOldCacheVersions() which runs after a successful `claude plugin install`.\nIt reads installed_plugins.json to find the active installPath, then removes all\nsibling version directories that don't match.",
          "is_bot": false,
          "headline": "fix(plugin): prune stale versioned cache dirs after install",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-05-29T00:21:20Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "49bf30a2c791854416f9fda4953083d494462031",
          "body": "F001a: require X-Checksum header; reject plugin if absent unless\nRVL_ALLOW_MISSING_CHECKSUM=1 is set.\n\nF001b: treat 404 on signing-key endpoint as a hard error; reject\nplugin installation unless RVL_ALLOW_UNSIGNED_PLUGIN=1 is set.\n\nF003: honour RVL_SKIP_MIGRATION=1 env var to suppress auto-migration\nin CI and multi-tenant environments.\n\nF005: add -- separator before user-supplied git refs in exec.Command\ncalls; reject refs starting with - in reachability checks.",
          "is_bot": false,
          "headline": "fix(security): fail-closed plugin integrity checks and git arg hardening",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-05-27T20:33:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ed67263cec8a8500a16506ad5dce1138ccdc2d43",
          "body": "- SECURITY.md: vulnerability disclosure policy with contact, scope, and SLA\n- .github/CODEOWNERS: @josebiro owns all files\n- .goreleaser.yml: add sboms block for CycloneDX SBOM via syft\n- release.yml: add id-token permission, syft installer, cosign install\n  and sign-blob step to publish checksums.txt.sig with each release",
          "is_bot": false,
          "headline": "chore(security): add SECURITY.md, CODEOWNERS, cosign signing, and SBOM",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-05-27T20:31:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9ab5da5ddb7cb24e200d56d052d193cd29d070ae",
          "body": "Update LICENSE licensor from Relynce LLC to Revelara AI LLC and\nlicensing contact from licensing@relynce.com to licensing@revelara.ai.\n\nRename internal identifiers that used Relynce as a name (rewriteRelynceAPIURL ->\nrewriteLegacyAPIURL, relynceDir/relyncePath -> legacyRelynceDir/legacyRelyncePath)\n\n[…]\nRelynce heading check from init.go.\n\nMigration string literals (.relynce/, api.relynce.ai, .relynce.yaml) are unchanged\nas they are the source patterns the migration logic reads from old user configs.",
          "is_bot": false,
          "headline": "chore: rename Relynce LLC to Revelara AI LLC",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-05-27T19:21:40Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "033beb084c83e2c316400b9e5b8be3eee5bff43d",
          "body": "po-ta8wj.1: digest.compact compact project memory format\n- New internal/project/memory.go: ReadDigest/AppendDigest/DismissedSlugs/EntrypointFromDigest\n  Supports RISK, WAIVER, PATTERN, ENTRYPOINT, SCAN line types; rotates at 200 lines\n  (drops oldest RISK/WAIVER by YYYY-MM meta); atomic write via te\n[…]\nafter mergeScanDir via JSON\n  round-trip; logs \"scanner: deduplicated N cross-agent duplicates\" when any dedup occurs\n- group_test.go: 7 new tests including 10-findings/3-pairs->7 acceptance criterion",
          "is_bot": false,
          "headline": "feat(scan): digest.compact project memory + DeduplicateFindings",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-05-25T19:06:58Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "219b0a683564bef73697b167929b87e8738f6178",
          "body": "New subcommand: rvl incident search <query> [--limit=N] [--format=table|json]\n\nCalls GET /api/v1/incidents/search and renders results as a table showing\nshort_name, relevance score, severity, title, and source URL. Supports\n--format=json for machine-readable output in scan skill pipelines.\n\nCloses po-9o0w1",
          "is_bot": false,
          "headline": "feat(incident): add rvl incident search command",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-05-20T15:26:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "086b11afd94cf0c8fca8b1f316c2d4744eb832d8",
          "body": "…ed error message",
          "is_bot": false,
          "headline": "fix(po-izrmz): correct 'rely login' typo to 'rvl login' in unconfigur…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-05-19T23:16:11Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0e347bf270e9b12a7c879ce5039ee07c59a67ae9",
          "body": "…gent-json + stderr fixes\n\n- FetchSigningKey now returns (ed25519.PublicKey, error): 404 = skip (nil,nil),\n  network/decode errors = fail-closed (nil, err); InstallPlugin propagates the\n  error instead of silently bypassing verification\n- ListInstalledAgents writes {\"agents\":[]} to stdout + diagnost\n[…]\n when --json is set and the agents dir is unreadable,\n  so scan.md can fall back to its static lens catalog\n- CmdStatus update notices moved to os.Stderr so rvl status --json pipes remain\n  valid JSON",
          "is_bot": false,
          "headline": "fix(po-ciy8h,po-3fdmy,po-zf2nq,po-9m2g0): J35 rvl-cli signing-key + a…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-05-19T19:14:52Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8a04d1a6684f29a6278dcad101d4f501e513eaf8",
          "body": "--json now outputs the full updated Risk object returned by POST /resolve.\nHuman output prints Status and ResolvedAt. Previously the response body was\ndiscarded and --json silently emitted nothing.",
          "is_bot": false,
          "headline": "fix(po-28vc1): CmdRiskResolve captures and emits server response",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-05-19T17:58:46Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "41540a9baba2e81ee22f11238224108938d3e866",
          "body": "- po-8n7wp: add --format=json to evidence submit/list/verify; raw JSON path matches /rvl:fix consumption pattern\n- po-b7ckw: fix --status enum in list help (pending/rejected -> not_configured/configured/sample/verified); add client-side validation that exits 1 on unknown value\n- po-mzewn: add UpdatedAt and OrganizationID fields to EvidenceItem struct to match spec",
          "is_bot": false,
          "headline": "fix(po-8n7wp,po-b7ckw,po-mzewn): J33 evidence CLI fixes",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-05-19T16:42:03Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a4e552fb3120b1f566c5e86d784cd2885ab9ab62",
          "body": "…hardening\n\nFive J32 CLI fixes on the rvl knowledge subcommands:\n\n- po-x7pk0 (correctness): `rvl knowledge procedures --control=RC-XXX`\n  used to fall back to the unfiltered query result when the\n  control-side filter matched zero procedures. Slash commands saw\n  arbitrary procedures surface as reme\n[…]\ning zero.\n\nRemaining knowledge subcommands (graph, graph-search, health, enrich)\nwill pick up --format=json in a follow-up; this commit covers the\nJ32 critical path consumed by /rvl:scan and /rvl:fix.",
          "is_bot": false,
          "headline": "fix(po-x7pk0,po-ukfmt,po-4xrz5,po-0704c,po-8eld4): rvl knowledge CLI …",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-05-19T14:13:13Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b2da48bfb65774b54d479d1f37fe293a0d63878e",
          "body": "…how CLI gaps\n\nFive J31 CLI bugs:\n\n- po-81w0v: --format=json was advertised but parsed nowhere. Both list\n  and show now accept --format=<value> (and --format=json) and emit\n  the raw server body for jq-driven slash-command pipelines.\n\n- po-g5b3w: default list limit was 50, which silently truncated \n[…]\np the spec-required\nfields the prior struct dropped (J30 po-6wrlt analog).\n\n--limit now hard-fails on non-numeric input instead of silently\ndefaulting to the previous value (parseInt -> strconv.Atoi).",
          "is_bot": false,
          "headline": "fix(po-81w0v,po-g5b3w,po-iks58,po-trn0m,po-f3dqm): rvl control list/s…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-05-19T04:01:29Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "544d7642d786086d096a5b2a8db5eed4e22d4e85",
          "body": "…olish\n\nFive remaining J30 CLI gaps:\n\n- po-2msnd: query strings built via fmt.Sprintf concatenation —\n  service names with '&' or '=' could smuggle extra query params.\n  Switched to net/url.Values.Encode().\n\n- po-eedub: CmdRiskReady silently truncated when the tenant had\n  >1000 risks. Two fixes: (a\n[…]\n future paginated table renderer can use the server's effective\n  values.\n\nAlso adds CmdRiskList an end-of-output truncation note when total\nexceeds the returned page, matching the new ready behavior.",
          "is_bot": false,
          "headline": "fix(po-2msnd,po-eedub,po-9a07e,po-hu71i,po-6wrlt): risk-command CLI p…",
          "author_name": "Joseph Bironas",
          "author_login": "josebiro",
          "committed_at": "2026-05-19T01:17:00Z",
          "body_truncated": true,
          "is_coding_agent": false
        }
      ],
      "releases_count": 61,
      "commits_last_year": 252,
      "latest_release_at": "2026-07-25T07:41:02Z",
      "latest_release_tag": "v0.10.1",
      "releases_from_tags": false,
      "days_since_last_push": 1,
      "active_weeks_last_year": 20,
      "days_since_latest_release": 2,
      "mean_days_between_releases": 2.8
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": false,
      "health_percentage": 50,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "github.com/revelara-ai/rvl-cli",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": true,
          "registry_url": "https://pkg.go.dev/github.com/revelara-ai/rvl-cli",
          "is_deprecated": false,
          "latest_version": "v0.10.1",
          "repository_url": "https://github.com/revelara-ai/rvl-cli",
          "versions_count": 61,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-25T07:34:14Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 2
        }
      ]
    },
    "popularity": {
      "forks": 0,
      "stars": 1,
      "watchers": 0,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 0
      },
      "star_history": null,
      "open_issues_and_prs": 0
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [],
      "has_llms_txt": false,
      "has_dockerfile": false,
      "has_mcp_signal": false,
      "bootstrap_files": [
        "Makefile"
      ],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [
        "go.mod"
      ],
      "largest_source_bytes": 52218,
      "source_files_sampled": 101,
      "oversized_source_files": 0,
      "agent_instruction_files": [
        "AGENTS.md"
      ],
      "agent_instruction_max_bytes": 986
    },
    "dependencies": {
      "manifests": [
        "go.mod"
      ],
      "advisories": {
        "error": null,
        "scope": "repository_graph",
        "source": "osv",
        "findings": [
          {
            "name": "golang.org/x/text",
            "direct": true,
            "version": "v0.37.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5970"
            ],
            "fixed_version": "0.39.0",
            "advisory_count": 1,
            "oldest_advisory_days": 13
          },
          {
            "name": "github.com/yuin/goldmark",
            "direct": false,
            "version": "v1.7.13",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5320"
            ],
            "fixed_version": "1.7.17",
            "advisory_count": 1,
            "oldest_advisory_days": 20
          },
          {
            "name": "golang.org/x/net",
            "direct": false,
            "version": "v0.55.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5942"
            ],
            "fixed_version": "0.56.0",
            "advisory_count": 1,
            "oldest_advisory_days": 13
          }
        ],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {
          "unknown": 3
        },
        "advisory_count": 3,
        "affected_count": 3,
        "assessed_count": 40,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 0,
        "direct_affected_count": 1
      },
      "ecosystems": [
        "go"
      ],
      "dependencies": [
        {
          "name": "github.com/charmbracelet/glamour",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.0"
        },
        {
          "name": "github.com/charmbracelet/huh",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.8.0"
        },
        {
          "name": "github.com/charmbracelet/lipgloss",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.1-0.20250404203927-76690c660834"
        },
        {
          "name": "golang.org/x/term",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.43.0"
        },
        {
          "name": "golang.org/x/text",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.37.0"
        },
        {
          "name": "gopkg.in/yaml.v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.0.1"
        }
      ],
      "all_dependencies": {
        "error": null,
        "source": "github-sbom",
        "packages": [
          {
            "name": "github.com/charmbracelet/glamour",
            "direct": true,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/huh",
            "direct": true,
            "version": "v0.8.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/lipgloss",
            "direct": true,
            "version": "v1.1.1-0.20250404203927-76690c660834",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/term",
            "direct": true,
            "version": "v0.43.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/text",
            "direct": true,
            "version": "v0.37.0",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/yaml.v3",
            "direct": true,
            "version": "v3.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/alecthomas/chroma/v2",
            "direct": false,
            "version": "v2.20.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/atotto/clipboard",
            "direct": false,
            "version": "v0.1.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aymanbagabas/go-osc52/v2",
            "direct": false,
            "version": "v2.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aymerick/douceur",
            "direct": false,
            "version": "v0.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/catppuccin/go",
            "direct": false,
            "version": "v0.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/bubbles",
            "direct": false,
            "version": "v0.21.1-0.20250623103423-23b8fd6302d7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/bubbletea",
            "direct": false,
            "version": "v1.3.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/colorprofile",
            "direct": false,
            "version": "v0.2.3-0.20250311203215-f60798e515dc",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/x/ansi",
            "direct": false,
            "version": "v0.10.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/x/cellbuf",
            "direct": false,
            "version": "v0.0.13",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/x/exp/slice",
            "direct": false,
            "version": "v0.0.0-20250327172914-2fdc97757edf",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/x/exp/strings",
            "direct": false,
            "version": "v0.0.0-20240722160745-212f7b056ed0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/x/term",
            "direct": false,
            "version": "v0.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/dlclark/regexp2",
            "direct": false,
            "version": "v1.11.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/dustin/go-humanize",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/erikgeiser/coninput",
            "direct": false,
            "version": "v0.0.0-20211004153227-1c3628e74d0f",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gorilla/css",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/lucasb-eyer/go-colorful",
            "direct": false,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-isatty",
            "direct": false,
            "version": "v0.0.20",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-localereader",
            "direct": false,
            "version": "v0.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-runewidth",
            "direct": false,
            "version": "v0.0.17",
            "ecosystem": "go"
          },
          {
            "name": "github.com/microcosm-cc/bluemonday",
            "direct": false,
            "version": "v1.0.27",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mitchellh/hashstructure/v2",
            "direct": false,
            "version": "v2.0.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/muesli/ansi",
            "direct": false,
            "version": "v0.0.0-20230316100256-276c6243b2f6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/muesli/cancelreader",
            "direct": false,
            "version": "v0.2.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/muesli/reflow",
            "direct": false,
            "version": "v0.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/muesli/termenv",
            "direct": false,
            "version": "v0.16.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/rivo/uniseg",
            "direct": false,
            "version": "v0.4.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xo/terminfo",
            "direct": false,
            "version": "v0.0.0-20220910002029-abceb7e1c41e",
            "ecosystem": "go"
          },
          {
            "name": "github.com/yuin/goldmark",
            "direct": false,
            "version": "v1.7.13",
            "ecosystem": "go"
          },
          {
            "name": "github.com/yuin/goldmark-emoji",
            "direct": false,
            "version": "v1.0.6",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/net",
            "direct": false,
            "version": "v0.55.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sync",
            "direct": false,
            "version": "v0.20.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sys",
            "direct": false,
            "version": "v0.45.0",
            "ecosystem": "go"
          }
        ],
        "collected": true,
        "truncated": false,
        "total_count": 40,
        "direct_count": 6,
        "indirect_count": 34
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 31,
        "open_issues": 0,
        "closed_ratio": 1,
        "closed_issues": 1,
        "closed_unmerged_prs": 0
      },
      "bus_factor": 1,
      "bot_contributors": 1,
      "top_contributors": [
        {
          "type": "User",
          "login": "josebiro",
          "commits": 251,
          "avatar_url": "https://avatars.githubusercontent.com/u/1455144?v=4"
        }
      ],
      "contributors_sampled": 1,
      "top_contributor_share": 1
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "release.yml"
      ],
      "has_docs_dir": true,
      "linter_configs": [
        ".golangci.yml"
      ],
      "has_editorconfig": false,
      "has_linter_config": true,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "go.sum"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 4,
            "reason": "branch protection is not maximal on development and all release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 0,
            "reason": "0 out of 5 merged PRs checked by a CI test -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/5 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 0,
            "reason": "project has 0 contributing companies or organizations -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 10,
            "reason": "update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 10,
            "reason": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": 10,
            "reason": "packaging workflow detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 0,
            "reason": "dependency not pinned by hash detected -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "SAST tool is not run on all commits -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 10,
            "reason": "security policy file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": 8,
            "reason": "5 out of the last 5 releases have a total of 5 signed artifacts.",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 7,
            "reason": "3 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "efd80b3373eae6b47ec7005e5b9eda2037203491",
        "ran_at": "2026-07-28T03:21:22Z",
        "aggregate_score": 5.6,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": true,
      "has_dependabot_config": true
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-26T07:10:48Z",
      "oldest_open_prs": [],
      "last_merged_pr_at": "2026-07-26T07:10:47Z",
      "ci_last_conclusion": null,
      "oldest_open_issues": []
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/revelara-ai/rvl-cli",
    "host": "github.com",
    "name": "rvl-cli",
    "owner": "revelara-ai"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "moderate",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 62,
      "inputs": {
        "security": 63,
        "vitality": 86,
        "community": 24,
        "governance": 53,
        "engineering": 78
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "excellent",
        "name": "Vitality",
        "value": 86,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "good",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 78,
            "inputs": {
              "commits_last_year": 252,
              "human_commit_share": 0.99,
              "days_since_last_push": 1,
              "active_weeks_last_year": 20
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 1 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 1
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "20/52 weeks with commits",
                "points": 13.8,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 20
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "252 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 252
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": null,
            "notes": [],
            "value": 98,
            "inputs": {
              "releases_count": 61,
              "latest_release_tag": "v0.10.1",
              "releases_from_tags": false,
              "days_since_latest_release": 2,
              "mean_days_between_releases": 2.8
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "61 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 61
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 2 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 2
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~2.8 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 2.8
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "5 out of the last 5 releases have a total of 5 signed artifacts.",
                "points": 8,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "critical",
        "name": "Community & Adoption",
        "value": 24,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 1,
            "inputs": {
              "forks": 0,
              "stars": 1,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "1 stars",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "0 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "moderate",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 50,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": false,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (Apache-2.0)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "Apache-2.0"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "moderate",
        "name": "Sustainability & Governance",
        "value": 53,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 10,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 1,
              "top_contributor_share": 1
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 100% of commits",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 100
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "1 contributors",
                "points": 1.4,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 0 contributing companies or organizations -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "excellent",
            "name": "Issue & PR responsiveness",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "merged_prs": 31,
              "open_issues": 0,
              "closed_issues": 1,
              "issue_closed_ratio": 1,
              "closed_unmerged_prs": 0
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "100% of issues closed",
                "points": 46.8,
                "status": "met",
                "details": [
                  {
                    "code": "issues_closed_share",
                    "params": {
                      "share": 100
                    }
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "31/31 decided PRs merged",
                "points": 38.2,
                "status": "met",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 31,
                      "decided": 31
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/5 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "at_risk",
            "name": "Ownership & stewardship",
            "note": null,
            "notes": [],
            "value": 36,
            "inputs": {
              "followers": 0,
              "owner_type": "Organization",
              "is_verified": null,
              "owner_login": "revelara-ai",
              "public_repos": 4,
              "account_age_days": 159
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "organization-owned",
                "points": 30,
                "status": "met",
                "details": [
                  {
                    "code": "owner_organization",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "0 followers of revelara-ai",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 0,
                      "login": "revelara-ai"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "4 public repos, account ~0 yr old",
                "points": 6,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 4
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 0
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "github.com/revelara-ai/rvl-cli"
              ],
              "ecosystems": "go",
              "any_deprecated": false,
              "min_days_since_publish": 2
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on go",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "go"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 2 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 2
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "61 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 61
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "good",
        "name": "Engineering Quality",
        "value": 78,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "moderate",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 64,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": true,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "1 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": ".golangci.yml",
                "points": 16,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yml"
                    }
                  }
                ],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "0 out of 5 merged PRs checked by a CI test -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "excellent",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "topics": [
                "reliability",
                "reliability-engineering",
                "software-design",
                "software-development",
                "software-engineering",
                "sre",
                "ai",
                "ai-agents",
                "ai-tools",
                "resilience"
              ],
              "has_wiki": true,
              "homepage": "https://revelara.ai",
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": "https://revelara.ai",
                "points": 15,
                "status": "met",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": "10 topics",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "topics_count",
                    "params": {
                      "count": 10
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "moderate",
        "name": "Security",
        "value": 63,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "moderate",
            "name": "Security posture",
            "note": null,
            "notes": [],
            "value": 56,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 18,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 0,
              "scorecard_aggregate": 5.6
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection is not maximal on development and all release branches",
                "points": 3,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "0 out of 5 merged PRs checked by a CI test -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/5 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 0 contributing companies or organizations -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "update tool detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool is not run on all commits -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "5 out of the last 5 releases have a total of 5 signed artifacts.",
                "points": 6,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "3 existing vulnerabilities detected",
                "points": 5.2,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "excellent",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories. Remaining weights renormalized. Matched 40 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "indirect_dependencies_free_of_known_advisories"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_repository",
                "params": {
                  "assessed": 40
                }
              },
              {
                "code": "advisories_repo_graph_caveat",
                "params": {}
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 89,
            "inputs": {
              "source": "osv",
              "advisories": 3,
              "affected_packages": 3,
              "assessed_packages": 40,
              "unassessed_packages": 0,
              "affected_by_severity": "unknown 3",
              "direct_affected_packages": 1
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "1 affected: golang.org/x/text v0.37.0 (unknown)",
                "points": 26.6,
                "status": "partial",
                "details": [
                  {
                    "code": "advisories_affected",
                    "params": {
                      "count": 1,
                      "packages": "golang.org/x/text v0.37.0 (unknown)"
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "transitive set not separable from development and test dependencies in this scope",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_scope_not_separable",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory has been public longer than 90 days",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "advisories_none_stale",
                    "params": {
                      "days": 90
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 40,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 2
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "excellent",
        "name": "AI Readiness",
        "value": 85,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "excellent",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 1,
              "agent_instruction_files": [
                "AGENTS.md"
              ],
              "agent_instruction_max_bytes": 986
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "AGENTS.md",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "AGENTS.md"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "99 of 99 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 99,
                      "sampled": 99
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "good",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 80,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "go.sum"
              ],
              "has_dockerfile": false,
              "typed_language": true,
              "bootstrap_files": [
                "Makefile"
              ],
              "has_devcontainer": false,
              "has_linter_config": true,
              "typecheck_configs": [],
              "agent_commit_share": 0,
              "toolchain_manifests": [
                "go.mod"
              ],
              "dependency_bot_commit_share": 0.01
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "Makefile",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Makefile"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": ".golangci.yml",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yml"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "Go (statically typed)",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "no agent-authored commits among the last 100",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_authored_commits",
                    "params": {
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "1 of the last 100 commits are automated dependency updates",
                "points": 8,
                "status": "met",
                "details": [
                  {
                    "code": "dependency_bot_commits",
                    "params": {
                      "count": 1,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "Go",
              "largest_source_bytes": 52218,
              "source_files_sampled": 101,
              "oversized_source_files": 0
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Go (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "0/101 source files over 60KB",
                "points": 55,
                "status": "met",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 101,
                      "oversized": 0
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-28T03:21:37.081493Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/r/revelara-ai/rvl-cli.svg",
  "full_name": "revelara-ai/rvl-cli",
  "license_state": "standard",
  "license_spdx": "Apache-2.0"
}