zkrebbekx / chronicle

Conjunto completo de dependencias resueltas según el grafo de dependencias de GitHub: 1 paquetes directos y 5 indirectos (transitivos). El cierre transitivo es completo cuando el repositorio incluye un lockfile.

Este repositorio no publica ningún paquete que el índice resuelva, así que se evaluó su propio grafo de dependencias — 6 paquetes, que incluyen también fijaciones de desarrollo y prueba que nunca se distribuyen: 1 tienen avisos conocidos, de los cuales 0 son directas.

Un aviso significa que la versión registrada en el grafo de dependencias cae dentro del rango afectado de un aviso. No se analiza la alcanzabilidad, y el grafo incluye fijaciones de desarrollo y prueba: un hallazgo puede referirse al utillaje y no al software distribuido.

{
  "data": {
    "repo": {
      "topics": [
        "audit-log",
        "audit-trail",
        "bitemporal",
        "change-history",
        "compliance",
        "database",
        "effective-dating",
        "go",
        "golang",
        "postgresql",
        "temporal-data",
        "versioning"
      ],
      "is_fork": false,
      "size_kb": 2754,
      "has_wiki": true,
      "homepage": "https://zkrebbekx.github.io/chronicle/",
      "languages": {
        "Go": 944076,
        "CSS": 11141,
        "HTML": 9413,
        "Makefile": 1954,
        "Dockerfile": 1019,
        "JavaScript": 26896
      },
      "pushed_at": "2026-07-27T15:08:12Z",
      "created_at": "2026-07-20T13:36:39Z",
      "owner_type": "User",
      "updated_at": "2026-07-21T01:05:17Z",
      "description": "Bitemporal entity change history for Go — valid time and transaction time, ORM-agnostic over database/sql. Know what your data was, and what you believed it was.",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "MIT",
      "default_branch": "main",
      "license_spdx_raw": "MIT",
      "primary_language": "Go",
      "significant_languages": [
        "Go"
      ]
    },
    "owner": {
      "blog": null,
      "name": "Zac Krebbekx",
      "type": "User",
      "login": "zkrebbekx",
      "company": null,
      "location": "South Australia",
      "followers": 5,
      "avatar_url": "https://avatars.githubusercontent.com/u/334641?v=4",
      "created_at": "2010-07-17T04:08:55Z",
      "is_verified": null,
      "public_repos": 36,
      "account_age_days": 5856
    },
    "license": {
      "state": "standard",
      "spdx_id": "MIT",
      "raw_spdx": "MIT",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.2.0",
          "kind": "minor",
          "published_at": "2026-07-20T22:18:25Z"
        },
        {
          "tag": "v0.1.0",
          "kind": "minor",
          "published_at": "2026-07-20T15:20:42Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "26de2d21ac8ebb23274576b97e69e13d86b875ea",
          "body": "The bitemporal grid is the visual identity: two time axes, a plane of version\nboxes, one cell split by a retroactive correction. Adds the generated logo and\nsocial-preview banner under docs/assets, and leads the README with the banner\nlinked to the playground.",
          "is_bot": false,
          "headline": "docs: brand assets — logo and social preview",
          "author_name": "Zac Krebbekx",
          "author_login": "zkrebbekx",
          "committed_at": "2026-07-21T01:05:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b07f81a7f09f1dba6187ef8e2fb1b06b9394a81a",
          "body": "The status blockquote predated phases 4 and 5. All five phases are shipped and\ntagged (root v0.2.0, pgstore/v0.1.2, chronicled/v0.2.0), and the browser\nplayground is live; say so, and link it.",
          "is_bot": false,
          "headline": "docs(readme): status is released, not phase 3",
          "author_name": "Zac Krebbekx",
          "author_login": "zkrebbekx",
          "committed_at": "2026-07-20T22:48:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b12efeab04a72c824e44dced665ce0102384e7a7",
          "body": "Point readers at the live in-browser demo of the two time axes.",
          "is_bot": false,
          "headline": "docs(readme): link the playground",
          "author_name": "Zac Krebbekx",
          "author_login": "zkrebbekx",
          "committed_at": "2026-07-20T22:45:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ade7206ee3a046662cd8494c93f24b4443569319",
          "body": "Build the WASM (GOOS=js GOARCH=wasm) into web/chronicle.wasm, copy the\nmatching wasm_exec.js, and upload web/ as the Pages artifact. No npm, no\nVite — the playground is hand-written static files, matching the root\nmodule's zero-dependency ethos. Pinned action SHAs. Asset paths are\nrelative so the site works at the /chronicle/ project-pages subpath.",
          "is_bot": false,
          "headline": "ci(pages): deploy the playground to GitHub Pages",
          "author_name": "Zac Krebbekx",
          "author_login": "zkrebbekx",
          "committed_at": "2026-07-20T22:45:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1ea21770e26b07be9ac347c49bf39b75a58f4a35",
          "body": "A hand-written static front end (vanilla JS + SVG, no framework, no CDN,\ntheme-aware) over the WebAssembly engine. The centerpiece is the\nbitemporal grid: valid time on X, transaction time on Y, each stored\nrecord drawn as a box spanning [validFrom,validTo) x [txFrom,txTo),\ncoloured by value or by i\n[…]\nvals, unbounded = open box, transaction time\nsystem-assigned but UI-controlled here for teaching.\n\nThe *.html ignore rule is negated for web/index.html; the CI-built wasm\nand wasm_exec.js are ignored.",
          "is_bot": false,
          "headline": "feat(playground): interactive bitemporal grid UI",
          "author_name": "Zac Krebbekx",
          "author_login": "zkrebbekx",
          "committed_at": "2026-07-20T22:44:58Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d83e26b70af803686fc8f7bdcbb301c31161015f",
          "body": "Add cmd/chronicle-wasm, the playground's engine: the chronicle library\nover an in-memory store, exposing a small JSON API on the global\n`chronicle` object (put, correct, get, timeline, history, fieldHistory,\nquery, setClock, reset, loadScenario).\n\nThe entrypoint lives in the root module so it import\n[…]\n\nclock is injected. Every call boundary recovers from a panic into a\nreturned {error} rather than tearing down the wasm instance. Three\nscenarios ship, flagship first: a retroactive salary correction.",
          "is_bot": false,
          "headline": "feat(playground): compile chronicle to WebAssembly",
          "author_name": "Zac Krebbekx",
          "author_login": "zkrebbekx",
          "committed_at": "2026-07-20T22:44:47Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a292f464eeed5f29efa7575e4b0cf7cd82254eda",
          "body": null,
          "is_bot": false,
          "headline": "build(chronicled): require chronicle v0.2.0 for FieldHistory",
          "author_name": "Zac Krebbekx",
          "author_login": "zkrebbekx",
          "committed_at": "2026-07-20T22:20:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "165f2739cacd8ae5a815290a8e7988e2c2c3a832",
          "body": "… drop it\n\nThe field-history DTO swallowed a json.Marshal error and rendered\n{\"present\":true} with no value — an ambiguous half-absent field, the one\nsilent data-loss an audit response must not have. Unreachable with the\nshipped JSONCodec (decoded values always re-marshal), but a custom codec could\nreach it, so it now surfaces as a 500 rather than a corrupted 200. Found by\nthe phase-5 correctness review.",
          "is_bot": false,
          "headline": "fix(chronicled): fail a field-value render error loud, never silently…",
          "author_name": "Zac Krebbekx",
          "author_login": "zkrebbekx",
          "committed_at": "2026-07-20T22:18:25Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1265f289d9ce6b9d2302909058f129cf248116b1",
          "body": "Adds the field-history section to the README (library and service) and a\nphase-5 section to docs/DESIGN.md, with the two Corrections found while\nbuilding it:\n\n- The brief's present->absent mechanism does not exist. An ordinary\n  Put/Correct never reduces an entity's valid coverage: a write bounded\n \n[…]\n is FieldRevision with a FieldValue{Value, Present}\n  carrying the absent-vs-null distinction.\n\nAlso records that only as.ValidAt is used (as.TxAt ignored, the mirror of\nTimeline) and the linear cost.",
          "is_bot": false,
          "headline": "docs: phase 5 record — field history, and two corrections",
          "author_name": "Zac Krebbekx",
          "author_login": "zkrebbekx",
          "committed_at": "2026-07-20T21:55:52Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "cc0de5ac48249bcfa11e9b27d7213ec3c661d0db",
          "body": "Exposes Log.FieldHistory over HTTP: path required (400 that explains,\nURL-decoded, NUL-rejected like every other read path), validAt optional and\ndefaulting to now with the zero-rendering sentinel rejected, descending\noptional. Each change renders from/to as raw JSON with a present flag, so an\nabsen\n[…]\nnull-tombstone present->absent transition, descending order, and every\nvalidation branch; the live-pg integration suite proves the flagship\nend to end over Postgres. api package 92.9% (handler 96.3%).",
          "is_bot": false,
          "headline": "feat(chronicled): GET /v1/{kind}/{entity}/field-history endpoint",
          "author_name": "Zac Krebbekx",
          "author_login": "zkrebbekx",
          "committed_at": "2026-07-20T21:55:42Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6c88a40099a92977c82b6dcca9b0949093ad63fa",
          "body": "FieldHistory(ctx, kind, id, path, as) walks how the recorded value of one\nfield changed over transaction time, holding a valid-time point fixed — who\nchanged it, when we learned it, and whether it was an assertion or a\ncorrection. This is the read the design promised and the capability\nSalesforce se\n[…]\nf the rest of the log.\n\nAdds FieldHistory to chroniclefest so both stores are certified, unit tests\nfor the pointer machinery, and a long-history benchmark. New files 100%\ncovered; root package 97.0%.",
          "is_bot": false,
          "headline": "feat: field history, the single-field audit trail",
          "author_name": "Zac Krebbekx",
          "author_login": "zkrebbekx",
          "committed_at": "2026-07-20T21:55:32Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d3a38e2d50528974a4d853202ba8b91be48dfd41",
          "body": null,
          "is_bot": false,
          "headline": "build(chronicled): require pgstore v0.1.2",
          "author_name": "Zac Krebbekx",
          "author_login": "zkrebbekx",
          "committed_at": "2026-07-20T16:37:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "74e7366264151b506fe7c0a564c4d4e1f80ee761",
          "body": "…udo-version\n\npgstore's go.mod named chronicle at v0.0.0-00010101…, which resolves only\nthrough the local replace directive. A downstream that pulls pgstore\ntransitively ignores that replace and needs a real version to select. Pin\nv0.1.0, the release whose API pgstore is built against; the replace stays for\nlocal development.",
          "is_bot": false,
          "headline": "build(pgstore): require the released chronicle v0.1.0, not a zero pse…",
          "author_name": "Zac Krebbekx",
          "author_login": "zkrebbekx",
          "committed_at": "2026-07-20T16:36:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a3b2df99e04f5fecbbfd5d24ab63d2dc41b716ef",
          "body": "Keeps the module graph honest ahead of a chronicled tag: the replace\ndirective builds against the working tree, but the recorded requirement\nshould name the pgx-patched pgstore, not the withdrawn v0.1.0 line.",
          "is_bot": false,
          "headline": "build(chronicled): point pgstore requirement at v0.1.1",
          "author_name": "Zac Krebbekx",
          "author_login": "zkrebbekx",
          "committed_at": "2026-07-20T16:34:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0aba99a189daeb6344a5d94639ff522b1f2f93f2",
          "body": "Two fixes:\n\n- The valid-time microsecond truncation added for the write-response echo was\n  applied in the shared time parser, so it also truncated query instants.\n  Truncating a txAt downward steps it before an in-memory store's\n  full-resolution TxFrom and misses the record — invisible on a macOS \n[…]\n5 floor, so both modules move to 1.25 and their CI\n  matrices collapse to 1.25; the lint job moves to 1.25 to load them. The\n  zero-dependency root module is unaffected and keeps its 1.23..1.25 range.",
          "is_bot": false,
          "headline": "fix: query-time truncation regression, and patch pgx to 5.9.2",
          "author_name": "Zac Krebbekx",
          "author_login": "zkrebbekx",
          "committed_at": "2026-07-20T16:31:28Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c3d02945d57e04929459a5799cba6dd6c702eed6",
          "body": "Security review (auth/attribution — no critical/high/medium; actor\nattribution airtight) and semantics review (faithful wrapper — no majors)\neach surfaced fixable edges:\n\n- Panic recovery middleware: a handler panic now renders as a JSON 500\n  through the error contract instead of a dropped connecti\n[…]\n- Docs: CHRONICLED_LOG_LEVEL added to the README; the OpenAPI error-code list\n  separates default-deployment codes from those only reachable in non-default\n  deployments or from an out-of-band writer.",
          "is_bot": false,
          "headline": "fix(chronicled): harden the HTTP surface from two adversarial reviews",
          "author_name": "Zac Krebbekx",
          "author_login": "zkrebbekx",
          "committed_at": "2026-07-20T16:25:35Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "fc971c15a186acb7a0ca76d380cb225699413a6f",
          "body": "README gains Running the service: the docker compose quickstart, the\nflagship bitemporal scenario as curl, the actor-attribution rule, and the\nhonest scope note (API-key auth, single trust zone, put mTLS/OIDC in\nfront for anything bigger).\n\nDESIGN.md gains the phase 4 section and two Corrections fou\n[…]\nat deserves stating.\nAlso recorded: the retain clock-skew caveat surfacing at the HTTP\nboundary (caught live by the integration suite), and the URL namespace\nnote for kinds named like fixed endpoints.",
          "is_bot": false,
          "headline": "docs: phase 4 record — the service, and what building it corrected",
          "author_name": "Zac Krebbekx",
          "author_login": "zkrebbekx",
          "committed_at": "2026-07-20T15:58:53Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3a12583dfaa48583b94760746128fde26f3f69a9",
          "body": "chronicled shares pgstore's CI shape: a go 1.24/1.25 matrix with the\npostgres service container for the integration suite plus coverage, and\na separate no-database job asserting the fast path skips cleanly. The\nlint matrix gains the module, as do the Makefile's test/lint/vet/tidy\ntargets and a cover-chronicled target.",
          "is_bot": false,
          "headline": "ci: chronicled jobs and lint matrix",
          "author_name": "Zac Krebbekx",
          "author_login": "zkrebbekx",
          "committed_at": "2026-07-20T15:58:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a5605f7f3881572740d15b27a41a8089975dcd48",
          "body": "Multi-stage Dockerfile from the repository root (the nested module needs\nits replace-directive siblings), CGO_ENABLED=0, into\ndistroless/static-debian12:nonroot — the runtime is the one static\nbinary, verified by driving the flagship scenario through the composed\nstack. docker compose up brings Postgres and chronicled up migrated,\nchaining on, with clearly-marked demo tokens.",
          "is_bot": false,
          "headline": "build(chronicled): distroless image and one-command demo",
          "author_name": "Zac Krebbekx",
          "author_login": "zkrebbekx",
          "committed_at": "2026-07-20T15:58:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "eb3fddc2541a0c74805c96f75735ee67b1eb93d7",
          "body": "The flexitype-pattern deployment for polyglot shops that cannot import\nthe Go library: one chronicle.Log per process over pgstore, JSON over\nstdlib net/http (Go 1.22 pattern routing). The dependency budget is the\nstory — chronicle, pgstore, and pgx as the driver; no router, no config\nlibrary, no log\n[…]\nrough HTTP, pagination walk equal to the library\nwalk, holds withholding sweeps, tombstoned deletion under chaining,\nshredding), and a boot test covering migration, auth and graceful\ndrain end to end.",
          "is_bot": false,
          "headline": "feat(chronicled): standalone REST service over pgstore",
          "author_name": "Zac Krebbekx",
          "author_login": "zkrebbekx",
          "committed_at": "2026-07-20T15:58:29Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6a8752eb4be2a714cf80ce483d2a1198a1108ec9",
          "body": "The blanket dependency bump raised pgx to v5.10.0, whose go directive is\n1.25.0 — silently lifting pgstore's floor past two-thirds of the CI matrix.\nPin pgx to v5.8.0 (go 1.24), which also drops x/crypto from the module\ngraph entirely, removing the dependency Dependabot was flagging rather\nthan patching it. pgstore's matrix loses go 1.23, which is past upstream\nEOL; the zero-dependency root module keeps 1.23.",
          "is_bot": false,
          "headline": "fix(pgstore): pin driver deps to the go 1.24 line",
          "author_name": "Zac Krebbekx",
          "author_login": "zkrebbekx",
          "committed_at": "2026-07-20T15:20:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "57575da2c0cdb4117e46997b128b852e3f89e138",
          "body": "The metadata NUL rejection closed one store-conformance divergence and left\nfive open: kind, entity ID, actor fields and reason all reach PostgreSQL\ntext columns, which reject NUL (22021) where MemStore accepts it — the same\nwrite succeeding on one store and failing on the other, reachable from the\n\n[…]\nnd unicode stay accepted, since rejecting more than necessary\nwould be a different bug.\n\nAlso bumps pgstore's test-only dependencies (pgx v5.10.0, x/crypto v0.54.0)\npast the versions Dependabot flags.",
          "is_bot": false,
          "headline": "fix: reject NUL in every caller-supplied text field, not just metadata",
          "author_name": "Zac Krebbekx",
          "author_login": "zkrebbekx",
          "committed_at": "2026-07-20T15:14:50Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "0a7e6ccfa1f677ee9d23d783b02dbeadd1dc4fd4",
          "body": "Applying the documentation review against the post-phase-3 tree:\n\n- README: one Log serializes its writes end-to-end, so \"writes to\n  different entities do not contend\" holds at the store level only —\n  run one Log per worker over pgstore where that matters; the\n  DEFERRABLE justification matches th\n[…]\necords lock narrowing as open\n  question 8 rather than pretending the contention claim was true.\n- cursor.go: EncodeCursor documents the two seeded-ID edges (\\x1f in\n  an ID, RFC 3339's year ceiling).",
          "is_bot": false,
          "headline": "docs: reconcile claims with the shipped code",
          "author_name": "Zac Krebbekx",
          "author_login": "zkrebbekx",
          "committed_at": "2026-07-20T15:05:10Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e74764d0ed1c7a8348b5a5ffb9e8a3ad9d0b735b",
          "body": "… wider tx floor\n\n- Migrate (store and keyring alike) runs its DDL inside one\n  transaction behind pg_advisory_xact_lock on the (schema, table)\n  pair. IF NOT EXISTS is idempotent but not atomic: N replicas\n  booting against a fresh schema raced CREATE TABLE and the losers\n  crashed on the duplicate\n[…]\n-plan-apply design instead of the pre-Planner one, and the\n  DEFERRABLE justification (also in schema.sql) no longer claims an\n  insert-first intermediate state the close-first Apply never\n  produces.",
          "is_bot": false,
          "headline": "fix(pgstore): concurrent first-boot Migrate, typed schema rejections,…",
          "author_name": "Zac Krebbekx",
          "author_login": "zkrebbekx",
          "committed_at": "2026-07-20T15:04:54Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "48a81d958167759f62a8acde6ef2e503aa68cd5d",
          "body": "… diffs\n\nFindings from three independent adversarial reviews, root module:\n\n- MemStore.Apply validates every strict supersession target before\n  mutating anything, so ErrConflict keeps its documented contract:\n  nothing is applied. A stale or missing ID late in the list used to\n  leave the earlier t\n[…]\non the As doc.\n- The concurrency suite now asserts what its name claims: exactly one\n  non-remainder record per transaction instant, where the old check\n  of record-ID uniqueness held by construction.",
          "is_bot": false,
          "headline": "fix: half-applied conflicts, zero-clock ratchet bypass, notation-only…",
          "author_name": "Zac Krebbekx",
          "author_login": "zkrebbekx",
          "committed_at": "2026-07-20T15:04:42Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5517f1ef0dcef3602882715339a08a46b2ecdf55",
          "body": "DESIGN.md gains the phase 3 record and four new inline Corrections,\ncontinuing the practice of recording spec flaws where they were found:\n\n- 'suspends deletion for scoped records from that moment' invited a\n  wrong implementation — EffectiveFrom gates when a hold is active,\n  never which records it\n[…]\nns. The shredding section carries the COMPLIANCE.md hedge verbatim\nand makes no GDPR claim; the chaining section states the threat model\nand both documented edges (microsecond canonicalization, TxTo).",
          "is_bot": false,
          "headline": "docs: phase 3 record — corrections, honest wording, compliance sections",
          "author_name": "Zac Krebbekx",
          "author_login": "zkrebbekx",
          "committed_at": "2026-07-20T14:32:24Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f031aa67991382c93ff0926d10a087178c1c220a",
          "body": "…nes, keyring\n\nSchema grows two derived tables, created idempotently by the same\nMigrate: <table>_holds, whose rows are written once at placement and\ncompleted at release and never deleted, with CHECK constraints keeping\nboth halves attributed; and <table>_tombstones, keyed on record_id so a\nretried\n[…]\n,\nrelease, archive hook, tombstoned Verify, shred, then a real SQL UPDATE\nthat Verify catches), holds across two pools, sad paths over an\nunmigrated schema, and a corrupted stored key. Coverage 90.2%.",
          "is_bot": false,
          "headline": "feat(pgstore): compliance capabilities — holds, deletion with tombsto…",
          "author_name": "Zac Krebbekx",
          "author_login": "zkrebbekx",
          "committed_at": "2026-07-20T14:28:10Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f51585c1f4858a62f259bafd678caba5008bc0e4",
          "body": "…th fault injection\n\nRunCompliance holds a store claiming Deleter and HoldStore to the whole\ncontract: refusal of current records is all-or-nothing, tombstones are\nreadable and retry-stable, holds accept a backdated EffectiveFrom but\nnever a caller-supplied PlacedAt, and release keeps the row. RunKe\n[…]\nliasing keyring — its snapshot aliased the same slice\nit later compared against — which is the standing argument for testing\nthe suite against broken implementations before trusting it with real\nones.",
          "is_bot": false,
          "headline": "test(chroniclefest): conformance for deletion, holds and keyrings, wi…",
          "author_name": "Zac Krebbekx",
          "author_login": "zkrebbekx",
          "committed_at": "2026-07-20T14:19:08Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "258b6cbe463a9f6ab551ccca005f6170dd948f63",
          "body": "… hook\n\nA separate package, deliberately: importing chronicle/retain is\ngreppable evidence that a codebase destroys history, and the core\npackage keeps its nothing-is-ever-destroyed posture intact.\n\n- Policy{Kind, KeepFor}: eligibility runs from TxTo — how long a record\n  has been superseded — never\n[…]\n and the\n  store's deletion, so a retry after a partial failure re-archives.\n- Batched keyset paging via WithBatchSize, safe against mid-sweep\n  deletion because a cursor is a position, not an offset.",
          "is_bot": false,
          "headline": "feat(retain): retention sweeper with dry-run, hold checks and archive…",
          "author_name": "Zac Krebbekx",
          "author_login": "zkrebbekx",
          "committed_at": "2026-07-20T14:14:18Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9418497d6628d5c2be84171cf13d225955e3853c",
          "body": "The compliance layer's root-module half, feature by feature:\n\n- Hold and HoldStore: legal holds with operator-asserted, backdatable\n  EffectiveFrom (FRCP 37(e)'s trigger is anticipation, judged after the\n  fact), store-assigned PlacedAt, and releases that keep the row.\n- Deleter: an optional destruc\n[…]\neaks a chain. No GDPR claim is made anywhere.\n\nCaller metadata in the chronicle: namespace is now rejected, since a\ncaller who could write chain or cipher markers could forge exactly what\nthey attest.",
          "is_bot": false,
          "headline": "feat: legal hold, deletion, hash chaining and crypto-shredding core",
          "author_name": "Zac Krebbekx",
          "author_login": "zkrebbekx",
          "committed_at": "2026-07-20T14:14:03Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5f023958c64d7fa20814acc4575ed4baf0b93891",
          "body": "KindError.Error and CodecError.Unwrap had no coverage at all. The error\ntypes are what a caller pattern-matches on, so their messages and their\nunwrapping are API: a message naming the wrong field, or an Unwrap dropping\nthe cause, breaks callers as surely as a changed signature would.\n\nAdd the branc\n[…]\nlic API: the\ncrypto/rand failure in newNodeToken, MemStore's ErrClosed guards inside\nmethods already holding the lock that checked it, and chroniclefest's\n1000-page pagination-did-not-terminate bound.",
          "is_bot": false,
          "headline": "test: cover the error types and the log's store-failure paths",
          "author_name": "Zac Krebbekx",
          "author_login": "zkrebbekx",
          "committed_at": "2026-07-20T13:22:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "54620d64f5865a8219b024efc25310925b945a99",
          "body": "The suite sat at 79% statement coverage with every uncovered statement one\nof its own t.Fatalf branches: they had never executed, because both stores\npass. A suite that has never been observed to fail is not evidence. An\ninverted comparison or a mistyped variable in one of those branches would\nlet a\n[…]\n was midnight on the first of a month, so\n    a store rounding valid time agreed with all of them by coincidence.\n\nchroniclefest coverage 79.3% -> 99.8%. pgstore passes all three new checks\nunchanged.",
          "is_bot": false,
          "headline": "test(chroniclefest): prove the conformance suite detects what it claims",
          "author_name": "Zac Krebbekx",
          "author_login": "zkrebbekx",
          "committed_at": "2026-07-20T13:22:44Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "38398f9fb99ae5ec4d8b6cc29f3707df77bd07e4",
          "body": "A nested module so the root stays dependency-free. The adapter imports\nonly database/sql and the standard library, so callers bring their own\ndriver; pgx is a test-only dependency of this module.\n\nSchema, embedded and applied by Migrate:\n\n- tstzrange for both axes as stored generated columns, NULL f\n[…]\nnstraint on a\npartitioned table must include the partition key with equality, and\ntx_from WITH = is meaningless for non-overlap. Recorded as a correction;\nretention in phase 3 needs another mechanism.",
          "is_bot": false,
          "headline": "feat(pgstore): PostgreSQL storage adapter",
          "author_name": "Zac Krebbekx",
          "author_login": "zkrebbekx",
          "committed_at": "2026-07-20T12:52:20Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6c92db0d4530b3598ed37bccbc6f2e75ceb12240",
          "body": "A write to one entity is a read-modify-write: read the overlapping\nrecords, compute the split, apply it. All three have to be indivisible.\nThe previous shape had the log read through Query and hand Apply a\nfinished Write, with the store detecting a stale plan and reporting\nErrConflict for the log to\n[…]\ncords,\nQuery.Matches and Query.Validate. An out-of-module store cannot produce\ncursors that behave identically to MemStore's without them, and identical\nbehaviour is the contract chroniclefest checks.",
          "is_bot": false,
          "headline": "refactor!: Apply takes a plan, so the read is inside the store's lock",
          "author_name": "Zac Krebbekx",
          "author_login": "zkrebbekx",
          "committed_at": "2026-07-20T12:52:05Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "fa9295e21a60ee735e9f866f2589072a7ef79f9f",
          "body": "A behavioural contract that lives only in the reference implementation's\nown tests is not a contract. The second store gets written against\nwhatever the first happened to do, and the two drift on the cases nobody\nwrote down: half-open boundaries, cursor ties, whether a supersession is\nidempotent.\n\nc\n[…]\ngap: MemStore.Apply stored whatever\nTxFrom an incoming record carried instead of stamping the write's own\ninstant, which gave callers a back door onto the axis the whole design\nsays they cannot write.",
          "is_bot": false,
          "headline": "test: add chroniclefest, a shared Store conformance suite",
          "author_name": "Zac Krebbekx",
          "author_login": "zkrebbekx",
          "committed_at": "2026-07-20T12:16:07Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "25bd0af7f919b2507ffcd14a017850bafc569782",
          "body": "Store is now Apply + Get + Query. Put and Supersede are gone, and with\nthem the fallback path that ran a supersession and an insertion as two\nuncoordinated calls -- correct only when no concurrent reader exists,\nwhich is a precondition no library can check and no caller thinks about.\n\nApply now owns\n[…]\n gain a per-log random token. Two processes minting an ID from\na timestamp and a per-process sequence can collide, and the store's\nprimary key would then silently discard one of two concurrent writes.",
          "is_bot": false,
          "headline": "refactor!: promote Apply into Store and give it the transaction axis",
          "author_name": "Zac Krebbekx",
          "author_login": "zkrebbekx",
          "committed_at": "2026-07-20T12:15:43Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a0dd4bba086825bcd0fc5108fe90526594f51b71",
          "body": "…en questions\n\nPhase 1 implementation surfaced three correctness defects in the design:\n\n- The split Put/Supersede store interface cannot express an atomic\n  supersede-plus-insert, so the non-overlap invariant was unenforceable\n  through it. Replaced with a single Apply taking both halves.\n- Postgre\n[…]\ns open questions 2-4, records remainder attribution as question 5,\nand corrects the failure-modes table, which credited the optional Reason field\nwith capturing intent it cannot be relied on to carry.",
          "is_bot": false,
          "headline": "docs: correct Store interface, Postgres isolation requirements and op…",
          "author_name": "Zac Krebbekx",
          "author_login": "zkrebbekx",
          "committed_at": "2026-07-20T11:47:59Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a15d541265a7fb12fbf81fd4de55b8c25e167608",
          "body": "chronicle records what an entity was over valid time, and what was\nbelieved about it over transaction time. Phase 1 ships the temporal\nengine and its query surface; the Postgres adapter, the REST service and\nthe retention/legal-hold layer come later.\n\nValid time is caller-supplied; transaction time \n[…]\nndencies, stdlib testing only, 96.6% statement coverage, clean\nunder vet, gofmt -s, golangci-lint and -race. Invariants are asserted\nafter every step of a seeded property test and under go test -fuzz.",
          "is_bot": false,
          "headline": "feat: bitemporal entity change history core model and in-memory store",
          "author_name": "Zac Krebbekx",
          "author_login": "zkrebbekx",
          "committed_at": "2026-07-20T11:45:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        }
      ],
      "releases_count": 2,
      "commits_last_year": 38,
      "latest_release_at": "2026-07-20T22:18:25Z",
      "latest_release_tag": "v0.2.0",
      "releases_from_tags": true,
      "days_since_last_push": 2,
      "active_weeks_last_year": 1,
      "days_since_latest_release": 8,
      "mean_days_between_releases": 0.3
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": false,
      "health_percentage": 57,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "github.com/zkrebbekx/chronicle",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": true,
          "registry_url": "https://pkg.go.dev/github.com/zkrebbekx/chronicle",
          "is_deprecated": false,
          "latest_version": "v0.2.0",
          "repository_url": "https://github.com/zkrebbekx/chronicle",
          "versions_count": 2,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-20T22:18:25Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 8
        },
        {
          "name": "github.com/zkrebbekx/chronicle/pgstore",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": true,
          "registry_url": "https://pkg.go.dev/github.com/zkrebbekx/chronicle/pgstore",
          "is_deprecated": false,
          "latest_version": "v0.1.2",
          "repository_url": "https://github.com/zkrebbekx/chronicle",
          "versions_count": 3,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-20T16:36:09Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 9
        },
        {
          "name": "github.com/zkrebbekx/chronicle/chronicled",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": true,
          "registry_url": "https://pkg.go.dev/github.com/zkrebbekx/chronicle/chronicled",
          "is_deprecated": false,
          "latest_version": "v0.2.0",
          "repository_url": "https://github.com/zkrebbekx/chronicle",
          "versions_count": 2,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-20T22:20:17Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 8
        }
      ]
    },
    "popularity": {
      "forks": 0,
      "stars": 0,
      "watchers": 0,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 0
      },
      "star_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_stars": 0,
        "collected_at": null
      },
      "open_issues_and_prs": 1
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [
        "examples"
      ],
      "has_llms_txt": false,
      "has_dockerfile": true,
      "has_mcp_signal": false,
      "bootstrap_files": [
        "Makefile"
      ],
      "api_schema_files": [
        "chronicled/internal/api/openapi.yaml"
      ],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [
        "chronicled/go.mod",
        "examples/go.mod",
        "go.mod",
        "pgstore/go.mod"
      ],
      "largest_source_bytes": 56636,
      "source_files_sampled": 87,
      "oversized_source_files": 0,
      "agent_instruction_files": [],
      "agent_instruction_max_bytes": null
    },
    "dependencies": {
      "manifests": [
        "chronicled/go.mod",
        "examples/go.mod",
        "go.mod",
        "pgstore/go.mod"
      ],
      "advisories": {
        "error": null,
        "scope": "repository_graph",
        "source": "osv",
        "findings": [
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.30.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5970"
            ],
            "fixed_version": "0.39.0",
            "advisory_count": 1,
            "oldest_advisory_days": 15
          }
        ],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {
          "unknown": 1
        },
        "advisory_count": 1,
        "affected_count": 1,
        "assessed_count": 6,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "go"
      ],
      "dependencies": [
        {
          "name": "github.com/jackc/pgx/v5",
          "manifest": "chronicled/go.mod",
          "ecosystem": "go",
          "version_constraint": "v5.9.2"
        },
        {
          "name": "github.com/zkrebbekx/chronicle",
          "manifest": "chronicled/go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.2.0"
        },
        {
          "name": "github.com/zkrebbekx/chronicle/pgstore",
          "manifest": "chronicled/go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.2"
        },
        {
          "name": "github.com/jackc/pgx/v5",
          "manifest": "pgstore/go.mod",
          "ecosystem": "go",
          "version_constraint": "v5.9.2"
        },
        {
          "name": "github.com/zkrebbekx/chronicle",
          "manifest": "pgstore/go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.0"
        }
      ],
      "all_dependencies": {
        "error": null,
        "source": "github-sbom",
        "packages": [
          {
            "name": "github.com/jackc/pgx/v5",
            "direct": true,
            "version": "v5.9.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jackc/pgpassfile",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jackc/pgservicefile",
            "direct": false,
            "version": "v0.0.0-20240606120523-5a60cdf6a761",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jackc/puddle/v2",
            "direct": false,
            "version": "v2.2.2",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sync",
            "direct": false,
            "version": "v0.17.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.30.0",
            "ecosystem": "go"
          }
        ],
        "collected": true,
        "truncated": false,
        "total_count": 6,
        "direct_count": 1,
        "indirect_count": 5
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 1,
        "merged_prs": 0,
        "open_issues": 0,
        "closed_ratio": null,
        "closed_issues": 0,
        "closed_unmerged_prs": 4
      },
      "bus_factor": 1,
      "bot_contributors": 0,
      "top_contributors": [
        {
          "type": "User",
          "login": "zkrebbekx",
          "commits": 38,
          "avatar_url": "https://avatars.githubusercontent.com/u/334641?v=4"
        }
      ],
      "contributors_sampled": 1,
      "top_contributor_share": 1
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "ci.yml",
        "pages.yml"
      ],
      "has_docs_dir": true,
      "linter_configs": [
        ".golangci.yml"
      ],
      "has_editorconfig": false,
      "has_linter_config": true,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "go.sum"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": null,
            "reason": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": null,
            "reason": "no pull request found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/30 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 0,
            "reason": "project has 0 contributing companies or organizations -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 10,
            "reason": "update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 10,
            "reason": "project is fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 0,
            "reason": "project was created within the last 90 days. Please review its contents carefully",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": null,
            "reason": "packaging workflow not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 6,
            "reason": "dependency not pinned by hash detected -- score normalized to 6",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "no SAST tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 10,
            "reason": "security policy file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": null,
            "reason": "no releases found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 10,
            "reason": "GitHub workflow tokens follow principle of least privilege",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 9,
            "reason": "1 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "26de2d21ac8ebb23274576b97e69e13d86b875ea",
        "ran_at": "2026-07-29T17:39:22Z",
        "aggregate_score": 6.6,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": true,
      "has_dependabot_config": true
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-27T15:07:57Z",
      "oldest_open_prs": [
        {
          "number": 5,
          "created_at": "2026-07-20T16:02:02Z",
          "last_comment_at": null,
          "last_comment_author": null
        }
      ],
      "last_merged_pr_at": null,
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": []
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/zkrebbekx/chronicle",
    "host": "github.com",
    "name": "chronicle",
    "owner": "zkrebbekx"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "moderate",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 56,
      "inputs": {
        "security": 73,
        "vitality": 66,
        "community": 24,
        "governance": 34,
        "engineering": 88
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "moderate",
        "name": "Vitality",
        "value": 66,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "moderate",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 51,
            "inputs": {
              "commits_last_year": 38,
              "human_commit_share": 1,
              "days_since_last_push": 2,
              "active_weeks_last_year": 1
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 2 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 2
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "1/52 weeks with commits",
                "points": 0.7,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 1
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "38 commits in the last year",
                "points": 14.3,
                "status": "partial",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 38
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 88,
            "inputs": {
              "releases_count": 2,
              "latest_release_tag": "v0.2.0",
              "releases_from_tags": true,
              "days_since_latest_release": 8,
              "mean_days_between_releases": 0.3
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "2 version tags (no GitHub releases)",
                "points": 16.2,
                "status": "partial",
                "details": [
                  {
                    "code": "version_tags_no_releases",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 8 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 8
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~0.3 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 0.3
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "critical",
        "name": "Community & Adoption",
        "value": 24,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 1,
            "inputs": {
              "forks": 0,
              "stars": 0,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "0 stars",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "0 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "moderate",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 50,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": false,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (MIT)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "MIT"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "at_risk",
        "name": "Sustainability & Governance",
        "value": 34,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 10,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 1,
              "top_contributor_share": 1
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 100% of commits",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 100
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "1 contributors",
                "points": 1.4,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 0 contributing companies or organizations -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "critical",
            "name": "Issue & PR responsiveness",
            "note": "Excluded from scoring (no data or not applicable): Issue resolution. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "issue_resolution"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 1,
            "inputs": {
              "merged_prs": 0,
              "open_issues": 0,
              "closed_issues": 0,
              "issue_closed_ratio": null,
              "closed_unmerged_prs": 4
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "no issues or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_issues_or_data",
                    "params": {}
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "0/4 decided PRs merged",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 0,
                      "decided": 4
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "at_risk",
            "name": "Ownership & stewardship",
            "note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "verified_domain"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 49,
            "inputs": {
              "followers": 5,
              "owner_type": "User",
              "is_verified": null,
              "owner_login": "zkrebbekx",
              "public_repos": 36,
              "account_age_days": 5856
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "personal (user) account",
                "points": 10,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_personal",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": "not applicable to user accounts",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_applicable_to_user_accounts",
                    "params": {}
                  }
                ],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "5 followers of zkrebbekx",
                "points": 5.6,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 5,
                      "login": "zkrebbekx"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "36 public repos, account ~16 yr old",
                "points": 23.4,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 36
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 16
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 92,
            "inputs": {
              "packages": [
                "github.com/zkrebbekx/chronicle",
                "github.com/zkrebbekx/chronicle/pgstore",
                "github.com/zkrebbekx/chronicle/chronicled"
              ],
              "ecosystems": "go",
              "any_deprecated": false,
              "min_days_since_publish": 8
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "3 package(s) on go",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 3,
                      "ecosystems": "go"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 8 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 8
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "3 published versions",
                "points": 12,
                "status": "partial",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 3
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "excellent",
        "name": "Engineering Quality",
        "value": 88,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "good",
            "name": "Engineering practices",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_ci_tests"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 80,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": true,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "2 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": ".golangci.yml",
                "points": 16,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yml"
                    }
                  }
                ],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "excellent",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "topics": [
                "audit-log",
                "audit-trail",
                "bitemporal",
                "change-history",
                "compliance",
                "database",
                "effective-dating",
                "go",
                "golang",
                "postgresql",
                "temporal-data",
                "versioning"
              ],
              "has_wiki": true,
              "homepage": "https://zkrebbekx.github.io/chronicle/",
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": "https://zkrebbekx.github.io/chronicle/",
                "points": 15,
                "status": "met",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": "12 topics",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "topics_count",
                    "params": {
                      "count": 12
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "good",
        "name": "Security",
        "value": 73,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "moderate",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): Branch-Protection, CI-Tests, Packaging, Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "branch_protection",
                    "ci_tests",
                    "packaging",
                    "signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 66,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 14,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 4,
              "scorecard_aggregate": 6.6
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 0 contributing companies or organizations -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "update tool detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is fuzzed",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow not detected",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 6",
                "points": 3,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "no SAST tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "GitHub workflow tokens follow principle of least privilege",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "1 existing vulnerabilities detected",
                "points": 6.8,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "excellent",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 6 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "indirect_dependencies_free_of_known_advisories",
                    "no_advisories_left_outstanding"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_repository",
                "params": {
                  "assessed": 6
                }
              },
              {
                "code": "advisories_repo_graph_caveat",
                "params": {}
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "source": "osv",
              "advisories": 1,
              "affected_packages": 1,
              "assessed_packages": 6,
              "unassessed_packages": 0,
              "affected_by_severity": "unknown 1",
              "direct_affected_packages": 0
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "no direct dependency carries a known advisory",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "no_direct_advisories",
                    "params": {}
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "transitive set not separable from development and test dependencies in this scope",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_scope_not_separable",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory carries a publication date",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_no_publication_date",
                    "params": {}
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 6,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 2
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "good",
        "name": "AI Readiness",
        "value": 72,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "at_risk",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 1,
              "agent_instruction_files": [],
              "agent_instruction_max_bytes": null
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "no CLAUDE.md / AGENTS.md / editor rules",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_instructions",
                    "params": {}
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "38 of 38 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 38,
                      "sampled": 38
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "good",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 83,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "go.sum"
              ],
              "has_dockerfile": true,
              "typed_language": true,
              "bootstrap_files": [
                "Makefile"
              ],
              "has_devcontainer": false,
              "has_linter_config": true,
              "typecheck_configs": [],
              "agent_commit_share": 0,
              "toolchain_manifests": [
                "chronicled/go.mod",
                "examples/go.mod",
                "go.mod",
                "pgstore/go.mod"
              ],
              "dependency_bot_commit_share": 0
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "Makefile",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Makefile"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": ".golangci.yml",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yml"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "Go (statically typed)",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "Dockerfile, lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Dockerfile, lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "no agent-authored commits among the last 38",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_authored_commits",
                    "params": {
                      "sampled": 38
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "dependency automation configured, none observed in the sampled commits",
                "points": 5,
                "status": "partial",
                "details": [
                  {
                    "code": "dependency_bot_config_only",
                    "params": {}
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 6",
                "points": 6,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "Go",
              "largest_source_bytes": 56636,
              "source_files_sampled": 87,
              "oversized_source_files": 0
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Go (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "0/87 source files over 60KB",
                "points": 55,
                "status": "met",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 87,
                      "oversized": 0
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "good",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 80,
            "inputs": {
              "example_dirs": [
                "examples"
              ],
              "has_mcp_signal": false,
              "api_schema_files": [
                "chronicled/internal/api/openapi.yaml"
              ]
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": "chronicled/internal/api/openapi.yaml",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "chronicled/internal/api/openapi.yaml"
                    }
                  }
                ],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": "examples",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "examples"
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [],
  "report_type": "repository",
  "generated_at": "2026-07-29T17:39:26.845638Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/z/zkrebbekx/chronicle.svg",
  "full_name": "zkrebbekx/chronicle",
  "license_state": "standard",
  "license_spdx": "MIT"
}