tombaldwin / candor-ts

No fue posible recopilar el conjunto de dependencias resuelto para este informe: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository

Instalar npm:candor-ts@0.23.1 arrastra 3 paquetes, directos y transitivos: 0 tienen avisos conocidos, de los cuales 0 son dependencias directas.

Ningún aviso conocido afecta a las dependencias evaluadas.

Un aviso significa que la versión registrada en el grafo de dependencias cae dentro del rango afectado de un aviso. No se analiza la alcanzabilidad, y el grafo incluye fijaciones de desarrollo y prueba: un hallazgo puede referirse al utillaje y no al software distribuido.

{
  "data": {
    "repo": {
      "topics": [],
      "is_fork": false,
      "size_kb": 920,
      "has_wiki": true,
      "homepage": "https://candor.poly.io",
      "languages": {
        "Shell": 11813,
        "JavaScript": 1163197,
        "TypeScript": 4624
      },
      "pushed_at": "2026-07-26T10:28:43Z",
      "created_at": "2026-06-11T09:09:09Z",
      "owner_type": "User",
      "updated_at": "2026-07-26T10:28:47Z",
      "description": "TypeScript slice of candor-spec — the derivability proof: written from the spec alone, 20/20 on the shared conformance oracle.",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "Apache-2.0",
      "default_branch": "main",
      "license_spdx_raw": "Apache-2.0",
      "primary_language": "JavaScript",
      "significant_languages": [
        "JavaScript"
      ]
    },
    "owner": {
      "blog": "https://www.poly.io/",
      "name": "Tom Baldwin",
      "type": "User",
      "login": "tombaldwin",
      "company": "Polymorphism @polyhub ",
      "location": "Sheffield UK",
      "followers": 4,
      "avatar_url": "https://avatars.githubusercontent.com/u/1909530?v=4",
      "created_at": "2012-06-30T19:25:55Z",
      "is_verified": null,
      "public_repos": 20,
      "account_age_days": 5138
    },
    "license": {
      "state": "standard",
      "spdx_id": "Apache-2.0",
      "raw_spdx": "Apache-2.0",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.23.0",
          "kind": "minor",
          "published_at": "2026-07-20T08:54:07Z"
        },
        {
          "tag": "v0.21.0",
          "kind": "minor",
          "published_at": "2026-07-17T14:57:31Z"
        },
        {
          "tag": "v0.20.1",
          "kind": "patch",
          "published_at": "2026-07-17T13:21:43Z"
        },
        {
          "tag": "v0.20.0",
          "kind": "minor",
          "published_at": "2026-07-17T12:58:28Z"
        },
        {
          "tag": "v0.19.0",
          "kind": "minor",
          "published_at": "2026-07-17T09:23:32Z"
        },
        {
          "tag": "v0.18.0",
          "kind": "minor",
          "published_at": "2026-07-16T19:53:47Z"
        },
        {
          "tag": "v0.17.0",
          "kind": "minor",
          "published_at": "2026-07-16T16:19:24Z"
        },
        {
          "tag": "v0.16.0",
          "kind": "minor",
          "published_at": "2026-07-16T08:46:49Z"
        },
        {
          "tag": "v0.15.0",
          "kind": "minor",
          "published_at": "2026-07-15T11:26:48Z"
        },
        {
          "tag": "v0.14.1",
          "kind": "patch",
          "published_at": "2026-07-14T21:54:57Z"
        },
        {
          "tag": "v0.14.0",
          "kind": "minor",
          "published_at": "2026-07-14T21:07:53Z"
        },
        {
          "tag": "v0.13.0",
          "kind": "minor",
          "published_at": "2026-07-14T19:21:35Z"
        },
        {
          "tag": "v0.12.0",
          "kind": "minor",
          "published_at": "2026-07-14T00:18:14Z"
        },
        {
          "tag": "v0.11.0",
          "kind": "minor",
          "published_at": "2026-07-13T14:22:55Z"
        },
        {
          "tag": "v0.5.12",
          "kind": "patch",
          "published_at": "2026-06-16T20:39:45Z"
        },
        {
          "tag": "v0.5.11",
          "kind": "patch",
          "published_at": "2026-06-16T20:08:17Z"
        },
        {
          "tag": "v0.5.10",
          "kind": "patch",
          "published_at": "2026-06-16T19:11:48Z"
        },
        {
          "tag": "v0.5.9",
          "kind": "patch",
          "published_at": "2026-06-16T18:11:46Z"
        },
        {
          "tag": "v0.5.8",
          "kind": "patch",
          "published_at": "2026-06-16T17:17:33Z"
        },
        {
          "tag": "v0.5.7",
          "kind": "patch",
          "published_at": "2026-06-16T15:43:14Z"
        },
        {
          "tag": "v0.5.6",
          "kind": "patch",
          "published_at": "2026-06-16T13:31:52Z"
        },
        {
          "tag": "v0.5.5",
          "kind": "patch",
          "published_at": "2026-06-15T19:48:00Z"
        },
        {
          "tag": "v0.5.4",
          "kind": "patch",
          "published_at": "2026-06-15T19:33:58Z"
        },
        {
          "tag": "v0.5.3",
          "kind": "patch",
          "published_at": "2026-06-15T18:17:27Z"
        },
        {
          "tag": "v0.5.2",
          "kind": "patch",
          "published_at": "2026-06-15T16:25:26Z"
        },
        {
          "tag": "v0.5.1",
          "kind": "patch",
          "published_at": "2026-06-15T14:18:11Z"
        },
        {
          "tag": "v0.5.0",
          "kind": "minor",
          "published_at": "2026-06-15T12:58:23Z"
        },
        {
          "tag": "v0.4.2",
          "kind": "patch",
          "published_at": "2026-06-12T15:35:13Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "c08063a8c17bb39f7e2b0858ee21251077ad00eb",
          "body": "8ee89f5 fixed an over-charge by moving the by-reference dependency charge BELOW\n`if (argIdx !== 0) return;`. Auditing my own fix for the other direction found it\nhad introduced a miss:\n\n    p.then(onOk, onErr)     // onErr performs Fs, and then() DOES invoke it\n      8ee89f5^   ['Fs']\n      8ee89f5 \n[…]\n\nthis precise one.\n\n653 tests, eslint clean, four-way conformance 26/0.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "scan: then() invokes its SECOND callback — the position rule is per-HOF",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-26T10:12:58Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "8ee89f515cf0ef6876531d80d38430d68b20e9f5",
          "body": "75ec3f6 added the by-reference dependency charge and placed it fifteen lines\nabove `if (argIdx !== 0) return;`, returning early — so it fired at EVERY\nargument index, not only the callback slot.\n\n    dep report:  seedy ['Fs']\n    app:         xs.forEach(logIt, seedy)      // seedy is thisArg — never\n[…]\nHOF never invokes.\n\n652 tests, eslint clean, four-way conformance 26/0.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "scan: the by-reference dep charge ran ABOVE the position guard it needed",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-26T08:59:07Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "dbed2b9b56809e1207238f896655430755b98519",
          "body": "The gate pins the engine by the sha256 of its LIVE .mjs sources, so a mismatch is\nthe EXPECTED state on any working checkout — every landed fix moves the hash, and\nthis session moved it four times. The abort said \"got X, want Y (FROZEN.md)\" and\nstopped there, leaving a reproducer to go hunting for w\n[…]\nrce hash that\ndrifts loudly beats a stored binary that drifts silently.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "confirmatory: the freeze-gate abort now carries its remedy",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-26T04:53:58Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "420e715fcfab24c0a9f2ce10287f8909ecf683d0",
          "body": "…claim\n\ncandor-spec DEP-RECEIVER-TYPING-DESIGN.md, half 1. When a call into a chained\ndependency finds no entry that means one of two things, and the engine drew no\ndistinction:\n\n  keyed-and-missed      the key names a BODY the dep scanned (`declare class C\n                        { m() }`, `declare\n[…]\nnce OK (PART 21 now runs the ts arm — and DIVERGEs on a reverted scan).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "scan: a chained lookup that could never be answered read as a purity …",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-26T03:37:36Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "8eba3afb2c4ca0079d340acadccce66ca0802657",
          "body": "Records the wave as one Unreleased entry: what died at the boundary, why the\ninformation was already present, the rust template each fix follows, and the A/B\nnumbers both unchained (0 gains / 0 losses / 166 invisible gains) and chained\n(7 effect gains / 0 losses, all traced to one dependency constru\n[…]\n scan may now attribute effects to functions that previously\nread pure.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "CHANGELOG: the scan-boundary vein, four ts mechanisms closed",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-26T00:16:54Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "75ec3f60540c6eddd11601ca7836252b588c2ac2",
          "body": "`xs.forEach(depWrite)` / `setTimeout(depWrite, 0)`: the HOF invokes it, so the\ndependency's effects are reachable at the call site. The reference got neither an\nedge (there is no local unit) nor an Unknown nor a disclosure — nothing at all,\non BOTH sides of the scan boundary.\n\nThe suppression was de\n[…]\nnd sensitivity\n(8/8 disclosure, 8/8 oracle recall) green; eslint clean.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "scan: a DEP function passed BY REFERENCE to a HOF was silent-pure",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-26T00:12:12Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "965ac823817b6c6ed2f9b526227670a3d2ea3914",
          "body": "Every scan mints a `Class.constructor` unit — explicit ctor or not, because field\ninitializers execute at construction — so a dependency's report DOES carry\n`<pkg>#<Class>.constructor`. The consumer never asked for it, in either arm:\n\n  * a DECLARED ctor resolves to a ConstructorDeclaration, which h\n[…]\nfuzz, transitive-recall and sensitivity (8/8, 8/8) green; eslint\nclean.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "scan: `new DepClass()` never consulted the chained dep report",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-26T00:07:05Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "625e8fdac9c6aadc4761fbb297b2566835da6dcf",
          "body": "The implicit-stringification vein is closed inside one project (§2f, §2f-bis).\nSplit the same code across a package boundary and scan the dependency separately\n— the arrangement candor's own docs recommend — and it came back:\n\n    `${e}` where e: Entry from \"depkit\", Entry.toString writes a file\n\n  \n[…]\nnd sensitivity (8/8 disclosure, 8/8 oracle\nrecall) green; eslint clean.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "scan: implicit coercion reaches a DEPENDENCY's toString/toJSON",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-26T00:06:55Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "6fb2560ed90326d00ffaa7d819227eb2e0c3d010",
          "body": "In a monorepo the dependency is a symlink into `node_modules`, and the TypeScript\nchecker resolves it to its REAL path (`…/packages/common/dist/index.d.ts`) — no\n`node_modules/` segment. Every κ-ledger / `invisible` disclosure arm was gated on\nexactly that segment (`/node_modules\\//.test(file)`), so\n[…]\ne-recall and sensitivity (8/8\ndisclosure, 8/8 oracle recall) all green.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "scan: a SYMLINKED workspace dep produced no disclosure at all",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-25T23:39:16Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "60cee596e334b0b29945ce45a715146ef393ae6f",
          "body": "…to 1\n\nAll eight packages cloned, installed, scanned and ran their suites with no\nattrition, so every delta is the flag. Checked and sound-complete are identical\nframe-for-frame (92 / 4) — the flag adds disclosure without removing adjudicated\nframes and without moving any frame out of claimed-comple\n[…]\no\nverdict changed, but narrowing to the resolved entry would remove it.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "confirmatory: --dep-inits takes the held-out slice from 3 violations …",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-25T22:41:36Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "248c4fef8c12d35e38f26cca070b264beff9d7db",
          "body": "… isn't\n\n\"A dependency bump added a top-level Net call\" is the gains headline case, and\ncandor could not see it. The application's own source does not change; the only\nchange is one line at file scope inside node_modules:\n\n    https.get('https://telemetry.example.com/beacon');   // runs on import\n\nI\n[…]\nscan is skipped and\ncounted in the summary line, never implied covered.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "eval: the gains supply-chain case was structurally invisible, and now…",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-25T21:53:19Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "fab67fd49e296683718a54d55941ad9565ae7339",
          "body": "The blocker on the external half of the initializer-edge vein was never\nanalysis, it was that nobody had scanned the dependency. node_modules is on\ndisk, so scan it.\n\n`--dep-inits` collects the bare specifiers this project imports AT TOP LEVEL —\nits direct dependency surface, not the whole tree — re\n[…]\nsure, 8/8\noracle recall), four-way conformance 26 cases / 0 mismatches.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "scan: --dep-inits scans the packages you import and chains them",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-25T21:43:44Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "6facf72e7dcfdf29e75a2b0f879a09f5e3cdc2d7",
          "body": "write-file-atomic was the one left open — its Rand reaches through node_modules,\nthe external half of the initializer-edge vein. Scanning its two dependencies and\nchaining their reports closes it:\n\n    signal-exit                     dist.cjs.index.<module> -> ['Rand','Unknown']\n    write-file-atomi\n[…]\nhat stays undisclosed is a dependency nobody\nhas scanned, deliberately.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "confirmatory: both held-out findings are now resolved by determination",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-25T21:30:04Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "3643cd96f97a700613c7e789ac96594f2d7d651c",
          "body": "Importing a package runs its entry module, so the importer reaches whatever that\ninitializer does. The intra-project half of this edge shipped in 70553c3; the\nexternal half was left open because the obvious version — disclose Unknown for\nany top-level import of an unanalyzed dependency — measured at\n[…]\nsure, 8/8 oracle recall),\nfour-way conformance 26 cases / 0 mismatches.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "scan: a chained dependency's initializer reaches the importing module",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-25T21:28:41Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "7e7ad7c3a3ebb964de783594abf4c52ad1a9f66e",
          "body": "results-importedge/: proper-lockfile goes 1 violation -> 0, index.<module>\nmoving from claimed-complete to disclosed, because the edge resolves\nintra-project down to a module that already discloses. No Unknown invented and\nnothing flooded; sound-complete drops 5 -> 4 for the same reason, a frame\ncor\n[…]\nating exactly along\nthe line the analysis predicted is the useful part.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "confirmatory: the import edge closes one of the two held-out findings",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-25T17:39:02Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "70553c3a8784153cfd3a12e5e590d3d18b75ce92",
          "body": "Importing a module runs its top level, so whatever imports it reaches whatever\nthat initializer does. candor-ts has had the initializer UNIT since 0.14 but\nnever the EDGE INTO it, so this read sound-complete pure:\n\n    dep.ts  export const dbg = process.env.NODE_DEBUG || \"\"   ->  dep.<module> ['Env'\n[…]\non probe, fuzz 25/25, and\nfour-way conformance 26 cases / 0 mismatches.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "scan: model the MODULE-IMPORT edge into the initializer unit",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-25T17:34:56Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "55a18fae969ca82539f18f6d4b90ccc3400ed998",
          "body": "Found while trying to close the previous commit's 5 uncorroborated caller\nframes with continuation tracking. That work recovered only one frame, and\nrather than publish a number I could not explain I traced it. The explanation\nwas not about async at all.\n\nTransitive attribution reads new Error().sta\n[…]\nade this project refuses. A sound version needs promise-graph tracking.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "verify: the falsifier's own stack was truncated at ten frames",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-25T15:48:52Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "cf91b95d5317000c023cdf257adaf59f8e51642e",
          "body": "sensitivity.mjs asks whether the oracle catches an effect at the function that\nPERFORMS it, with candor's disclosure stripped, and answers 8/8. The question\none level up is the one the honesty invariant actually turns on: candor's\nsignatures are transitive, so a false all-clear can sit on a CALLER w\n[…]\ne\nwork. Knowing how much of a chain the arm can speak for no longer is.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "soundness: measure how far up a call chain the Node oracle can falsify",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-25T15:23:25Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "e1a84fc906826228adfeb6708c0224e1796a17e6",
          "body": "…col over local implementors\n\nTS arm of the four-way closure of a false all-clear the cross-organization corpus found on real code\n(candor-spec/SOUNDNESS-VEIN-implicit-stringify.md; JVM 5189da7, swift ca299f0): an effect reached through\na stringification whose target is only invoked implicitly.\n\nTHE\n[…]\no the TARGETS, where a forgotten\ncase over-discloses rather than hides.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "close the implicit-stringification vein (ts) — CHA the coercion proto…",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-25T00:46:31Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "2eab8e7bd2a0e65bb4fb13a466d20d64a51ac9d0",
          "body": "…out the multi-value ones\n\nTwo disclosure defects in the same code path, both pre-existing, found while\nsweeping a scan advisory across the engines. Neither changes a verdict.\n\n1. INERT KEYS WERE SILENT. The config vocabulary is shared family-wide, but this\nengine wires only 4 of the keys to a mode.\n[…]\n,\nlint, unit, mcp, lsp 58/0, watch 16/0, fabrication probe, fuzz 25/25.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "config: disclose recognized-but-unimplemented keys, and stop lying ab…",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-24T21:52:06Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "e704ee55bf830d4dc60774ac7a3d17d96c056945",
          "body": "…arity with candor-java)\n\nPort of candor-java's scan-completeness nudge (8b5d0b0). A high VOLUME of calls\ninto κ-uncovered packages is the signature of a scan missing an INPUT, not of an\nimprecise classifier: the code leans on packages nothing in the run analyzed, so\nwhat they do is simply absent. M\n[…]\nbut is not implemented, so there\nis no resolution hazard to warn about.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "scan: nudge a dependency-less scan toward chaining its deps (engine p…",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-24T21:03:11Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "1d85b65ebe71e8c1d28c74ad75574ff1505fdcb6",
          "body": "…rol, not fresh\n\nPanel-8 (AEC) caught that graceful-fs is in BOTH the developmental Node B.1\nslice and this held-out manifest, contradicting the \"every package is a fresh\nrepo absent from calibration\" claim. graceful-fs is a deliberately-reused\nvacuous control (dynamic fs-method reassignment degrade\n[…]\nhe held-out\nclaim as \"7 fresh packages + graceful-fs (reused control)\".\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "confirmatory/FROZEN.md: disclose graceful-fs is a reused vacuous-cont…",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-21T18:48:34Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "cc8af8ab0b3911da92ddfdae182dad2b3a3506d9",
          "body": "…-clear\n\nAn earlier pass (and the paper) mislabelled node-tar's WriteEntrySync.constructor\nflag as an oracle artifact. It is not. candor emits no row for the constructor\n(decorator-wrapped class), AND the completeness manifest is {count,digest}+uncovered\n-packages, not a function-level set — so abse\n[…]\ncheck. get-port/proper-lockfile remain over-flags. Reported, not fixed.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "confirmatory(node): RECLASSIFY node-tar flag — genuine (A0) false all…",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-21T11:02:48Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "9a6a176c898072c29d986f1d22651eed0236259c",
          "body": "…side\n\nTraced all 3 held-out VIOLATION flags to source against frozen 0.23.1:\n- get-port: ava harness Fs charged to a scanned test-file frame (library Fs-free)\n- proper-lockfile: Fs fired after module-init returned, outside that frame's extent\n- node-tar: oracle synthesised a WriteEntrySync.construc\n[…]\n(safe direction,\nper-frame additive). Reported, not fixed under freeze.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "confirmatory(node): verified flag adjudication — 3 flags, all oracle-…",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-21T10:15:31Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "b807ea57c7e568f8b6666c1bdea1974d1e12a280",
          "body": "The Node analog of the JVM arm (eval/corpus-confirmatory) and the Rust/Swift\nsyscall arms: a held-out, version-pinned corpus, a frozen classifier (engine\nsource hash-gated in run_frozen.sh), one run, results reported not repaired.\n\n8 held-out npm packages (cloned at release tags; excludes every eval\n[…]\nd tap suites) and the container-span\nattribution bug to fix separately.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "soundness: add the frozen Node/TS confirmatory arm (held-out corpus)",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-21T09:43:55Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "13e760fefca7cabb6b9f462f64d9843853d110d8",
          "body": "… raw-socket Net regression\n\nTASK 1 — verify-core blame attribution. When the dynamic honesty oracle finds a\ndisclosed Unknown doing REAL WORK at runtime (observed escapes the non-Unknown\nsignature — the \"Unknown-load-bearing\" case), it now names the exact unresolved\nedge to resolve for a precise an\n[…]\nso it can't appear).\n\nnpm test green (570 + 105 unit passed, 0 failed).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "verify: BLAME a load-bearing Unknown to its unknownWhy edge + pin the…",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-20T18:00:03Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "2d8db37faff0cb80316eef24b7db6356926426a8",
          "body": "Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "release 0.23.1: engine perf + classifier-soundness patch (spec 0.23)",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-20T12:08:39Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "18ae9151e98e4f50317dfb5e507525352367a906",
          "body": "Both least-fixpoint sweeps (effects + the literal surfaces hosts/tables/cmds/\npaths/blind/incomplete) used `while (changed) { for [,rec] of fns }`: they re-swept\nevery function on every pass, so the pass count equalled the longest back-to-front\ncall chain — O(V²) on deep whole-project graphs (a 6000\n[…]\nected. Java arm of the\nsame vein: candor-java computeFixpoint worklist.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "perf: worklist pass-3 fixpoint — kill the O(V²) deep-graph cliff",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-20T11:32:59Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "f557c236565c2cab0edaf4b7407e8d8d0a7d3863",
          "body": "Version bump + CHANGELOG for the 0.23.0 floor release (cross-package interface\ndispatch; the four-way sync-callback rung; the reconcile-against-reality classifier\nsoundness wave; value provenance; verify-oracle coverage crediting). See CHANGELOG.md.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "release: 0.23.0 (spec 0.23)",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-20T08:49:25Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "8493609ff0d9a177278623e3881fc8b41adad7c8",
          "body": "…back rung)\n\nThe TS arm of the four-way sync-callback-invoker conformance case: an opaque\ncallback param handed to Array.forEach reads Unknown (the fix shipped in 014fcd8).\nPaired by bare name with the rust/java/swift fixtures + candor-spec expected.json.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "conformance: add the sync_callback_opaque fixture (four-way sync-call…",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-19T21:22:42Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "014fcd8c4c774514699074e8a414daca2f00d9d9",
          "body": "An OPAQUE callback handed to a synchronous higher-order invoker — `forEach`/\n`map`/`filter`/`some`/`every`/`find`/`flatMap`/`reduce`/… — was read silently\nPURE. `arr.forEach(cb)` where `cb` is a parameter (or any callable the checker\ncan't resolve to a body) is INVOKED by the HOF, but the es-lib sig\n[…]\n5) + 12 new regression checks (the vein + every over-disclosure guard).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "scan: opaque callback to a sync HOF discloses Unknown (was silent-pure)",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-19T21:04:17Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "71035966b6135f38d10f84281d67d8fb5f80e273",
          "body": "…ive, not nearest-frame\n\nFollow-up to the transitive-attribution change (7ff8097): the NODE_OPTIONS-wiring comment\nstill described the old nearest-frame attribution. No code change.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "candor verify: fix stale comment — preload attribution is now transit…",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-19T17:55:17Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "7ff809708f1e2bbb588c5535d220c8210e19325b",
          "body": "…e JVM oracle)\n\ncandor's report is TRANSITIVE (a function that reaches an effect is effectful), but the\nruntime capture attributed each observed effect only to the NEAREST project frame (the\nleaf). It was thus structurally blind to the dangerous cardinal sin: a CALLER that\nreaches an effect through \n[…]\n). 556/556 tests pass. Verify-only;\nreport and verdict bytes unchanged.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "candor verify: transitive effect attribution (Node arm parity with th…",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-19T17:28:21Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "4a75e5c35e7a5c19c4fe254d23cea4e0e1eaf3ec",
          "body": "…ollision\n\nCode-review parallel of the rust/swift collision guards (candor-rust b4ae3b9,\ncandor-swift 0de57e4): two `interface I` decls in different files both key the\nunion hash on `pkg#I.method`, so the emittedHashes first-wins would emit ONE I's\nunion under a name a consumer of the OTHER I resolv\n[…]\nlves use() → Net; unit 103 / integration 553\n/ fabrication-probe green.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "scan: guard the interfaceUnion emission against same-name-interface c…",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-19T13:12:16Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "98a42c0d222d60024510a908899d28eb6c82c978",
          "body": "Record the cross-package interface-dispatch rung (interfaceUnion + --workspace,\nthree-way conformance-pinned via PART 18) as spec 0.23. Bump the SPEC_VERSION\nconstant + all spec-string fixtures/assertions/docs from 0.22 to 0.23; the engine\nBUILD versions (0.22.0) stay (separate axis). Gated feature,\n[…]\nll engine test suites + four-way conformance + release-preflight green.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "spec: declare 0.23 — the cross-package interface-dispatch rung",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-19T12:44:31Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "c6b8767253e33c2965e16e6815432086a8f682e7",
          "body": "…p graph)\n\nExtends --workspace to resolve effects across MULTIPLE workspace hops: a dep's\ncalls into ITS OWN workspace deps now resolve too. Discovery is separated from\nscanning; each dep is re-scanned WITH the accumulating .candor/deps dir chained\n(CANDOR_DEPS), to a fixpoint — effects are monotone\n[…]\n(test.mjs ~2min is machine load, identical on the pre-change baseline).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "scan: --workspace transitive chaining (fixpoint over the workspace de…",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-19T10:52:58Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "2af77fca41db4f62f0e27da7bbc2a9fc6aa32dde",
          "body": "…ionize)\n\nProductionizes the workspace-chaining prototype into one command. `--workspace`\n(alias `--deps`) auto-discovers the target's symlinked monorepo dependencies (a\nworkspace link points OUT of node_modules to the package's real source), scans\neach into .candor/deps/ with interface-CHA union en\n[…]\neen; default (no --workspace)\nbehavior unchanged. --help/usage updated.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "scan: --workspace flag — auto-discover + chain monorepo deps (product…",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-19T10:37:57Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "710178eab4441fd9f82564309b4b371e3591bbf2",
          "body": "…rototype)\n\nPrototypes the fix for the external-interface-dispatch residual found dogfooding\nukri-tfs: a consumer calling `channels.X.publish()` on an `OutboundChannel`\ninterface imported from the sibling package `@ukri-tfs/message-handling` (whose\nimpl reaches SNS/Net) read PURE, because candor pin\n[…]\naceUnion` field + the flag, auto-scan workspace deps) is the follow-on.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "scan: workspace report chaining — cross-package interface dispatch (p…",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-19T09:39:26Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "9459e8f55ffb5d8a9b0256f657adc15494b84941",
          "body": "Dogfooding ukri-tfs surfaced a silent under-report: `buildPostgresDataSource`\ndid `new DataSource(options).initialize()` — which opens the Postgres\nconnection pool, a real Db round-trip — and read PURE, a false all-clear on a\nfunction that opens a database connection. The typeorm verb rule covered t\n[…]\netadata` stays\nnull (in-memory lookup, no over-broadening to all get*).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "scan-core: typeorm DataSource lifecycle (initialize/connect/DDL) is Db",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-19T08:56:27Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "94d165854dd502c8c5fa3ee272592f6a020bc162",
          "body": "`s.base()` where `s: Sub`, `interface Sub extends Sup`, and `base` is declared on\nSup read disclosed-Unknown, not the precise Fs java/rust give: TS resolves `base`\nto the signature on Sup, but interfaceImpls only registered `class Impl\nimplements Sub` under Sub — Sup's CHA universe was empty.\n\nFIX: \n[…]\nr-interface regression); fabrication probe OK;\nfour-way conformance OK.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "scan: resolve super-interface method dispatch (R47)",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-18T23:25:29Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "77cd4aec89d2895f6624f296323f165a3d5d217e",
          "body": "…verride\n\nA node:stream Writable's public `.write()`/`.end()` drive the user's `_write`/`_writev`/\n`_final`/`_transform`/`_flush`, and a Readable's `.read()` drives `_read` — INSIDE node\ncore (invisible), so a CUSTOM effectful stream subclass reached ONLY via the public API\nread silent-pure at every\n[…]\nmance OK. R32 is now closed in ALL FOUR engines (rust, jvm, swift, ts).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "R32: node:stream provided method drives the subclass's _write/_read o…",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-18T15:41:42Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "8e92f53363a9f5a0bb08c7bd2018afa66fb3cdae",
          "body": "Companion to the globalThis.process.env fix: `globalThis.process.hrtime()` (Clock)\nand `global.process.send()` (Ipc) read silent-pure, while the bare forms were\nclassified. The process.* global-call handler matched the callee by exact text\n(\"process.hrtime\") and walked the receiver to a bare `proces\n[…]\n\n\n4 regression cases; corpus A/B identical; 546 tests pass; lint clean.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "scan: recognize process.* global CALLS off globalThis/global (Clock/Ipc)",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-18T14:20:51Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "06240e70f7c6e74236d6a4be54b7e42c55bcd9c5",
          "body": "…v object\n\nA corpus probe found `globalThis.process.env.HOME` (and `global.process.env`,\n`(globalThis as any).process.env`) read silent-pure, while bare `process.env` was\nEnv — yet it is the SAME object (isomorphic/universal code reaches process off the\nglobal), so the runtime trap fires and the ora\n[…]\n & unrelated guards); corpus A/B\nidentical; 542 tests pass; lint clean.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "scan: recognize globalThis.process.env / global.process.env as the en…",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-18T14:13:53Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "540aff6bb0f17666a618ff6e9541eeb7bf89eb7e",
          "body": "A corpus probe found a cardinal-sin miss: a template-literal SQL client's tag call\n`sql`SELECT … ${id}`` (postgres.js / @vercel/postgres / slonik) read silent-pure.\nTwo causes: (1) those clients were not in the npm κ table; (2) the\nTaggedTemplateExpression arm only edged a LOCAL tag — an EXTERNAL ta\n[…]\nression cases;\n538 tests pass; lint clean; four-way conformance exit 0.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "scan: classify tagged-template calls through κ + the coverage ledger",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-18T14:04:01Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "5e228d3ad4461bf64083282aece6cb11ef6c8029",
          "body": "…effectful builtin\n\nA corpus probe found a cardinal-sin miss: `fs.writeFileSync.call(null, p, d)`,\n`.apply(null, [p,d])`, and `Reflect.apply(fs.writeFileSync, …)` read silent-pure,\nwhile `.bind`, an alias, a computed member, and dynamic import were all caught.\n`Reflect.apply` is the canonical Proxy-\n[…]\nre, project fn → edge); 535 tests pass; lint clean; conformance exit 0.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "scan: classify reflective invoke (.call/.apply/Reflect.apply) of a κ-…",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-18T13:10:43Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "3125bbc802ccf48cd81f3ab425d6b2074a2414d2",
          "body": "…E traps (oracle)\n\nContinuing the whole-object process.env pass. A referee audit + further probing\nsurfaced two more silent-pure enumeration idioms and a classifier/oracle mismatch:\n\nscan (classifier): recognize `for (const k in process.env)` (the for-in loop\nenumerates every key) and `structuredClo\n[…]\nes unaffected; 530 tests pass; lint clean; four-way conformance exit 0.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "env completeness: for-in + structuredClone (classifier), and env-WRIT…",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-18T12:44:06Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "ccf395083e2d6ae65ff106389da78cb8ec513367",
          "body": "…s Env\n\nCorpus-hunting surfaced a silent-under-report class: `process.env.KEY` is caught,\nbut the env object handed WHOLE to a builtin that enumerates or mutates it read\nsilent-pure. Confirmed real end-to-end — `Object.assign(process.env, obj)` (the\nstandard bulk env-load idiom) writes the environme\n[…]\nadow guard); full suite green; lint clean;\nfour-way conformance exit 0.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "scan: recognize whole-object process.env access via builtins/spread a…",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-18T12:24:54Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "1c3dd3ee1389d510daf6b7d4dd526d8510fcfa73",
          "body": "…gation\n\nA max code review found pass 2c's direct/one-hop param-write model leaked: an Env\nwrite through a parameter fed process.env was silently missed for a forwarding hop,\na local alias of the parameter, a write inside a capturing closure, and a compound\nassignment; the positional arg->param join\n[…]\nound + a benign no-inflow control); full suite green (515); lint clean.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "scan: complete the effect-polymorphism fix — transitive env-fed propa…",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-18T12:02:13Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "f6c090da1dd149d79bd1a97a92367934dd0d2e17",
          "body": "…n to 0.22\n\nLockstep minor bump 0.21 -> 0.22 across the candor family. 0.22 documents the\nverify oracle (per-engine; the report/verdict schema is unchanged from 0.21, so a\n0.21 consumer is unaffected) and folds in the two corpus-found soundness fixes\nalready on main — a JVM bridge-method attribution\n[…]\n0) green; every engine suite\npasses at 0.22. Not tagged, not published.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "Release 0.22: the verify oracle rung — bump spec floor + build versio…",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-18T10:52:31Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "7d22474ff6d4c191e3668fa7f49d28afb011eb7e",
          "body": "…through a parameter\n\nA public-corpus run (dotenv) surfaced a genuine per-function false all-clear:\n`populate(processEnv, parsed)` writes `processEnv[key] = value`, and `config`\ncalls it with `process.env` (via `let processEnv = process.env`). candor's\nper-function syntactic classifier inferred `pop\n[…]\nfied to FAIL without\nthe fix. Full suite green (510 + 107); lint clean.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "scan: resolve the effect-polymorphism boundary — process.env aliased …",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-18T10:29:31Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "1f2be8b16c4ae54ad1b8fde09b95d474ca03813a",
          "body": "Ports the unknown-ratchet opt-in to candor-ts, matching the candor-java reference\n(d9b000d). An Unknown-only gain vs the baseline (advisory since 0.16) FAILS\nAS-EFF-005 under config `unknown-ratchet` / env `CANDOR_UNKNOWN_RATCHET` (default\nOFF ⇒ byte-identical). A fn already Unknown in the baseline \n[…]\non (env and bare config key). 506 suite + 103 unit green,\neslint clean.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "candor: unknown-ratchet — ts port (four-way parity)",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-17T23:03:07Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "7da3d3c78803a9e815df462f896e417c65e9d34c",
          "body": "A max-effort code review found several false-all-clear / silent-miss paths in the\noracle. Fixed, each gated:\n\n- TORN TRACE LINE (verify.mjs): the whole NDJSON trace was parsed with one\n  `.map(JSON.parse)` in a try — a single torn/interleaved line threw and the catch\n  left sites=[], so verify print\n[…]\nsuite + 8/8 sensitivity) green, eslint clean. verify stays unpublished.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "candor verify: max-review soundness fixes (TS arm)",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-17T22:13:47Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "622a941f417ca7ff87b7e33b7a5416098c2cff24",
          "body": "…per)\n\nThe honesty oracle's clean record is worthless without a SENSITIVE falsifier — the\npaper's empirical referees called this experiment \"non-negotiable\". sensitivity.mjs\nplants a real Fs effect behind each of 8 dynamic mechanisms a static analyzer\ncannot see through — eval, new Function, compute\n[…]\nll recall). `candor-ts-sensitivity` bin.\n498 suite green, eslint clean.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "candor: seeded-violation sensitivity battery (RQ1 Part C, from the pa…",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-17T21:10:39Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "a218ef952d9c164634c40a650d6effa71cfe41e7",
          "body": "…ind)\n\nCorpus-testing the oracle on a real app (a 7k-line smoke test) exposed that the\nstart-line-only loc index from the previous commit was INCOMPLETE — and, worse,\nregressive: a real `fs.readFileSync` deep inside an effectful `run()` (line 5324)\nbucketed onto a PURE test-callback arrow declared e\n[…]\nex. verify stays UNPUBLISHED; spec unchanged (sidecar, not a §2 field).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "candor verify: attribute by function SPAN, not nearest-decl (corpus f…",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-17T19:02:48Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "5d3e19de507738cb17bf74a43912a415c9cc1c4a",
          "body": "Dogfooding the oracle surfaced a silent false-all-clear IN THE ORACLE — the exact\nfailure it exists to prevent. The runtime→fn attribution anchored only against the\n§2 report's EFFECTFUL fns (pure fns are omitted from §2, so they carry no loc). An\neffect executed inside a fn candor called pure there\n[…]\nys UNPUBLISHED on main; spec unchanged (the sidecar is not a §2 field).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "candor verify: close the pure-fn attribution hole (dogfood find)",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-17T18:35:25Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "e8853d690da978da693235f2c808d1da496bfad7",
          "body": "…e C)\n\nThe strongest oracle rung — a syscall trace observes effects BELOW the language\nruntime, so it can't share a bug with the analyzer OR the language-level Node\ncapture. Per-function syscall attribution needs stack unwinding + symbolization\n(research-grade), so this slice ships the mechanism-ind\n[…]\n cases, and an end-to-end syscall-trace run. 96 unit + 493 suite green.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "candor verify: syscall capture front-end (mechanism-independent, slic…",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-17T17:13:16Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "6cbad1e0a6382742ae840f47e6eddfc5ce96ab3f",
          "body": "…hecker\n\nSlice A — refine a captured Net by destination, and treat Llm/Db soundly.\n\n- verify-emit: netEffects(host,port) → Net (+ Llm for a model host [the oracle's\n  OWN table, NOT candor's — independence] / + Db for a database port) + destOf()\n  extracts host/port per entry-point arg shape (fetch/\n[…]\ns + the refinement-vs-base-miss distinction.\n94 unit + 493 suite green.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "candor verify: Db/Llm destination classification + refinement-aware c…",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-17T17:05:20Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "cb6f24a1aba09c56faa748a3d7435a5e03df07f5",
          "body": "Slice-1 missed `import { readFileSync } from \"node:fs\"` — the preload patched the\nbuiltin's DEFAULT-export object, but node keeps the NAMED export a distinct\nbinding, so a destructured named import called the un-wrapped original. For an\nhonesty oracle, silently under-observing is the one failure it \n[…]\nmaining slice-1 limit (disclosed):\nattribution is enclosing-fn by line.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "candor verify: close the ESM named-import capture gap (soundness)",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-17T16:44:06Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "e8fe926f9797bf0ec999e3aaee42c4340b1e1555",
          "body": "The mechanism-INDEPENDENT third check of the defense-in-depth ladder (static\nanalysis → cross-engine conformance → THIS): run a program under a runtime\ncapture and check candor's static claim against reality —\n`observed(f) ⊆ inferred(f) ∪ {Unknown}` per executed function. A function that\nRAN an effe\n[…]\n).\nDesign: COMPLETENESS-MANIFEST-DESIGN.md §3 / the RQ1 harness README.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "candor verify: the dynamic honesty oracle (Node, slice 1)",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-17T15:32:47Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "ffce072d3e87adf459b9a410b58e2c0794fb1fc2",
          "body": "Bumps declared spec 0.20 → 0.21 and build 0.20.1 → 0.21.0. The 0.21 rung is the\ncompleteness manifest: analyzed:{count,digest} + unanalyzed:[{path,reason}] in the\nreport + verdict, and a fail-closed exit-2 incomplete verdict so a machine/agent\ncan never read ok:true over source candor never analyzed.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "Release spec 0.21: version bump (completeness manifest)",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-17T14:55:48Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "929241f4ea57d1a7c1203dcf288c1096e25385cf",
          "body": "…ate)\n\nPorts the java reference to candor-ts (COMPLETENESS-MANIFEST-DESIGN.md).\n\n- Detection: candor-ts silently analyzed partial trees on a syntax error and\n  disclosed nothing. Now collects program.getSyntacticDiagnostics() → the\n  project files that failed to parse, deduped, as unanalyzed units +\n[…]\nleteness.py. specVersion stays 0.20\n(bumps at release); ⟨0.21⟩ markers.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "Completeness manifest: ts port (analyzed + unanalyzed + fail-closed g…",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-17T14:44:06Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "1a756d75c677d33f0ddf00daf9a68b0f97e71df1",
          "body": "…/RUM providers)\n\nEngine patch (spec STAYS 0.20 — the netClass vocabulary is unchanged; only which\nhosts map to known-telemetry). A dogfood of the published 0.20 on real repos found\nthe tight curated set misses common single-purpose telemetry: adds posthog.com,\nplausible.io, usefathom.com, heapanaly\n[…]\nnned per engine + a new\ngen_netclass posthog-subdomain case (four-way).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "0.20.1: grow TELEMETRY_HOSTS from the real-repo dogfood (+8 analytics…",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-17T13:20:15Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "18029101de8c2816ef62f374b835d6ae9e1a2ce4",
          "body": "… query surface)\n\nBumps the declared spec 0.19 → 0.20 and the build version 0.19.0 → 0.20.0.\nThe 0.20 rung is the Net destination-class (netClass field + deny Net[unknown-host])\nplus the reason-class query surface (blindspots --stats/--class, unverified --class).\nAlso folds the netClass ⟨0.21⟩ dev markers → ⟨0.20⟩ (shipped in 0.20, not skipped).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "Release spec 0.20: version bump (Net destination-class + reason-class…",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-17T12:54:33Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "2933bf453f3f904da4445a1856a53ef130a80bfd",
          "body": "Ports the java reference (NET-DESTINATION-CLASS-DESIGN.md) to candor-ts.\n\nscan-core.mjs:\n- TELEMETRY_HOSTS curated set (shared VERBATIM with java/rust) + isTelemetryHost\n  + netDestClass (known-telemetry / known-partner [config partner OR model host]\n  / unknown-host) + NET_DEST_CLASSES + the shared\n[…]\ns-\nverified on a fetch fixture: report + gate match the java reference.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "Net destination-class: ts port (netClass + deny Net[unknown-host])",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-17T11:59:15Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "ba4b384881e0387dd38efb847163b01a8ec2c7c6",
          "body": "…our-way)\n\nCompletes the design's reason-class filter across both verbs: 'candor unverified --class\nreflect' keeps only the pure/deny-layer holes whose Unknown is of a matching reason class\n(six tokens, dynamic, *); ok reflects the class-scoped view. Four-way (rust/java/ts/swift —\nunlike blindspots,\n[…]\nnsistent with blindspots. Shared parseClassFilter. Per-engine coverage.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "feat: unverified --class <c,…> — drill down by reason class ⟨0.20⟩ (f…",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-17T10:58:52Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "fe874e594ef3868119511e391e34f93e096adeb9",
          "body": "The filter companion to --stats: 'candor blindspots --class reflect,native' keeps only the\nUnknown sources whose reason classes intersect the set (the six tokens, dynamic, or *);\ncomposes with --stats. Three-way (rust/java/ts). Shared vocab with the §6.2 policy reason\nclasses. ReasonClass gains Hash (for the filter set). Per-engine tests. Targets 0.20 with --stats.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "feat: blindspots --class <c,…> — drill down by reason class ⟨0.20⟩",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-17T10:35:25Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "40390c185dd72077502a10bd9bfe5e69828d7c8b",
          "body": "`candor blindspots --stats` shows how much Unknown, by reason class\n{reflect,dispatch,indirect,native,unresolved,setup}, over the Unknown SOURCES — so a\nteam can SIZE the blind-spot cost (and separate genuine dynamism from setup mis-config)\nbefore turning on `deny E Unknown`. Three-way (rust/java/ts\n[…]\nonsistency, not the values. Per-engine tests. Unreleased; targets 0.20.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "feat: blindspots --stats — the reason-class distribution ⟨0.20⟩",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-17T10:06:41Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "b2d4962fb654f8a2d61dcf4e29ea07b6d8fafd90",
          "body": "…en/paren doc forms)\n\nPost-release CI fix: the round_trips/FixGate assertions used escaped \\\"spec\\\":\\\"0.18\\\"\n(regex-invisible to the sweep + preflight), swift README/AGENTS used spec-0.18 / candor-spec) 0.18\n(non-space separators), and build-version doc examples lagged. No shipped behaviour change —\ntest/doc strings only. AgentsDoc regenerated.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "fix: bump spec-string forms the 0.19 sweep missed (escaped JSON, hyph…",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-17T09:32:17Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "e91b11efb4b999a8785156d319adfbb491c57da3",
          "body": "Bump build version 0.18.0→0.19.0 + declared spec 0.18→0.19. Reason-scoped Unknown rung\n(see CHANGELOG). Stale-spec-string sweep across tests/docs/fixtures (preflight-clean).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "release 0.19.0 — spec 0.19 (reason-scoped Unknown)",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-17T09:20:05Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "16a2293ea62d3b1c1a163510d5c3907bcaa180e8",
          "body": "… hoist)\n\nReview-found cosmetic: a dep hoisted to a workspace-root node_modules was wrongly named in\nthe SETUP diagnostic as \"not installed\" (the check looked only under projDir). Follow node\nresolution — search node_modules at projDir AND every ancestor. The gate was already safe\n(resolvable code never reaches the setup seam); this stops the diagnostic crying wolf.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "scan: SETUP \"installed?\" check walks node_modules ancestors (monorepo…",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-17T08:53:08Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "ea73ac16f1ee3efc2fe38665432258334605e218",
          "body": "…mediation (SPEC §6.2 §3 ⟨0.19⟩)\n\nThe setup/genuine split (the referee's \"no npm install\" fatigue vector): a call whose\nhead identifier binds to a DECLARED-but-UNINSTALLED dependency (package.json ∖ node_modules)\nis tagged `no-node_modules:<pkg>` (reason class `setup`) — resolvable even when the pac\n[…]\nssification + gate tolerance are already four-way). Integration-tested.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "scan: setup-vs-genuine diagnostic — tag no-node_modules Unknowns + re…",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-17T06:41:00Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "a4af657e3ef1d0759100a0fe2e0b681d5f9fb8e4",
          "body": "…(SPEC §6.2 ⟨0.19⟩)\n\npolicy.mjs gains parseUnknownAliases + discoverConfigText; parsePolicy takes an aliases\nmap and resolves `Unknown[<name>]`. The gate (scan.mjs) and the config-aware parsepolicy\n(query.mjs) both resolve aliases. A config alias may not shadow a built-in and never\nchanges bare `deny E Unknown`. test-unit.mjs covers it.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "policy: config unknown-alias key — user-defined reason-class aliases …",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-17T06:14:14Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "28dd10e74698e962f745adab8ea8b470ce70ac68",
          "body": "….19⟩)\n\nevaluatePolicy attaches reasonClass (all transitive classes on the fn) to an Unknown\ndenial record; omitted otherwise. Regression-pinned in test-unit.mjs.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "gate: emit reasonClass on an AS-EFF-006 Unknown verdict (SPEC §6.2 ⟨0…",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-17T00:59:21Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "223d8a6d320387b120abcb5035b9a2fa61183e2b",
          "body": "- reasonClass() maps raw unknownWhy tokens → normative class (mirrors java/rust/swift).\n- parsePolicy handles Unknown[…], `*`, `dynamic` alias, A2 under-gating lint.\n- evaluatePolicy propagates the reason CLASS transitively over the callgraph (unknownWhy\n  in the report is direct-only), so `deny E U\n[…]\nfault). Updated 3 deny-record\ndeepEqual expectations for the new field.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "policy: port reason-scoped Unknown[class] to candor-ts (four-way parity)",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-17T00:26:45Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "e9e64619f998fcea17e714f19c489eefc3fafaa8",
          "body": "Floor bump 0.17 -> 0.18 (pinned-tool-surface rung; no report/verdict change):\nthe --strict advisory-verb CI gate (fix-gate/gains/unverified) + the\nsurface/tour mostly-Unknown disclosure, both pinned four-way, plus the\nFable-review edge fixes. All engines at 0.18.0; spec constants + CHANGELOGs\nbumped; four-way conformance + every engine suite green.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "release: spec 0.18 / 0.18.0 — the trust-trio floor",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-16T19:40:24Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "9633de04e1f3563390309635ba19af4efb37b003",
          "body": "Fable code-review finding E: `tour --json` over a >=1/3-Unknown graph emitted a\nbare `{\"reaches\":[]}` a JSON consumer (the agent loop) reads as clean — the same\nfalse all-clear the text branch qualifies. Now carries an additive\n`unknown:{count,total}` field, present only when the threshold trips\n(by\n[…]\nsh typos and tolerated --text via parseCanonical — findings B/C/D N/A.)\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "tour --json: additive mostly-Unknown disclosure (the machine half of #1)",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-16T19:22:48Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "4526d52e1f356e34f28f7c57a5f7bac58385c029",
          "body": "…owed gains --policy\n\nCorpus re-audit #3 (0.18 trust-trio). fix-gate exited 0 even with `ok:false`;\ngains ran green when a user passed `--policy` (parseCanonical consumes it for\nevery verb, then drops it for non-policy verbs) — either way a CI gate that\nnever fires. Following the `unverified --stric\n[…]\nallow.\nHelp text updated. Pinned four-way by conformance PART 5b + 12b.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "query: --strict makes fix-gate/gains a CI gate (exit 1); reject swall…",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-16T18:40:17Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "8f5033f8bff7be5618d851b76505acea8883c46f",
          "body": "…t/--human\n\nCorpus re-audit #2 (0.18 trust-trio). An unknown `-`-prefixed token was\nswallowed as a positional: `where Fs --polciy /x` ran with NO policy and\nexited GREEN, so a typo'd `--policy` shipped a gate that never fires.\n\nNow: unknown `--`-flags exit 2 with a did-you-mean (longest shared prefi\n[…]\ntext`/`--human` stay tolerated.\nPinned four-way in conformance PART 17.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "query: reject typo'd flags loud (exit 2), tolerate cross-engine --tex…",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-16T18:14:58Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "2082c4b1578f4801b939814f1b44865c772b86fe",
          "body": "Re-audit cardinal sin: on a TS repo whose cross-file imports don't resolve\n(a missing tsconfig.json / unresolvable imports), functions read Unknown,\nthe surface heuristic finds nothing SURPRISING, and the scan opener + tour\nboth print \"nothing hidden — every effect sits where its name says it\nshould\n[…]\nva/swift surface guard + a\nconformance pin are the four-way completion.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "#1: never say \"nothing hidden\" over a meaningfully-Unknown graph",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-16T17:47:50Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "6d843cfcacf780d9226151cf0a69bc2c9978c53d",
          "body": "candor-ts's slice of the UX-audit round (spec floor → 0.17):\n\n- #13 a bare call to an HTTP-client identifier default/named-imported from\n  node-fetch/undici/axios/got resolves to Net (+host), not Unknown — the\n  canonical `import fetch from 'node-fetch'` idiom. Restricted to the\n  client callable (d\n[…]\n\n+ regression tests. 471/0; mcp 75, lsp 58, unit clean; conformance OK.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "0.17: node-fetch recall, prose-at-TTY output, target validation",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-16T16:16:14Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "4b4db7da6f415890009b281a752dba2b0910576b",
          "body": "…t floor\n\nPreflight (release-preflight.sh) flagged prior-floor 'spec 0.15' strings left in\nsynthetic test fixtures, example envelopes, and doc strings after the bump. All\nare arbitrary-at-current-floor (the loader accepts any spec; the guard keys on\nthe build version, not spec) — moved to 0.16 so nothing declares the old floor.\nSuites re-verified green.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "0.16 sweep: bump residual spec-string fixtures/examples to the curren…",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-16T08:41:40Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "c0e8936e2b960c7bf831a59a1d9cee4e80c8a1db",
          "body": "Bumps SPEC_VERSION to 0.16 (scan.mjs + query.mjs) and the package to 0.16.0\n(package.json + package-lock.json). The report envelope, --gate-json verdict,\nand --version now speak spec 0.16.\n\nThe ⟨0.16⟩ work — the callgraph-aware baseline guard (a baseline-pure fn now\neffectful is a caught gain; exist\n[…]\nest-lsp 58; test-watch 16; probe OK (37 fns / 10 builtins); fuzz 25/25.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "spec 0.16 / 0.16.0: the callgraph-aware baseline guard floor release",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-16T08:37:36Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "a31bdf93493c2075a7e4ff5f6f622fedd586688a",
          "body": "A corpus test found the callgraph-aware guard, on real dependency bumps, fired\nonly on gained-Unknown — resolution noise, not capability gains. Unknown is the\n§4 trust marker (pure policies exclude it), so failing on pure→Unknown breaks CI\non innocuous bumps. Now: the ratchet (exit 1) fires only on \n[…]\neal effect.\n\n445 test.mjs + all legs green; conformance PART 15c green.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "baseline guard ⟨0.16⟩: an Unknown-only gain is advisory, not exit 1",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-15T23:43:50Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "a79d911c46755e00e9e47110d71cb9235f80158d",
          "body": "- the violation summary appends \"→ candor-ts-query fix-gate names the remedy\n  for each\" (stderr, failure-only; clean runs cmp-identical).\n- where/show/callers/impact/path with a MISSING required arg exited 0 with\n  empty results — path's was a false all-clear (\"does not perform undefined\").\n  All n\n[…]\norm untouched. +12 tests\n  (441 total); all legs green; conformance OK.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "gate failure points at fix-gate; missing-arg queries are usage errors",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-15T22:15:06Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "18af03af0ea2f31ef236e9788963708558447209",
          "body": "HELP: candor-ts + candor-ts-query --help restyled to the family template;\nALL ACTIONS derived from SUBCOMMANDS (can't go stale); spec confined to\n--version.\n\nGUARD ⟨0.16⟩: the AS-EFF-005 guard in scan.mjs keys existence on the baseline\n`.callgraph.json` sidecar (the same node-set gains `origin` uses\n[…]\n0; new code marked ⟨0.16 staged⟩. npm test fully green; PART 15b green.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "help house-style + ⟨0.16 staged⟩ callgraph-aware baseline guard",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-15T20:07:48Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "4ab7586bd37d71391e6172d5eb35b4131571c162",
          "body": "version 0.15.0, SPEC_VERSION 0.15. The held train ships: the coverage envelope\n(§2 field + verdict-preserving gate advisory + gains coverage/coverageDelta,\nCLI+MCP), const-anchored + literal-head host resolution (PARTs 4q/4r), and the\nprocess.env bracket/alias/destructure/in Env-recall fix (a real-world corpus\ntesting find on chalk/supports-color).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "spec 0.15: the coverage envelope + host-resolution recall + Env recall",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-15T11:16:23Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "1747647ac5b471affba2987971d2ef54d53602e2",
          "body": "The κ ledger travels with the report: one shared uncoveredLedger feeds the new\n§2 `coverage` envelope field (omitted when empty — covered reports byte-identical\nvs HEAD), the stderr receipt (bytes unchanged), and the --gate-json advisory\n(verdict-preserving, key order pinned [spec,ok,violations,cove\n[…]\nunresolvable). Pinned by PART 4s. +13 checks, full battery green. Held.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "⟨0.15 staged⟩ the coverage envelope + gate advisory + gains disclosure",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-15T10:42:11Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "317fb0d3446299c5ae0c5d11e8e68475e8a76f16",
          "body": "Env was classified only for a direct `process.env.KEY` dot access; bracket\naccess (`process.env[\"K\"]`), a local const-alias (`const env = process.env;\nenv.K`), destructuring (`const {K} = process.env`), and the `in` operator\n(`\"K\" in process.env`) all read silent-pure — a silent Env under-report on\n\n[…]\n fn param / reassigned local stays pure. Gated in test.mjs (+13). Held.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "scan: recognize process.env via bracket / alias / destructure / `in`",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-15T00:40:32Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "37b4050d7c93a85add8ead994094100cede9e37c",
          "body": "A template/concat whose literal head completes the authority with interpolation\nonly in the path (`fetch(`https://host/v1/${p}`)`) now extracts the host and\nfires the §1 Llm/Db/Net refinement (was bare Net) — the most common URL shape.\nSound boundary: split authority / whole-host interp / unterminat\n[…]\nt stay bare Net; a literal-head CDN stays Net. Pinned by PART 4r. Held.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "scan: literal-head host extraction",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-14T23:32:57Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "38a6298df6d7aeaef0cb9f225ab798de4d723996",
          "body": "A const-anchored host — `const API_BASE = \"…\"; fetch(`${API_BASE}/x`)`, a bare\nconst ref, or a const-left concat — now classifies via the existing host path\n(Llm/Db/Net uniformly), matching candor-java. Resolved via the checker only when\nthe symbol's every declaration is a const string literal; a le\n[…]\nno fabrication). Pinned by conformance PART 4q. No version bump (held).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "scan: const-string propagation for host resolution",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-14T22:52:11Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "16617ec7787519a5061ff5c2fcf1c3556047b236",
          "body": "A `class C { static { … } }` block runs at class-DEFINITION time, not instance\nconstruction, but its effects folded into the instance `C.constructor` unit and\ncarried no unitKind — so `new C()` falsely appeared to perform the static-init\neffect. Now mints its own `C.<static-init>` unit (unitKind:\"in\n[…]\nng adjacent cases\nafter the 0.14 top-level rung; gated in test.mjs §8b.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "0.14.1: static block → its own <static-init> initializer unit",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-14T21:38:18Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "86495db14dd0b13727727239bd87ef0623e58d76",
          "body": "The release cycle publishes manually before the v* tag lands (release-verify\nneeds the package live synchronously), so the tag-triggered OIDC run red-failed\nwith \"cannot publish over the previously published versions\". Guard the publish\nstep: skip cleanly when `npm view candor-ts@<version>` already \n[…]\nill publishes with OIDC provenance. No more red on a\nduplicate version.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "publish.yml: idempotent — skip when the version is already on npm",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-14T21:17:18Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "545ed477fb2e8a47952d9f39e1b12996df3d122d",
          "body": "A module whose top-level executable code (top-level await, an IIFE, a bare\nfetch/readFileSync, export const x = await …) performed an effect was silently\ndropped as a false-\"pure\" empty report — a deny Llm/Net/Fs gate passed it (the\ncardinal sin). Now synthesized as one <module> unit per file with\nu\n[…]\nonformance PART 4p pins it four-way.\nversion 0.14.0, SPEC_VERSION 0.14.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "spec 0.14: the top-level <module> initializer unit",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-14T20:57:17Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "4b8ab767924663b43903b7a4ff4283a093b29e61",
          "body": "version 0.13.0, SPEC_VERSION 0.13. Two rungs:\n- the Llm boundary effect refining Net (model-host set matched against the\n  parsed host, curated npm model-SDK list); fixed the global-fetch no-host-\n  capture gap and tightened the fabrication guard.\n- candor_activity MCP tool + the candor-lsp activity\n[…]\n propagation over MCP; the blocked record surfaced in-editor over LSP).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "spec 0.13: the Llm effect + candor_activity MCP tool + LSP activity push",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-14T19:10:58Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "c8fecf25318c23334f7b865aad8b7988cb8261d7",
          "body": "…cate\n\nThe unit test (test-unit.mjs, not run by test.mjs) still asserted the old\nover-matching rules — any :11434 host, the bedrock substring. Updated to the\ncorrected predicate + added the fabrication-guard negatives (remote :11434,\ns3-bedrock bucket, bedrock control plane). CI-caught (my local test.mjs run\ndidn't include the unit file).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "candor-ts: update the isModelHost unit test to the r3-corrected predi…",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-14T18:23:06Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "80fb0b4955935a815106f6f1ab5852ead19709d0",
          "body": "…s, not raw strings\n\n- the :11434 gate + host capture run against the PARSED host, never a raw\n  literal: axios.post('/v1/x:11434/y') no longer fabricates Llm; the URL is\n  read from the documented arg position (a trailing options literal isn't the\n  host); fetch(new URL(...)) no longer fails closed\n[…]\ntring\n  match).\nFull battery green (test 363, mcp 73, lsp 58, fuzz 25).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "candor-ts: max-review r3 Llm fixes — host predicate on EXTRACTED host…",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-14T18:21:14Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "0374c360a7a988efcd47431a31f348ccc725e58d",
          "body": "MODEL_HOSTS verbatim + isModelHost/modelHostEffects; a curated npm model-SDK\nlist (openai, @anthropic-ai/sdk, @aws-sdk/client-bedrock-runtime, ai, ollama,\nlangchain…) as a whole-module Net κ rule + Llm at the classify site. Fixed a\nlatent bug found en route: the global fetch(url) path captured NO ho\n[…]\n spec string stays 0.12. Full\nbattery green (unit 357, mcp 73, lsp 58).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "candor-ts: port the Llm effect (Db-precedent refinement of Net)",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-14T15:25:47Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "8ff173364aae941f6239c60adf8da4b52eac42bc",
          "body": "…nce (6 findings)\n\n- rotation replay flood: a size decrease skips to end, never replays (the\n  capped log rewrites via tail+mv on EVERY append — the reset-to-0 replayed\n  ~5000 historical showMessages per poll; trade-off commented).\n- overlay bookkeeping: the gate overlay gets its OWN map (activityT\n[…]\nverified red against pre-fix HEAD (LSP 58, MCP 73); full\nbattery green.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "max review r2: activity tailer/overlay/root fixes + MCP baseline + si…",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-14T13:54:52Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "b305e23e352b0f1ec040afba5522b24cf5b3555c",
          "body": "… (0.13 accumulation)\n\nThe AGENT-SURFACE-DESIGN P2 slice, closing the FEEDBACK-SPEC 'richer in-IDE\npush' item: candor-lsp tails .candor/activity.jsonl (its ONE watcher — a\nsmall unref'd stat poll; everything else stays re-read-per-request) and, on a\nnew BLOCKED record, pushes the delta the Stop hook\n[…]\nalone. 5 pins in\ntest-lsp.mjs (48 total); AGENTS.md documents the push.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "lsp: the activity push — a new blocked gate record surfaces in-editor…",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-14T12:50:05Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "c5b8b7c07427465bd95bce4aeb98bd1a546d7e23",
          "body": "…3 accumulation)\n\nThe FEEDBACK-SPEC 'richer MCP push' P1 slice (design: umbrella\nAGENT-SURFACE-DESIGN.md): an agent asks 'what has the gate caught?' without\nshelling out. Measured from .candor/activity.jsonl — edits/verdicts,\nviolations by AS-EFF code, effects introduced, largest blast radius, deepe\n[…]\nscan). 7 pins in test-mcp.mjs (66 total); AGENTS.md\ndocuments the tool.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01LaEvHERUSb26e5qcgoMu8x",
          "is_bot": false,
          "headline": "mcp: candor_activity — the edit-time gate's self-inspection tool (0.1…",
          "author_name": "Tom Baldwin",
          "author_login": "tombaldwin",
          "committed_at": "2026-07-14T11:50:16Z",
          "body_truncated": true,
          "is_coding_agent": true
        }
      ],
      "releases_count": 28,
      "commits_last_year": 292,
      "latest_release_at": "2026-07-20T08:54:07Z",
      "latest_release_tag": "v0.23.0",
      "releases_from_tags": false,
      "days_since_last_push": 0,
      "active_weeks_last_year": 7,
      "days_since_latest_release": 6,
      "mean_days_between_releases": 0.6
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": false,
      "health_percentage": 42,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "candor-ts",
          "exists": true,
          "license": "(MIT OR Apache-2.0)",
          "keywords": [
            "effects",
            "static-analysis",
            "side-effects",
            "call-graph",
            "policy",
            "candor"
          ],
          "ecosystem": "npm",
          "matches_repo": true,
          "registry_url": "https://www.npmjs.com/package/candor-ts",
          "is_deprecated": false,
          "latest_version": "0.23.1",
          "repository_url": "https://github.com/tombaldwin/candor-ts",
          "versions_count": 72,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": 1,
          "monthly_downloads": 6202,
          "first_published_at": "2026-06-12T15:22:38.031000Z",
          "latest_published_at": "2026-07-20T12:17:23.455000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 6
        }
      ]
    },
    "popularity": {
      "forks": 0,
      "stars": 0,
      "watchers": 0,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 0
      },
      "star_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_stars": 0,
        "collected_at": null
      },
      "open_issues_and_prs": 0
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [],
      "has_llms_txt": false,
      "has_dockerfile": false,
      "has_mcp_signal": false,
      "bootstrap_files": [],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [],
      "largest_source_bytes": 316677,
      "source_files_sampled": 29,
      "oversized_source_files": 4,
      "agent_instruction_files": [
        "AGENTS.md"
      ],
      "agent_instruction_max_bytes": 15152
    },
    "dependencies": {
      "manifests": [
        "package.json"
      ],
      "advisories": {
        "error": null,
        "scope": "published_package",
        "source": "osv",
        "findings": [],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {},
        "advisory_count": 0,
        "affected_count": 0,
        "assessed_count": 3,
        "malicious_count": 0,
        "assessed_package": "npm:candor-ts@0.23.1",
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "npm"
      ],
      "dependencies": [
        {
          "name": "@types/node",
          "manifest": "package.json",
          "ecosystem": "npm",
          "version_constraint": "^25.9.2"
        },
        {
          "name": "typescript",
          "manifest": "package.json",
          "ecosystem": "npm",
          "version_constraint": "^6.0.3"
        }
      ],
      "all_dependencies": {
        "error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
        "source": null,
        "packages": [],
        "collected": false,
        "truncated": false,
        "total_count": null,
        "direct_count": null,
        "indirect_count": null
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 1,
        "open_issues": 0,
        "closed_ratio": null,
        "closed_issues": 0,
        "closed_unmerged_prs": 0
      },
      "bus_factor": 1,
      "bot_contributors": 0,
      "top_contributors": [
        {
          "type": "User",
          "login": "tombaldwin",
          "commits": 298,
          "avatar_url": "https://avatars.githubusercontent.com/u/1909530?v=4"
        }
      ],
      "contributors_sampled": 1,
      "top_contributor_share": 1
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": false,
      "ci_workflows": [
        "ci.yml",
        "publish.yml"
      ],
      "has_docs_dir": false,
      "linter_configs": [
        "eslint.config.mjs"
      ],
      "has_editorconfig": false,
      "has_linter_config": true,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "package-lock.json"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": null,
            "reason": "no pull request found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/30 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 3,
            "reason": "project has 1 contributing companies or organizations -- score normalized to 3",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 0,
            "reason": "no update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 0,
            "reason": "project was created within the last 90 days. Please review its contents carefully",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": 10,
            "reason": "packaging workflow detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 1,
            "reason": "dependency not pinned by hash detected -- score normalized to 1",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "no SAST tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 0,
            "reason": "security policy file not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": null,
            "reason": "no releases found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 7,
            "reason": "3 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "c08063a8c17bb39f7e2b0858ee21251077ad00eb",
        "ran_at": "2026-07-26T18:56:23Z",
        "aggregate_score": 3.3,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": false,
      "has_dependabot_config": false
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-26T10:35:14Z",
      "oldest_open_prs": [],
      "last_merged_pr_at": "2026-07-18T10:29:31Z",
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": []
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/tombaldwin/candor-ts",
    "host": "github.com",
    "name": "candor-ts",
    "owner": "tombaldwin"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "moderate",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 54,
      "inputs": {
        "security": 46,
        "vitality": 75,
        "community": 34,
        "governance": 53,
        "engineering": 56
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "good",
        "name": "Vitality",
        "value": 75,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "moderate",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 59,
            "inputs": {
              "commits_last_year": 292,
              "human_commit_share": 1,
              "days_since_last_push": 0,
              "active_weeks_last_year": 7
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 0 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 0
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "7/52 weeks with commits",
                "points": 4.8,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 7
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "292 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 292
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "releases_count": 28,
              "latest_release_tag": "v0.23.0",
              "releases_from_tags": false,
              "days_since_latest_release": 6,
              "mean_days_between_releases": 0.6
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "28 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 28
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 6 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 6
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~0.6 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 0.6
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "at_risk",
        "name": "Community & Adoption",
        "value": 34,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 1,
            "inputs": {
              "forks": 0,
              "stars": 0,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "0 stars",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "0 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "moderate",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 50,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": false,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (Apache-2.0)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "Apache-2.0"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          },
          {
            "key": "ecosystem_adoption",
            "band": "moderate",
            "name": "Ecosystem adoption (downloads)",
            "note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "registry_dependents"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 63,
            "inputs": {
              "packages": [
                "candor-ts"
              ],
              "dependents": null,
              "ecosystems": "npm",
              "total_downloads": null,
              "monthly_downloads": 6202
            },
            "components": [
              {
                "key": "monthly_downloads",
                "name": "Monthly downloads",
                "detail": "6,202 downloads/month across npm",
                "points": 50.6,
                "status": "partial",
                "details": [
                  {
                    "code": "downloads_monthly",
                    "params": {
                      "count": 6202,
                      "ecosystems": "npm"
                    }
                  }
                ],
                "max_points": 80
              },
              {
                "key": "registry_dependents",
                "name": "Registry dependents",
                "detail": "not reported by this ecosystem",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_reported_by_this_ecosystem",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "moderate",
        "name": "Sustainability & Governance",
        "value": 53,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 13,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 1,
              "top_contributor_share": 1
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 100% of commits",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 100
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "1 contributors",
                "points": 1.4,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 1 contributing companies or organizations -- score normalized to 3",
                "points": 3,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "good",
            "name": "Issue & PR responsiveness",
            "note": "Excluded from scoring (no data or not applicable): Issue resolution. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "issue_resolution"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 72,
            "inputs": {
              "merged_prs": 1,
              "open_issues": 0,
              "closed_issues": 0,
              "issue_closed_ratio": null,
              "closed_unmerged_prs": 0
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "no issues or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_issues_or_data",
                    "params": {}
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "1/1 decided PRs merged",
                "points": 38.2,
                "status": "met",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 1,
                      "decided": 1
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "at_risk",
            "name": "Ownership & stewardship",
            "note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "verified_domain"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 46,
            "inputs": {
              "followers": 4,
              "owner_type": "User",
              "is_verified": null,
              "owner_login": "tombaldwin",
              "public_repos": 20,
              "account_age_days": 5138
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "personal (user) account",
                "points": 10,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_personal",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": "not applicable to user accounts",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_applicable_to_user_accounts",
                    "params": {}
                  }
                ],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "4 followers of tombaldwin",
                "points": 5,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 4,
                      "login": "tombaldwin"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "20 public repos, account ~14 yr old",
                "points": 21.6,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 20
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 14
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "candor-ts"
              ],
              "ecosystems": "npm",
              "any_deprecated": false,
              "min_days_since_publish": 6
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on npm",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "npm"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 6 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 6
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "72 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 72
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "moderate",
        "name": "Engineering Quality",
        "value": 56,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "moderate",
            "name": "Engineering practices",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_ci_tests"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 50,
            "inputs": {
              "has_ci": true,
              "has_tests": false,
              "has_editorconfig": false,
              "has_linter_config": true,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "2 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": "eslint.config.mjs",
                "points": 16,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "eslint.config.mjs"
                    }
                  }
                ],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "moderate",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 65,
            "inputs": {
              "topics": [],
              "has_wiki": true,
              "homepage": "https://candor.poly.io",
              "has_readme": true,
              "has_docs_dir": false,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": "https://candor.poly.io",
                "points": 15,
                "status": "met",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "at_risk",
        "name": "Security",
        "value": 46,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "at_risk",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): CI-Tests, Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "ci_tests",
                    "signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 33,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 16,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 2,
              "scorecard_aggregate": 3.3
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 1 contributing companies or organizations -- score normalized to 3",
                "points": 0.8,
                "status": "partial",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "no update tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 1",
                "points": 0.5,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "no SAST tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file not detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "3 existing vulnerabilities detected",
                "points": 5.2,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "excellent",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): No advisories left outstanding. Remaining weights renormalized. Matched the npm:candor-ts@0.23.1 runtime dependency closure — what installing the published package pulls in — 3 packages. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "no_advisories_left_outstanding"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_published",
                "params": {
                  "package": "npm:candor-ts@0.23.1",
                  "assessed": 3
                }
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "source": "osv",
              "advisories": 0,
              "affected_packages": 0,
              "assessed_packages": 3,
              "unassessed_packages": 0,
              "affected_by_severity": "none",
              "direct_affected_packages": 0
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "no direct dependency carries a known advisory",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "no_direct_advisories",
                    "params": {}
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "no indirect dependency carries a known advisory",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "no_indirect_advisories",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory carries a publication date",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_no_publication_date",
                    "params": {}
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 3,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 2
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "moderate",
        "name": "AI Readiness",
        "value": 53,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "excellent",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 1,
              "agent_instruction_files": [
                "AGENTS.md"
              ],
              "agent_instruction_max_bytes": 15152
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "AGENTS.md",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "AGENTS.md"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "100 of 100 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 100,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "at_risk",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 32,
            "inputs": {
              "has_nix": false,
              "has_tests": false,
              "lockfiles": [
                "package-lock.json"
              ],
              "has_dockerfile": false,
              "typed_language": false,
              "bootstrap_files": [],
              "has_devcontainer": false,
              "has_linter_config": true,
              "typecheck_configs": [],
              "agent_commit_share": 1,
              "toolchain_manifests": [],
              "dependency_bot_commit_share": 0
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": "eslint.config.mjs",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "eslint.config.mjs"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "100 of the last 100 commits agent-authored or agent-credited",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "agent_authored_commits",
                    "params": {
                      "count": 100,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "no automated dependency updates observed",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_dependency_automation",
                    "params": {}
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 1",
                "points": 1,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "at_risk",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 47,
            "inputs": {
              "primary_language": "JavaScript",
              "largest_source_bytes": 316677,
              "source_files_sampled": 29,
              "oversized_source_files": 4
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "JavaScript without a type-check config",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_typecheck_config_language",
                    "params": {
                      "language": "JavaScript"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "4/29 source files over 60KB",
                "points": 47.4,
                "status": "partial",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 29,
                      "oversized": 4
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-26T18:56:28.880431Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/t/tombaldwin/candor-ts.svg",
  "full_name": "tombaldwin/candor-ts",
  "license_state": "standard",
  "license_spdx": "Apache-2.0"
}