Caua-ferraz / AgentGuard

Full resolved dependency set from the GitHub dependency graph: 4 direct and 33 indirect (transitive) packages. The transitive closure is complete when the repository commits a lockfile.

This repository publishes no package the index resolves, so its own dependency graph was assessed — 21 packages, which also include development and test pins that never ship: 0 carry known advisories, of which 0 are direct. 16 could not be assessed — no resolved version, an unsupported ecosystem, or beyond the reported package list.

No known advisories affect the assessed dependencies.

An advisory means the version recorded in the dependency graph falls inside an advisory’s affected range. Reachability is not analysed, and the graph includes development and test pins — a finding may concern tooling rather than shipped software.

{
  "data": {
    "repo": {
      "topics": [],
      "is_fork": false,
      "size_kb": 2592,
      "has_wiki": true,
      "homepage": null,
      "languages": {
        "Go": 2106201,
        "Shell": 14893,
        "Python": 479802,
        "Makefile": 3016,
        "Dockerfile": 1060,
        "JavaScript": 953,
        "TypeScript": 82937
      },
      "pushed_at": "2026-07-29T09:14:13Z",
      "created_at": "2026-03-25T01:04:28Z",
      "owner_type": "User",
      "updated_at": "2026-07-22T03:45:36Z",
      "description": "AgentGuard is a firewall for AI agents, preventing that any unwanted surprises go without supervision by your agent",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "Apache-2.0",
      "default_branch": "master",
      "license_spdx_raw": "Apache-2.0",
      "primary_language": "Go",
      "significant_languages": [
        "Go",
        "Python"
      ]
    },
    "owner": {
      "blog": "https://www.cauaferraz.dev/",
      "name": "Cauã Ferraz",
      "type": "User",
      "login": "Caua-ferraz",
      "company": null,
      "location": null,
      "followers": 4,
      "avatar_url": "https://avatars.githubusercontent.com/u/124847643?v=4",
      "created_at": "2023-02-09T01:09:45Z",
      "is_verified": null,
      "public_repos": 5,
      "account_age_days": 1268
    },
    "license": {
      "state": "standard",
      "spdx_id": "Apache-2.0",
      "raw_spdx": "Apache-2.0",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v1.0.0",
          "kind": "major",
          "published_at": "2026-07-22T14:13:56Z"
        },
        {
          "tag": "v0.9.0",
          "kind": "minor",
          "published_at": "2026-07-09T04:03:12Z"
        },
        {
          "tag": "V0.6.0",
          "kind": "other",
          "published_at": "2026-06-08T22:37:33Z"
        },
        {
          "tag": "v0.5.2",
          "kind": "patch",
          "published_at": "2026-06-02T00:23:55Z"
        },
        {
          "tag": "v0.5.1",
          "kind": "patch",
          "published_at": "2026-05-11T22:15:29Z"
        },
        {
          "tag": "v0.5.0",
          "kind": "minor",
          "published_at": "2026-05-07T16:26:11Z"
        },
        {
          "tag": "V0.4.0",
          "kind": "other",
          "published_at": "2026-04-16T05:48:17Z"
        },
        {
          "tag": "v0.3.0",
          "kind": "minor",
          "published_at": "2026-03-30T22:12:51Z"
        },
        {
          "tag": "V0.2.3",
          "kind": "other",
          "published_at": "2026-03-29T03:53:00Z"
        },
        {
          "tag": "V0.2",
          "kind": "other",
          "published_at": "2026-03-28T01:09:26Z"
        },
        {
          "tag": "V0.1.0",
          "kind": "other",
          "published_at": "2026-03-27T15:48:48Z"
        },
        {
          "tag": "V0.0.2",
          "kind": "other",
          "published_at": "2026-03-26T19:25:03Z"
        },
        {
          "tag": "MainBranchs",
          "kind": "other",
          "published_at": "2026-03-25T01:12:01Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "abcfb0f840bcb499e8adb10a7a0ba25f86a628e5",
          "body": null,
          "is_bot": false,
          "headline": "v1 release note merge",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-07-22T03:45:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "de07a2b6d0d2318aded77329b913291e6ae82285",
          "body": "Feat/v1.0 multinode",
          "is_bot": false,
          "headline": "Merge pull request #36 from Caua-ferraz/feat/v1.0-multinode",
          "author_name": "Cauã Ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-07-22T03:34:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5c2b2381f4d1df1cb4d4523efa4ab6abe59c0749",
          "body": "Bump golang.org/x/text v0.29.0 -> v0.39.0 for GO-2026-5970 (infinite\nloop on invalid input), reachable via pgx in pkg/store/postgres.go.\nClears both govulncheck and the live OSV.dev dep-audit gate. `go mod\ntidy` also carried x/sync v0.17.0 -> v0.21.0 (both indirect).\n\nTestBufferedAsync_RecoveryLoopD\n[…]\nmps\ndrainedFromOverflow + the metric only after the trailing Close/Remove\nsyscalls, so waiting on cap.Count() >= 5 raced the drain-counter and\nfile-removal assertions and flaked on the Windows runner.",
          "is_bot": false,
          "headline": "fix(ci): patch x/text CVE + de-flake audit recovery-drain test",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-07-22T03:28:51Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9faca48dfee2f9392d00cfa4074f6df798a91e28",
          "body": null,
          "is_bot": false,
          "headline": "general log fixes",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-07-22T02:28:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "bf234e80f95127bb09c9c60b3fbf75722a4d08ad",
          "body": "MCP Gateway protocol-coverage docs truthed up: the gateway brokers tools/*\nonly; resources/* and prompts/* are masked by MergeCapabilities (not\n\"forwarded verbatim\"), and notifications/cancelled is a latent no-op\n(host-space vs gateway-internal request-id spaces). A dropped server-initiated\nframe ca\n[…]\ne retired 60s marketing assets. (The gitignored CLAUDE.md\nDefinition-of-Done fill-ins — lint command, bench paths, regression threshold —\nwere applied to the local copy only; the file is not tracked.)",
          "is_bot": false,
          "headline": "docs: MCP-limitation truthing + doc drift + CHANGELOG 1.0.0",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-07-19T03:16:51Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c63c0dee2c7950f090101fcbf90ca753159f4cc8",
          "body": "A panic inside underlying.Log (store-driver panic, custom MarshalJSON, nil-handle\nclose race) escaped the BufferedAsyncLogger worker goroutine unrecovered and\naborted the whole process — violating \"a flush worker crash must never block or\ncrash the proxy loop.\"\n\nWrap the underlying.Log call in a rec\n[…]\nsting overflow-fallback path, so the entry stays\ndurable (drop-accounted) and the worker keeps draining. Mirrors the panic\nisolation pkg/notify's dispatcher already had. No exported signature changes.",
          "is_bot": false,
          "headline": "fix(audit): M1 isolate panics in buffered audit flush workers",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-07-19T03:16:01Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b48a434df9e2045ebbb2be9e9456da291ba81e96",
          "body": "The Python adapters inferred the filesystem `action` by substring match with a\nnarrower verb set, so edit_file/append_file/copy_*/move_*/unlink/rm*/list_*/\nstat/cat/find/glob sent NO action through LangChain/CrewAI/MCP while the Go\ntransports (gateclient.InferFilesystemAction) sent one — an action-k\n[…]\ne\nregression + false-positive cases.\n\nOperators whose policies key on filesystem `action` may see new (correct)\nmatches through the Python adapters — same class of change the v0.7 skew fix\ndocumented.",
          "is_bot": false,
          "headline": "fix(sdk): H1 filesystem-action inference parity with Go transports",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-07-19T03:15:54Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7ea2efc2f52f807ccd0b61a1dff8f186c1da77a2",
          "body": "Malformed streaming tool calls are refused fail-closed with a synthetic\nmalformed_tool_call DENY, but their audit entry was written by the normal\n/v1/check path, which records the POLICY engine's verdict (often ALLOW) —\nso the trail could read ALLOW for a call the agent got DENY on.\n\nAdd a DENY-only\n[…]\ntell operators to key the proxy too when the server is keyed.\n\nThe happy hot path is unchanged (Check stays byte-identical / 0-alloc on ALLOW);\nall new work is on the rare malformed-completion branch.",
          "is_bot": false,
          "headline": "fix: F1 audit-verdict fidelity + forced-audit fallback",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-07-19T03:15:43Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d3fd8db35dd2f6e7361215defc1e66067d00f89e",
          "body": null,
          "is_bot": false,
          "headline": "version bump for 1.0.0 in order to prepare for release",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-07-17T17:11:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f9a24350ca28a43f0664b9df32c30293aef80d60",
          "body": "Follow-up to the v1.0 accuracy pass: this branch merges on release day as\nv1.0.0, so every doc claim describing the CURRENT state now says v1.0 —\nexample outputs (/health, /v1/health, agentguard version, MCP serverInfo,\nSETUP health check), \"as of vX\" phrasings (FAQ single-API-key, hardcoded\nconstan\n[…]\n sharing\nnote now distinguishes SQLite (per-instance) from the v1.0 PostgreSQL\nbackend (shared, bounded-overshoot); SLO clarifies targets are per\nreplica under multi-node.\n\nDocs-only; no code touched.",
          "is_bot": false,
          "headline": "docs: bump current-state version references to v1.0",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-07-17T15:49:26Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4bce1ba6f0e0cb29e87a91832c7911623c981cac",
          "body": "…1–F3 behavior\n\nThe v1.0 code shipped (Postgres multi-node, approval write-once/one-shot,\nF1/F2/F3 security fixes) but README and docs still described the v0.9\nsingle-node posture and called Postgres future work. Bring every operator-\nfacing claim in line with what the code does now:\n\n- README: Limi\n[…]\ndance, reconcile-interval sizing, store\n  schema (new columns + consumption tables + PG variant), and the\n  single-node-only claims removed.\n\nDocs-only change; no code, config, or CI behavior touched.",
          "is_bot": false,
          "headline": "docs: v1.0 accuracy pass — multi-node Postgres, approval hardening, F…",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-07-16T17:00:32Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "dd1172004b9bfec650c54419a993274932ca9ac0",
          "body": "Three independent CI failures from the branch's first full CI exposure:\n\n- security: bump github.com/jackc/pgx/v5 v5.9.1 -> v5.9.2. v5.9.1 has\n  GHSA-j88v-2chj-qfwx (SQL injection via placeholder confusion with\n  dollar-quoted string literals), reachable through the store's query\n  paths per govulnc\n[…]\nssues locally and passed\n  the previous CI run — action-cache nondeterminism. The returns make the\n  sites immune to any conservative nil analysis and invalidate the stale\n  per-package cache entries.",
          "is_bot": false,
          "headline": "fix(ci): pgx SQL-injection bump + soak-gate placement + SA5011 hardening",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-07-15T15:23:20Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "69f8bec11feeab74e321139d00967719e98a84f5",
          "body": "…nic store merge\n\nThe v1-preparation approval hardening (write-once / one-shot ConsumeResolved /\n--approval-validity, persisted as consumed_at/resolved_via/resolved_from) and\nthis branch's 1-A cross-node reconcile were developed independently. The merge\nis textually clean and compiles, but the one-s\n[…]\noved exported decls, methods, or flags). The soak latency\nassert exceeds budget under -race on this Windows box (~3.5ms) but does so\nidentically on the pre-merge tip — environmental, not a regression.",
          "is_bot": false,
          "headline": "feat(v1.0): carry one-shot approval consumption across nodes + monoto…",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-07-15T14:56:11Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "405d2c24d303b78c470d717bfe4c4bf2427da985",
          "body": "…ultinode\n\nfeat/v1.0-multinode was cut from the v0.9.0 tag; the real pre-v1.0\nintegration base is origin/v1-preparation (v0.9.0 -> origin/master\nbcaecdb docs/0600 pass -> c2c1ab8 approval write-once/one-shot/validity\nhardening + SSE read bounding). Merge-base was exactly v0.9.0, so this\nmerge brings\n[…]\n approval one-shot/actor fields (ConsumedAt/ResolvedVia/\n  ResolvedFrom) are NOT yet carried by this branch's Postgres store or\n  cross-node reconcile path; that gap is closed in the follow-up commit.",
          "is_bot": false,
          "headline": "merge: reconcile v1-preparation (real pre-v1.0 base) into feat/v1.0-m…",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-07-15T14:39:41Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "52f251a15fc056ae4ba437f37c5a1264247434e6",
          "body": "The v1.0 branch (Item 1 multi-node + Item 2 hardening + F1/F2/F3 security fixes)\nwas built on master (Jun 8), which predates the v0.9 release line. This merges\nv0.9.0 in, bringing v0.9's work (dep-audit, metrics registry, --fail-audit-log,\n--notify-spool, the canonical p99 gate, COMPATIBILITY.md) on\n[…]\nnc audit drain (sharded FILE backend) so it measures the true hot path, with a\nDroppedToOverflow==0 guard. p99 0.55ms / 2.0ms(-race).\n\nFull suite + -race green; all p99 gates <3ms; F1/F2/F3 preserved.",
          "is_bot": false,
          "headline": "merge: reconcile v1.0 work onto v0.9.0 baseline",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-07-15T04:07:17Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7d3b3f4a5efbb5bbff0a9a30cae2d59d251f6a0c",
          "body": "Security fixes (approved hot-path/frozen-surface, from the 2f adversarial review):\n- F2: case-insensitive domain matching (request ToLower in normalizeRequest +\n  rule ToLower at load) — closes a deny-rule case bypass.\n- F1: malformed streaming tool-call completions now fail closed (refusal +\n  audi\n[…]\n2a: 7 hardened synthesized SSE fixtures + realism parser tests.\n- 2d/2e: CI — langchain/crewai integration-tests blocking (browser-use advisory);\n  OS matrix (ubuntu/windows/macos) on the Go test job.",
          "is_bot": false,
          "headline": "feat(v1.0): Item 2 validation hardening + F1/F2/F3 security fixes",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-07-15T03:18:42Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4b88a5814f34d24301c8c5fc5c48c91c182816f5",
          "body": "Async-reconcile, Postgres-only multi-node behind the existing store.Store\ninterface. Memory stays authoritative per node; Postgres is the shared durable\ntier; all convergence is background-only. Hot-path Allow/checkCost/Lookup code\nis byte-identical (0 removed lines, 0 added allocs); p99 stays <3ms \n[…]\nbs; authored TestEngineCheck_P99LatencyGate; integration p99 test made\n  load-bearing.\n\nstore.Store frozen interface untouched; all changes additive (v1.0 compat).\nDesign: docs/v1.0-multinode-PLAN.md.",
          "is_bot": false,
          "headline": "feat(v1.0): Postgres multi-node — shared state + reconcile (Item 1)",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-07-14T17:01:19Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c2c1ab821fc981d0b931716b8782ba230465f215",
          "body": "Approvals are now write-once (409 on flip), one-shot (resolved ALLOW\nreplayable once), and time-boxed (--approval-validity, default 5m), with\nan actor stamp — closing the last-write-wins flip and multi-use replay\ngaps. Security fixes: bound SSE line reads (readSSEEvent), notify redactor\ncovers path/\n[…]\nAPPROVAL_WORKFLOW.md, CLI.md, OBSERVABILITY.md\nfor the new behavior; plus a docs accuracy pass fixing ~10 verified drift\nissues across README, quickstarts, MCP_GATEWAY, LLM_API_PROXY, and audit notes.",
          "is_bot": false,
          "headline": "harden approval lifecycle + pre-v1 security & docs fixes",
          "author_name": "Caua Ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-07-13T01:30:23Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2f183b866ec9637ea692e8e3a856db1b357b0061",
          "body": "Approvals are now write-once (409 on flip), one-shot (resolved ALLOW\nreplayable once), and time-boxed (--approval-validity, default 5m), with\nan actor stamp — closing the last-write-wins flip and multi-use replay\ngaps. Security fixes: bound SSE line reads (readSSEEvent), notify redactor\ncovers path/\n[…]\nAPPROVAL_WORKFLOW.md, CLI.md, OBSERVABILITY.md\nfor the new behavior; plus a docs accuracy pass fixing ~10 verified drift\nissues across README, quickstarts, MCP_GATEWAY, LLM_API_PROXY, and audit notes.",
          "is_bot": false,
          "headline": "harden approval lifecycle + pre-v1 security & docs fixes",
          "author_name": "Caua Ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-07-13T01:30:06Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "bcaecdbc813d01f34aadd8b85ca7dc669db23e6f",
          "body": "… 0600 (audit M2)\n\nDocs — corrected every claim that drifted from the code:\n- approval queue documented as in-memory in 6 files — persistent since\n  v0.6 (--persist default); FILE_FORMATS gains the missing agentguard.db\n  entry, OPERATIONS backup guidance now covers the store\n- tool_scope_map shown \n[…]\ne now pre-creates the SQLite\ndatabase 0600 so WAL/SHM sidecars inherit owner-only mode, and tightens\nfiles created by older versions on every open. Unix-gated regression\ntests added; full suite green.",
          "is_bot": false,
          "headline": "docs: full v0.9 accuracy pass + fix(store): create agentguard.db mode…",
          "author_name": "Caua Ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-07-10T17:42:28Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9effe6bd73394b7da14c6188880acb5bc7f6fea7",
          "body": null,
          "is_bot": false,
          "headline": "changelog & release",
          "author_name": "Caua Ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-07-09T03:45:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "07944dc4a85c14cc82823589f46915f79cc8ecef",
          "body": null,
          "is_bot": false,
          "headline": "banner svg update",
          "author_name": "Caua Ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-07-09T03:38:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "790f8acc178199fbb751cd855d8fa8b53aa417f7",
          "body": null,
          "is_bot": false,
          "headline": "readme and docs update for the v0.9 release",
          "author_name": "Caua Ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-07-09T03:35:47Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4a2d5633bdfe14482bf39fd481eb51a786177cc0",
          "body": null,
          "is_bot": false,
          "headline": "Publish the gauge as atomic deltas instead of absolute snapshots",
          "author_name": "Caua Ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-07-09T03:23:29Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "82e59c705a1d83f8dc4d6ff923603d28df6ccef9",
          "body": "release of v0.9",
          "is_bot": false,
          "headline": "Merge pull request #32 from Caua-ferraz/security/v0.6-audit-hardening",
          "author_name": "Cauã Ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-07-09T03:03:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1b772f471c5e93f2a24b436f75aa03cf0def81f0",
          "body": null,
          "is_bot": false,
          "headline": "Bumped the pinned Go toolchain 1.25.11 → 1.25.12",
          "author_name": "Caua Ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-07-09T03:02:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d126abd8046f1a31eecf8ad8a0ff40472b712e88",
          "body": null,
          "is_bot": false,
          "headline": "improved and created new test for v1 functions and use cases",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-06-23T16:05:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b57fd6e54d386665b0d45a3e95999af45db44168",
          "body": "Security/v0.9 preparations for v1, test fixes audit and security/performance improvements",
          "is_bot": false,
          "headline": "Merge pull request #28 from Caua-ferraz/security/v0.6-audit-hardening",
          "author_name": "Cauã Ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-06-23T02:17:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cd62d88a3170e4a63782f73044202c9828f81633",
          "body": "1. sec := \"no known advisory in the registry\" initializer to var sec string.\n2.Added an unexported extraNotifiers []Notifier test seam to DispatcherOptions and appended it during construction, before the worker/recovery goroutines start (nil in production → no-op).",
          "is_bot": false,
          "headline": "adapted old notify to be compatible with the new functions.",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-06-23T02:09:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9ea5973675f45af7963d8ad302c19b9700f244b7",
          "body": "…n CLI\n\n1. the new tool verify in every commit if all dependencies are up to date\n2. if one or more dependecies is not up to date an security/performance verification will be done\n3. if the verification flag the update as trivial in security/performance it will proceed, otherwise an error will be displayed",
          "is_bot": false,
          "headline": "new implementation for dependencies and codependecies verifications o…",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-06-23T01:56:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8b7a93d0d735711234ac6b4b353c14f8529155a7",
          "body": "…rvability hardening\n\nv0.9 is a stabilization release (not a feature build) — the step before a\nvalidated v1.0. It locks in the surfaces intended to freeze at 1.0, corrects one\nhonesty defect, and fixes a latency-telemetry bug. No new features; /v1/check and\nthe audit JSONL stay byte-compatible with\n[…]\ne post-v1 deferrals.\n\nVerified: go build/vet/test ./... green (17 pkgs, 0 fail); -race clean on changed\npackages; golangci-lint 0 issues; the new timing + p99-gate tests fail against the\npre-fix code.",
          "is_bot": false,
          "headline": "release: v0.9.0 — surface stabilization, audit honesty + latency/obse…",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-06-23T01:00:54Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a3ca7f4bfbf05e9381e21af902c5e1f15b8e923e",
          "body": "…erdicts\n\nCuts the consistency + durability release (v0.6.0 was never tagged; its\npersistent multi-tenant milestone ships here). Three workstreams:\n\nConsistency (fixes real verdict skews):\n- Shared /v1/check gate client (pkg/internal/gateclient): wire contract,\n  fail-mode translation, Decision type\n[…]\nv0.7 with design briefs\n  (mcp-resources, streamable-http, data-pii, meta-fallback).\n\nDocs, README, CHANGELOG, and docs/releases/v0.7.0.md updated; versions\nbumped in all three binaries and both SDKs.",
          "is_bot": false,
          "headline": "release: v0.7.0 — verdict consistency, outage durability, streaming v…",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-06-13T22:27:18Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "86e35358f2d3fd5650afaa9e34677c501859a257",
          "body": " verdict consistency, outage durability, streaming verdicts\n\nCuts the consistency + durability release.\nThree workstreams:\n\nConsistency (fixes real verdict skews):\n- Shared /v1/check gate client (pkg/internal/gateclient): wire contract,\n  fail-mode translation, Decision type (re-exported via alias),\n[…]\nv0.7 with design briefs\n  (mcp-resources, streamable-http, data-pii, meta-fallback).\n\nDocs, README, CHANGELOG, and docs/releases/v0.7.0.md updated; versions\nbumped in all three binaries and both SDKs.",
          "is_bot": false,
          "headline": "release: v0.7.0",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-06-13T22:26:07Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e860f00690293c68c785efe11665895cb77bc11d",
          "body": "Unifies the mirrored gate clients and Python tool adapters\n(LangChain/CrewAI/MCP) to\nreduce drift.\n\nGo:\n- Extract shared `/v1/check` wire contract to `pkg/internal/gateclient`.\n- Fix: mcpgw now correctly infers `cat/find/glob` as filesystem read verbs.\n- Fix: mcpgw hard-denies unrecognized check res\n[…]\nectly infers filesystem actions, ensuring action-keyed policy rules fire appropriately.\n- Fix: MCP adapter now maps the `create` verb to `write`.\n- Add explicit `__all__` exports to SDK `__init__.py`.",
          "is_bot": false,
          "headline": "consolidate gate clients and adapters to resolve policy skews",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-06-11T02:24:29Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "51e7b76c0b3a42a0f2d815c39da3276d01830d96",
          "body": "…(M1)\n\nH3 — duplicate-JSON-key differential: the gate projects tool-call\narguments from a Go map (last-wins on duplicate keys) while the ALLOW\npath replays the raw argument bytes; a first-wins downstream executor\nwould act on a different value than the gated one. A new recursive\ndetector (argcheck.g\n[…]\nhan a\nfirst-wins client SDK executes. Now first-wins, matching the client.\n\nRegression tests verified fail-before/pass-after. Refs audit H3, M1.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(llmproxy): reject duplicate-key args (H3) + first-wins tool name …",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-06-10T05:41:00Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "6c87334803ce336e878ab91c50dafde438f93762",
          "body": "H1 — interleaved tool_use bypass: the Anthropic accumulator only gated\nthe first (active) tool_use block. A stream that opened a second tool_use\ncontent block before closing the first had the second block flushed to the\nclient when the first block's ALLOW gate cycle Reset() the accumulator,\nthen its\n[…]\nnt\nserial streams. Regression tests (security_audit_test.go) verified\nfail-before/pass-after.\n\nRefs docs/audit/2026-06-INTERNAL-AUDIT.md H1, H2.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(llmproxy): close Anthropic streaming gating bypasses H1+H2",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-06-10T05:37:21Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "27ffd17f5d0ef93c674988e33a82952c3644ed80",
          "body": "Read-only review of all 8 audit surfaces (parsers, streaming, auth,\npolicy engine, audit log, server/network, SQLite store, secrets).\nFindings rated Critical/High/Medium/Low with file:line, exploit\nscenario, and proposed fix.\n\nHeadline findings (parser-differential class — highest value):\n- H1 Anthr\n[…]\n misses path/domain/action\n\nVerified clean: no audit log injection (P1), no SQL injection (P2),\ncross-tenant isolation holds adversarially (P3).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs(audit): Phase 0 internal security audit findings",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-06-10T05:32:01Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "6566dce566e2381e797327475efb1be5af527e54",
          "body": "version update on all files",
          "is_bot": false,
          "headline": "Merge pull request #23 from Caua-ferraz/feat/v0.6-tenant-isolation",
          "author_name": "Cauã Ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-06-08T22:09:03Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d4335e2eaa5276079d7d399f5b1fe37fb6e84f65",
          "body": null,
          "is_bot": false,
          "headline": "version update on all files",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-06-08T22:08:18Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3604ef1b7b2c0d8fa75ec1e56a250cc1e6be6173",
          "body": "v0.6 tenant isolation merged version v0.6 to the main branch",
          "is_bot": false,
          "headline": "Merge pull request #22 from Caua-ferraz/feat/v0.6-tenant-isolation",
          "author_name": "Cauã Ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-06-08T21:42:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7d085eb9f2faac8d958dd74a011b0da3e71dcdcf",
          "body": "Granted better compatibility with windows system",
          "is_bot": false,
          "headline": "Python test fix for Sh script.",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-06-08T21:37:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0d93c7bf3dff7a52372ee921b12f5c52da2303fb",
          "body": "1.25 => 1.25.11\nKeeping up to date\n\nUpdated in main.go|sqlite.go|ci.yml|release|docker",
          "is_bot": false,
          "headline": "Update on go version",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-06-08T21:14:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9a42375be24869a11adaeeeaaa853077067ee534",
          "body": "Completes the v0.6 milestone: the\nproxy's per-request state now survives restarts, and tenants beyond \"local\" are first-class.\n\nPersistence (write-behind dual-tier, cold path):\n- pkg/store: Store interface + SQLiteStore (pure-Go modernc.org/sqlite, WAL,\n  one idempotent schema/migration). Tenant-sco\n[…]\n,\nsyncer flush<->hydrate, end-to-end restart survival over HTTP, per-tenant\npolicy evaluation, a binary smoke test, and latency benchmarks. Full suite\ngreen; -race clean on store/policy/persist/proxy.",
          "is_bot": false,
          "headline": "v0.6: durable persistent state + multi-tenant policies + general fixes",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-06-08T20:58:17Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "798c40ff7c7b057215a73338eb5eb16c1cb7d64c",
          "body": "Threads tenant_id through every per-request store so a multi-tenant\ndeployment cannot leak across tenants, while single-tenant (\"local\")\nbehavior stays byte-identical — the local tenant is stored as \"\" so wire\npayloads and on-disk audit files are unchanged.\n\n- audit: Entry.TenantID + EffectiveTenant\n[…]\nhe v1 request/response body. Adds isolation tests for each\nstore. Full design and the remaining durability work (Store + write-behind\nsyncer, zero-config SQLite) are in docs/v0.6-ARCHITECTURE-PLAN.md.",
          "is_bot": false,
          "headline": "feat(v0.6): tenant-isolate per-request state and audit schema",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-06-07T00:19:09Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a796b3b2b712f20024a1a432eb96d30a9d28938d",
          "body": "An atomic-replace policy edit (write-temp + rename — the pattern editors\nand `kubectl apply` use) can race FileWatcher.reload. On Windows the\nrename's MoveFileEx leaves the destination briefly locked, so the reload's\nopen-for-read returns ERROR_SHARING_VIOLATION. That failing read was\nlogged and dro\n[…]\n TestATIntegration_ProviderReloadE2E,\nTestFilePolicyProvider_WatchCallbackPanicDoesNotKillWatcher, and\nTestATFilePolicyProvider_RaceWatchGetMutate (10/10 green, previously\n~30-50% failure on Windows).",
          "is_bot": false,
          "headline": "fix(policy): self-heal transient reload reads in the file watcher",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-06-07T00:19:09Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ba1d70f79170762fc3450efc00e0568c0bbdfadb",
          "body": "Keep CLAUDE.md (engineering contract), TODO.md (milestone tracker), and\n.claude/ out of version control — they are local agent-workflow artifacts,\nnot project source.",
          "is_bot": false,
          "headline": "chore(repo): ignore local AI engineering workflow files",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-06-07T00:19:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ab2d5883c8f1b0ef71054e058d8d54bd34babe09",
          "body": "Maintenance release. Headline fix: MCP gateway initialize now\nspec-compliant (capabilities is required by MCP; was omitempty/null\nand rejected by current @modelcontextprotocol/server-filesystem and\nany strict upstream) — README quickstart works again.\n\nOther:\n- Toolchain refresh: Go 1.22 -> 1.25, Al\n[…]\nme poisoning on parse failure\n  (fsnotify v1.10.1's faster delivery exposed the race).\n- Bug fix: Python langchain batch test had order-dependent assert\n  that flaked on Python 3.13's async scheduler.",
          "is_bot": false,
          "headline": "release: v0.5.2",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-06-02T00:23:09Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9fb8a41a480e3e01a814dd66c67e2494f2713dd1",
          "body": "- .golangci.yml: v2 config; errcheck excludes test files and\n  conventional Close/Fprintf cleanup patterns\n- pkg/policy/watcher: advance modTime only on successful parse —\n  fsnotify v1.10.1's faster event delivery exposed an existing race\n  where a failed parse poisoned modTime and skipped the next\n[…]\nn\n  check_cmd.go, at_refusal_correctness_test.go, engine_extended_test.go\n- test_langchain: sort calls before assert; concurrent batch\n  execution order is non-deterministic on Python 3.13's scheduler",
          "is_bot": false,
          "headline": "fix(ci): unblock lint v2 + watcher modTime race + py3.13 batch order",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-06-02T00:05:54Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5248d60c577c79ad842cd6404a199dfa65e3a0c2",
          "body": "…ield\n\n- Go 1.22→1.25, Alpine 3.19→3.22 (both EOL); fsnotify 1.10.1, x/sys 0.45.0\n- TypeScript 5→6, Jest 29→30, Node floor 18→20; tsconfig types + jest.fn fixes\n- golangci-lint v1.61→v2.12; add Python 3.13 to CI matrix\n- Add govulncheck CI job and release-sbom workflow (SPDX + CycloneDX)\n- Fix MCP gateway initialize: capabilities is REQUIRED by spec; was sent\n  with omitempty and rejected by strict upstreams (incl. current\n  @modelcontextprotocol/server-filesystem)",
          "is_bot": false,
          "headline": "refresh toolchain and add supply-chain checks; fix MCP capabilities f…",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-06-01T23:22:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3d2877a2d7aa464d44bdfde8a84f413774294c05",
          "body": "release: v0.5.1\n\nBump all binaries + SDKs to 0.5.1, drop Python 3.9 from the matrix,\nand rewrite docs around the v0.5 product identity.\n\nVersion + packaging:\n- All canonical version strings aligned at 0.5.1.\n- pyproject: requires-python = \">=3.10\" (3.9 upstream EOL Oct 2025).\n- CI matrix: 3.10 / 3.1\n[…]\nl; cross-\n  link to QUICKSTART_* for procedural detail).\n- CONTRIBUTING: rewrote release section with full file list, GitHub-\n  Release-publish step, CRLF-on-Windows gotcha for bump-version.sh.\nEOF\n)\"",
          "is_bot": false,
          "headline": "git commit -m \"$(cat <<'EOF'",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-05-11T22:02:24Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "98f830f4721e12b4f7228f5c6cccca05824220a8",
          "body": null,
          "is_bot": false,
          "headline": "readme fixup",
          "author_name": "Cauã Ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-05-08T22:34:29Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9970e4396ef4d3816f7949edb99f22cde8fdc592",
          "body": "… makes the CLI test invalid, those updates fixes it",
          "is_bot": false,
          "headline": "corrected version of docs, dropped python version 3.9 from v0.5, that…",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-05-08T20:52:52Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "349ca0d7d1dbaca3e623b435d450c1d468beb24c",
          "body": null,
          "is_bot": false,
          "headline": "ci fix, added \"langchain,crewai,mcp\" to the pip install -e",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-05-08T20:33:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4a00fb73d25e7b38c1984b10b7c7467cfbc0a369",
          "body": null,
          "is_bot": false,
          "headline": "Merge branch 'master' of https://github.com/Caua-ferraz/AgentGuard",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-05-08T20:14:50Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9b3192d7b39733f4d2417d87b781922a3fc24d2a",
          "body": null,
          "is_bot": false,
          "headline": "overall documentations and versioning updates both in code and .md",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-05-08T20:14:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c29efc7d8fd8a15da30e7524b3d4b0c3003dba1b",
          "body": null,
          "is_bot": false,
          "headline": "Delete CLAUDE.md",
          "author_name": "Cauã Ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-05-07T16:14:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "37e2bd7932a3b355203560a5a0ad3f878fb74eef",
          "body": null,
          "is_bot": false,
          "headline": "a",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-05-07T16:14:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9667b760952e020028260b77405fe2a212be465e",
          "body": "…ntic 2.12 / langgraph 1.0 compat (v0.5.1)\n\nThe v0.5.0 GuardedCrewTool / GuardedTool adapters were composition wrappers\nthat registered themselves as virtual subclasses via BaseTool.register().\npydantic 2.12 no longer honours that registration in isinstance() checks,\nso CrewAI 1.x's Agent(tools=[...\n[…]\n release; the Go binaries (agentguard, agentguard-mcp-gateway,\nagentguard-llm-proxy), Makefile, and TypeScript SDK stay at v0.5.0.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(sdk): hybrid subclass+override CrewAI/LangChain adapters for pyda…",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-05-07T16:09:28Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "d925f1dfb0517ff09e63edee4b967331facca3f5",
          "body": "CI's golangci-lint v1.61.0 surfaced three issues against the\nv0.5.0 commit:\n\n- pkg/llmproxy/server_test.go:607 (errcheck) — defer\n  httpSrv.Shutdown(...) ignored the error return. Wrap in a\n  defer func() { _ = ... }() so errcheck sees an explicit\n  discard.\n\n- pkg/llmproxy/forward.go:92 (unused) — \n[…]\nes staticcheck.\n\nVerification:\n  - go vet ./... clean\n  - go build ./... clean\n  - go test ./pkg/llmproxy/... -race -count=1 clean\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(lint): close 3 golangci-lint findings post-v0.5.0",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-05-07T14:28:46Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "df93015e73b69fe3af4fe5e0fb4f1de0de0e97cd",
          "body": "The v0.5 release-process narrative was leaking into operator-facing\ndocs (Phase 1/2/3/4 references, \"v0.5 ships X\", reviewer codes like\n\"R5 P1\" or \"T7\", inline TODO(v0.6, #N) markers, and worker IDs like\nA17/A18). Operators don't care about the build process — they care\nabout what AgentGuard is and \n[…]\ngrep 'Phase [1-4]' docs/ README.md (excluding releases/) returns\nempty (or only acceptable historical references in MIGRATION.md).\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: clean up phase-speak from user-facing prose",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-05-07T05:44:37Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "09c5d930ef753c8b9c2700b8d6a8c26731ae4247",
          "body": "CHANGELOG.md: renamed [Unreleased] section header to\n[0.5.0] - 2026-05-05; preserved an empty [Unreleased] above\nfor post-v0.5.0 work.\n\ndocs/releases/v0.5.0.md: new operator-facing release notes —\nproxy heroes (agentguard-mcp-gateway + agentguard-llm-proxy),\nSDK hardening (compatibility tier), archi\n[…]\nsearch-agent 36 / 6; trading-bot 14 / 4)\n  - make build now stamps -X main.version=0.5.0\n  - All 3 binaries report --version 0.5.0\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "release: v0.5.0",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-05-07T05:30:04Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "9d193629cc4717450c17a975e98da416f0d221fb",
          "body": "Replaces placeholder URLs and email addresses across the repo with\nthe real ones now that the official website is live.\n\nWebsite URLs (agentguard.dev → agentguard.lictorate.com):\n- README.md:31 — Cloud waitlist; dropped the \"placeholder URL\" disclaimer\n- SUPPORT.md:25 — same waitlist URL\n- pkg/proxy\n[…]\n clean.\n\nRemaining agentguard.dev references are in AUDIT_REPORT.md (root-level\naudit historical record; gitignored) — left as-is.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: point to agentguard.lictorate.com + cauaferraz@lictorate.com",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-05-07T05:25:29Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "308a41b687f8b0e5e9027d57945bd3492cb51fa0",
          "body": "Three new AT-tier test files exercising the audit-fixup commit\n(bdf04e8). All pass under -race; no workers blocked.\n\npkg/proxy/at_b1_adversarial_test.go - 6 adversarial scenarios for\nB1 (approval-id replay validation):\n  - TenantIDDoesntCount (documents v0.6 gap; tenant-id is plumbed\n    but not in \n[…]\nunder \"Audit-fixup verification\".\n\nAT VERDICT: PASS - audit-fixup ready for v0.5.0 release synthesis.\nAI VERDICT (re-scan): CLEAN.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "test(at): adversarial + E2E coverage for v0.5 audit fixup",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-05-07T05:14:54Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "bdf04e81f50d7429f2117dcffc83e2ebd839257a",
          "body": "Multi-perspective audit (.audit/V05_AUDIT_REPORT.md) ran AFTER the\nPhase 4C commit (dbc2f19) and surfaced 7 ship-blockers + ~25\nhigh-severity gaps the per-phase orchestration didn't catch.\nThree of the seven were independently confirmed by 2-4 reviewers\neach. This commit closes the 7 blockers + the \n[…]\n0.6) markers) are documented as v0.6 work in\n.audit/v05_decisions.md.\n\nAudit findings disposition: see .audit/V05_AUDIT_REPORT.md.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.5 audit fixup: close 7 ship-blockers + 6 high-severity gaps",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-05-07T04:56:49Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "dbc2f195d9d2144dc66b75831cf751189f00c9fd",
          "body": "Closes T7 final (LLM API Proxy fully wired end-to-end), R5 P3/P4/P5,\nR1 F2 progress. Both proxy heroes shipping: MCP Gateway (Phase 4B) +\nLLM API Proxy (Phase 4C).\n\nCumulative through Phase 4C: ~85+ audit findings closed.\n\nA21 - Server + non-streaming forwarding skeleton:\n  - cmd/agentguard-llm-prox\n[…]\nh-audit propagation, MCP capability\nmasking).\n\nPhase review: see .audit/PHASE_4C_REVIEW.md.\nAudit: see .audit/V05_AUDIT_REPORT.md.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.5 phase 4c: LLM API Proxy implementation",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-05-07T04:32:21Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "013399dc47eb149dbbd7a47b5caf1e2f2c846079",
          "body": "Closes the architectural gap AT (Test Wrangler) discovered during\nPhase 4B's approval-flow E2E: the central server's /v1/check was\nstateless w.r.t. the approval queue. A model retrying a tool call\nafter a human approved on the dashboard would always evaluate fresh\nand produce a NEW approval entry — \n[…]\n human-approved from policy-allowed in audit log\n\nPhase review: see .audit/PHASE_4B_REVIEW.md § 6 (the architectural\ngap section).\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(proxy): handleCheck honors approval_id round-trip",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-05-07T01:02:05Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "60f675bf674ebcaff17b775b68e8db94591737dc",
          "body": "Closes T7 (MCP empty server) fully and the wire-format-bridge layer\nof the v0.5 proxy claim. Four worker subagents (A17, A18, A19, A20)\nplus AT (Test Wrangler) plus AI (Integrity Inspector) all clean.\n\nA17 - Bridge + transport (T7 wire layer):\n  - cmd/agentguard-mcp-gateway/main.go (NEW) - CLI entry\n[…]\nnsport)\n  - R7 E6 (MCP empty server) - fully closed\n  - R5 P (compat matrix MCP row)\n\nPhase review: see .audit/PHASE_4B_REVIEW.md.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.5 phase 4b: MCP gateway implementation",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-05-07T00:38:10Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "680585cba6bcb3b8cae0d05de15ed9ac648b51a0",
          "body": "Design-only phase. Locks the architecture for Phase 4B (MCP Gateway\nimplementation) and Phase 4C (LLM API Proxy implementation). Three\nnew design documents totaling 1822 lines.\n\nA16 (sequential, alone) wrote:\n\n  docs/PROXY_ARCHITECTURE.md (453 lines)\n  - Cross-cutting binary structure decision: two \n[…]\nn still bypass\n    by ignoring OPENAI_BASE_URL or talking to a different MCP server)\n\nPhase review: see .audit/PHASE_4A_REVIEW.md.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.5 phase 4a: proxy architecture design doc",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-05-06T21:44:55Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "aa3d1139efc50a61040bd6ba8e785ee86d9c9206",
          "body": "fall through NotImplementedError on CrewAI async paths\n\nTwo CI failures surfaced after the v0.5 merge:\n\n(1) langchain matrix: pytest exited 5 with \"0 items / 1 skipped\"\n    in test_real_langchain.py. The module-level\n    `pytest.importorskip(\"langchain\", minversion=\"0.3\")` was\n    skipping the file \n[…]\nmport added to adapters/crewai.py (was previously\n    only used in async def methods; now also needs\n    asyncio.get_running_loop)\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(integration): unblock CI matrix — drop importorskip minversion +",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-05-06T02:41:17Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "6821fd8f355b8db2db0cc3d04cff8955aa7361eb",
          "body": "Post-merge surface: the v0.5 merge into master surfaced a\nTestFixturesAreCanonicalJSON failure on Windows checkouts.\nRoot cause: git's core.autocrlf=true (Windows default) was\nconverting LF -> CRLF on checkout for the JSON fixtures under\npkg/proxy/schema/v1/testdata/, which the contract tests load\nb\n[…]\ne was\nCRLF-mangled. The .gitattributes commit ensures future checkouts\non any Windows machine respect LF for these specific files.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: lock LF on cross-language wire-format fixtures via .gitattributes",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-05-06T02:26:29Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "dd597076058d830d767c5fd1d59751275c5926de",
          "body": "moves, full SDK hardening\n\nBrings the v0.5 release work onto master in three reviewed,\ncheckpoint-gated phase commits. Each phase passed an independent\nTest Wrangler (AT) integration-test pass and an Integrity Inspector\n(AI) forbidden-pattern scan before being approved. ~73 of the\nv0.4.1 audit's fin\n[…]\n log, the test coverage log,\nand the findings map all live there for orchestrator reference but\nare not part of the public commit.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Merge release/v0.5 (phases 1-3): tier-0 credibility, architectural",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-05-06T02:21:59Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "1682123f51588227cd1081c9053a67176d451c23",
          "body": "Closes ~35 audit findings, including the cross-cutting T3 theme\n(adapter modern-API bypass) in full. Cumulative through Phase 3:\n~73 audit findings closed.\n\nFive worker subagents + AT (Test Wrangler) + AI (Integrity Inspector)\nlanded clean. AI verdict: CLEAN across all 10 forbidden-pattern scans.\n\nA\n[…]\npty server) partially closed (gateway preview;\nfull Phase 4B implementation pending).\n\nPhase review: see .audit/PHASE_3_REVIEW.md.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.5 phase 3: full SDK hardening",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-05-06T02:18:18Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "52078ae529fbf2327d126aea7424d1f54716ebef",
          "body": "Closes 7 explicit audit findings + 2 cross-cutting partials. Cumulative\nthrough Phase 2: ~38 findings closed (Phase 1 = 31 + Phase 2 = 7-9).\n\nA5 - PolicyProvider interface (R2 P1 partial):\n  - pkg/policy/provider.go (NEW) - PolicyProvider {Get, Watch, Validate, Close}\n  - FilePolicyProvider (file-ba\n[…]\ndings_map.md (cumulative\n~38 closures; full multi-tenant data sharding tracked for v0.6)\nPhase review: see .audit/PHASE_2_REVIEW.md\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.5 phase 2: architectural moves",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-05-05T20:52:32Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "ccf5de09178584212dc3a85edbd77bde0199c23d",
          "body": "Closes 31 audit findings from the v0.4.1 multi-perspective review.\nCross-cutting themes T2 / T8 / T9 / T10 / T11 fully or partially closed;\nT1 / T4 partially closed (rotation wired; full hash chain + retry/spool\ntracked for v0.6).\n\nA1 — Governance (R6 E1, P1, P2, P3, P9, P15):\n  - Full Apache-2.0 LI\n[…]\n trading-bot.yaml all exit 0\n\nAudit findings disposition: see .audit/v05_findings_map.md\nPhase review: see .audit/PHASE_1_REVIEW.md\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "v0.5 phase 1: tier-0 credibility + perf baseline",
          "author_name": "Caua-ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-05-05T15:59:03Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "1fe1456a61485104af7c8a20a868faacc932901b",
          "body": "Trim README from 643 to ~225 lines. Move the full policy YAML,\nauth deep-dive, SDK polling/decorator examples, adapter code\nsamples, and serve-flags table into their existing docs/ pages\nand link out instead. Keep the hook (problem, comparison table),\na minimal end-to-end example, architecture diagram, production\nchecklist, limitations, roadmap, and docs index on the landing\npage.\n\nCo-Authored-By: Claude Opus 4 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: slim README by delegating detail to docs/",
          "author_name": "Caua Ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-04-20T18:00:26Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "221298a7e3e47c2ef465a04a9798d90673a900e1",
          "body": "13 new docs covering the gaps surfaced by auditing the 600-clone wave\nagainst current user-visible behavior. Organized so a new user reaches\nthe right answer without grep'ing CLAUDE.md or the source:\n\n  docs/DEPLOYMENT.md          reverse proxy, TLS, CORS, bind behavior\n  docs/OPERATIONS.md         \n[…]\ntill VALID.\n\nREADME.md gets a Production checklist callout and a full documentation\nindex table so new users land on the right doc on first read.\n\nCo-Authored-By: Claude Opus 4 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: add operator-facing docs + annotate example policies",
          "author_name": "Caua Ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-04-20T02:58:26Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "00e948a1170cc0f82eaea7d9f100b13e3684bf30",
          "body": "Spam-audit sweep over the repo surfaced seven correctness/visibility gaps.\nAll fixes preserve v0.4.x wire behavior, message strings, and every\npublic symbol. Existing `except PermissionError` / `catch (Error)` call\nsites keep working.\n\n1. crewai adapter (_infer_scope): inspect the tool's dict input \n[…]\npass\n- Live dashboard smoke test: auth, CSRF, session, SSE, approve/deny,\n  metrics (all 13 series), CORS localhost-allow + evil-reject all green\n\nCo-Authored-By: Claude Opus 4 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: address 7 audit findings across Go proxy + SDKs",
          "author_name": "Caua Ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-04-19T18:00:23Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "484bab6d161f754732e94c9cddf6a585f190855d",
          "body": "test_concurrent_tool_calls flaked at 29/32 on the python-test (3.9) CI\nmatrix. Two cooperating causes:\n\n1. The mock AgentGuardHandler server inherited socketserver's default\n   request_queue_size = 5. Under the 32-thread burst the Linux kernel\n   RST-ed the overflow connections before accept().\n2. W\n[…]\noncurrent caller thread.\n\nVerified:\n- 10/10 consecutive runs of test_concurrent_tool_calls pass\n- Full plugins/python suite: 135 passed in 45.14s\n\nCo-Authored-By: Claude Opus 4 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(sdk+tests): broaden Guard.check exceptions + deeper mock backlog",
          "author_name": "Caua Ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-04-19T04:27:24Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "d6a80a907e06a062bbdc514c3db12dcd7a37c2c7",
          "body": "V0.4.1",
          "is_bot": false,
          "headline": "Merge pull request #6 from Caua-ferraz/v0.4.1",
          "author_name": "Cauã Ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-04-19T04:24:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ce03247e9f071bc64d50d5a922f8f4e08db7bcb9",
          "body": "Version bump across the six canonical sites:\n  - cmd/agentguard/main.go (var version)\n  - plugins/python/pyproject.toml\n  - plugins/python/agentguard/adapters/mcp.py (SDK_VERSION)\n  - plugins/typescript/package.json\n  - Makefile (VERSION)\n  - docs/SETUP.md (curl /health example output)\n\nAlso reconci\n[…]\nility trap.\n  - Prints the surviving historical references at the end so the\n    operator can eyeball that only intentional references remain.\n\nGo test -race, go vet, and go build all clean post-bump.",
          "is_bot": false,
          "headline": "release: bump version 0.4.0 -> 0.4.1",
          "author_name": "Caua Ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-04-19T03:05:36Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e0b1f45dc23beb3f99edcb3e89e5d41deb9b4a2e",
          "body": "The MCP adapter pins to MCP_PROTOCOL_VERSION = \"2024-11-05\". When a\nclient's initialize request advertises a different protocolVersion\n(typically a newer one), we now log a single WARN line to stderr\nnaming the requested version and the pinned one. We still respond\nwith the pinned version — actual v\n[…]\nons, missing params, and missing\nprotocolVersion remain silent (back-compat path).\n\nTests cover: match → silent, mismatch → WARN + pinned response,\nmissing params and missing protocolVersion → silent.",
          "is_bot": false,
          "headline": "[phase-5.2] mcp: WARN on protocolVersion mismatch, still pin",
          "author_name": "Caua Ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-04-19T02:55:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "250bcc66ef98b1c02987dddfc5658938669f17a9",
          "body": "Guard(...) now accepts fail_mode=\"deny\" (default) or \"allow\". v0.4.0\nbehavior is preserved exactly — the default still fails closed on\ntransport errors. Opting into \"allow\" returns a synthetic ALLOW when\nthe proxy is unreachable, mirroring the existing TypeScript SDK\noption (failMode: 'allow'). Inva\n[…]\nDKs will be\nexplicit about the default. No behavior change on the v0.4.1 default\npath.\n\nTests cover: default == deny, explicit allow overrides to ALLOW on\nunreachable, invalid value raises ValueError.",
          "is_bot": false,
          "headline": "[phase-5.1] python-sdk: add fail_mode parameter (v0.5.0 parity prep)",
          "author_name": "Caua Ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-04-19T02:52:58Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7696b81c1ae502aaafd1176ece113e263d330f9a",
          "body": "Documents every non-rule tunable introduced in v0.4.1 — proxy.session.ttl,\nproxy.request.max_body_bytes, proxy.audit.default_limit/max_limit,\nnotifications.dispatch_timeout, and per-target timeout — with type,\ndefault, validation, and runtime effect for each. Release notes already\nreference docs/CON\n[…]\nload live;\nserver-latched tunables require a restart) so operators are not surprised\nwhen a post-reload SIGHUP does not change their session TTL.\n\nCo-Authored-By: Claude Opus 4 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "[phase-4e] docs: add docs/CONFIG.md reference for Phase 4 keys",
          "author_name": "Caua Ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-04-19T02:22:20Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "8094675886a1c61c90c3e41c61a05f6b11df2452",
          "body": "Resolves proxy.session.ttl, proxy.request.max_body_bytes,\nproxy.audit.default_limit, and proxy.audit.max_limit from the loaded\npolicy via Policy's accessor methods and hands them to proxy.NewServer.\nnotify.NewDispatcher already picks up DispatchTimeout through the same\npolicy.NotificationCfg it alre\n[…]\nded\nthere. An operator who updates configs/default.yaml with any of the new\nkeys now sees the effect at the next restart without a binary change.\n\nCo-Authored-By: Claude Opus 4 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "[phase-4d] cmd: pass policy-driven tunables into the server",
          "author_name": "Caua Ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-04-19T02:21:30Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "eafa20b97f245e560032fb8d59a6c3f5aa85af62",
          "body": "Dispatcher now reads notifications.dispatch_timeout from policy and uses it\nas the default http.Client.Timeout for every webhook/slack target. Each\nNotifyTarget can override via its own `timeout` field; console and log\nnotifiers ignore timeouts because they are synchronous/local. An invalid\ndispatch\n[…]\nvel value.\n- TestDispatcher_DispatchTimeoutDefaultsWhenUnset — empty config falls\n  back to DefaultNotifyDispatchTimeout (v0.4.0-compatible 10s).\n\nCo-Authored-By: Claude Opus 4 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "[phase-4c] notify: plumb dispatch_timeout with per-target override",
          "author_name": "Caua Ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-04-19T02:20:44Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "d03de8be8c7afdbf9bbd49c36b5ddb0a607cd96f",
          "body": "…onfig\n\nAdds Config.SessionTTL, MaxRequestBodyBytes, AuditDefaultLimit, and\nAuditMaxLimit; all four fall back to the preexisting package-level\nconstants when unset so existing call sites and tests keep v0.4.0\nsemantics. The hot paths now read resolved values from Server fields set\nonce in NewServer \n[…]\nlimit above it.\n- TestSessionStore_CustomTTL — issued sessions expire after the\n  configured duration; zero fallback hits the SessionTTL default.\n\nCo-Authored-By: Claude Opus 4 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "[phase-4b] proxy: wire session TTL, body cap, and audit limits from c…",
          "author_name": "Caua Ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-04-19T02:19:24Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "f99ef9f898e1dc40196e8033517a825b1029b82b",
          "body": "Adds the declarative config surface promised in v0.4.1 — `proxy.session.ttl`,\n`proxy.request.max_body_bytes`, `proxy.audit.default_limit`,\n`proxy.audit.max_limit`, `notifications.dispatch_timeout`, plus per-target\n`timeout` on webhook/slack notifiers. Every key is optional; resolver\nmethods (Policy.\n[…]\ne YAML path so the\noperator can fix the right key.\n\nWiring into pkg/proxy and pkg/notify lands in subsequent commits; this\ncommit is schema-only.\n\nCo-Authored-By: Claude Opus 4 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "[phase-4a] policy: config schema for proxy + notify tunables",
          "author_name": "Caua Ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-04-19T02:15:55Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "e940f359720999170d0f7c2af0cea43b85f1ca10",
          "body": "New series agentguard_audit_migration_status{from,to,status} reports\nthe outcome of each registered audit-schema migration at startup.\nStatus is one of {ran, skipped, failed} — written from inside\nRunStartup before it returns on the error paths, so the gauge\nreflects what was in flight when the proc\n[…]\nunStartup_MarksFailureInMetric: a migrate error stamps\n   status=failed before RunStartup returns.\n\nCloses Phase 3 (observability metrics batch).\n\nCo-Authored-By: Claude Opus 4 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "[phase-3h] metrics: audit-schema migration status gauge",
          "author_name": "Caua Ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-04-19T00:29:45Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "3c0800c3b25057ca390d467b9e6095352a4f8286",
          "body": "…h gauge\n\nTwo series covering the notify worker pool:\n\n  agentguard_notify_queue_depth (gauge)\n    Length of the shared dispatch channel, sampled right after each\n    enqueue in Send(). A scrape-time read via len(chan) would race\n    with concurrent enqueues without additional locking; the\n    enque\n[…]\nmetheus output advances by N within 2s.\n - notify_test: queue_depth gauge TYPE line and value line both\n   present after a burst of Send() calls.\n\nCo-Authored-By: Claude Opus 4 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "[phase-3g] metrics: notify dispatch duration histogram and queue-dept…",
          "author_name": "Caua Ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-04-19T00:26:49Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "855c2398b8782837076b16b423b0e19fcaac64bc",
          "body": "Two series covering the /api/stream broadcast path:\n\n  agentguard_sse_subscribers (gauge)\n    Tracks the live watcher count. Updated by inc/dec in Subscribe\n    and Unsubscribe rather than at scrape-time so the /metrics\n    handler doesn't have to take the ApprovalQueue lock.\n\n  agentguard_sse_event\n[…]\nnsubscribe;\n   slow_consumer counter advances by exactly 2 when the\n   SSEChannelBufferSize+2 broadcasts are fired at an undrained\n   subscriber.\n\nCo-Authored-By: Claude Opus 4 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "[phase-3f] metrics: SSE subscriber gauge and slow-consumer drop counter",
          "author_name": "Caua Ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-04-19T00:23:44Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "e098b439fbc4c8277a0dcb2b86a23b6b23d492c6",
          "body": "Three new series covering the audit subsystem's two background costs:\n\n  agentguard_audit_replay_entries_total   (counter)\n  agentguard_audit_replay_duration_seconds (gauge)\n    Set once at process start when NewServer seeds in-memory decision\n    counters by walking the audit log. Duration is a gau\n[…]\n  TYPE lines and values after fixture increments; replay duration\n   reported in seconds (0.75 for 750ms) per Prometheus base-unit\n   convention.\n\nCo-Authored-By: Claude Opus 4 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "[phase-3e] metrics: audit startup-replay and rotation observability",
          "author_name": "Caua Ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-04-19T00:19:43Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "70038f4ed0f522a72c7976d1634983603fa257a6",
          "body": "…evictions\n\nTwo new series from pkg/ratelimit:\n\n  agentguard_ratelimit_buckets (gauge)\n    Snapshot of Limiter.BucketCount() at each /metrics scrape. Lets\n    operators watch bucket growth without introspecting the limiter\n    struct. Set inside handleMetrics so the refresh cadence matches\n    other\n[…]\nmitBuckets;\n   HELP/TYPE-only exposition when idle; sorted labeled exposition\n   after increments (index check anchored on the full metric name).\n\nCo-Authored-By: Claude Opus 4 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "[phase-3d] metrics: expose rate-limit bucket gauge and scope-labeled …",
          "author_name": "Caua Ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-04-19T00:16:01Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "9ae2b49ba1ed1caf8ec1757960ede2cef9a8a524",
          "body": "…n label\n\nAdd agentguard_approvals_evicted_total{reason} so operators can\ndistinguish the two capacity-pressure paths in pkg/proxy/server.go\nApprovalQueue.Add:\n\n  - reason=\"lru_resolved\": a resolved entry was dropped to make room.\n    Persistent non-zero rate ⇒ increase MaxPendingApprovals.\n  - reas\n[…]\nd on the full metric name so it doesn't collide with\n   reason=\"queue_full\" from the notify_dropped series emitted earlier\n   in the same scrape.\n\nCo-Authored-By: Claude Opus 4 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "[phase-3c] metrics: expose approval-queue eviction counter with reaso…",
          "author_name": "Caua Ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-04-19T00:12:47Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "a9ebd02407abc23a703317657d9c3400af0d04d1",
          "body": "…abels\n\nAdds agentguard_notify_events_dropped_total{notifier,reason}. Previously\nthe only way to see that the dispatcher queue had overflowed was to read\nthe package-level notify.DroppedEvents atomic — invisible to Prometheus\nscrapers, so \"why did approvals stop reaching Slack?\" required a live\ndebu\n[…]\nditive, not replacing.\n- Tests assert header-only emission for empty state, sorted-label\n  output, and that a real overflow through a stalled *WebhookNotifier\n  increments the webhook/queue_full slot.",
          "is_bot": false,
          "headline": "[phase-3b] metrics: expose notify drop counter with notifier+reason l…",
          "author_name": "Caua Ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-04-19T00:07:20Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b83d9d735646424e1eda570e3b53d4a20198dc68",
          "body": "Adds 2500, 5000, 10000 ms buckets to durationBuckets so long-tail\nevents (slow fsync, policy reload contention, locked rate-limit\nfan-out) have histogram resolution instead of all piling into +Inf.\n\nBuckets are a stable contract — existing boundaries are kept in order\nand only appended, so historical Prometheus data keeps its shape.",
          "is_bot": false,
          "headline": "[phase-3a] metrics: extend duration histogram tail to 10 s",
          "author_name": "Caua Ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-04-18T16:01:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2dde0c0a2516f8f09a1059ab443c0c9956d00703",
          "body": "The watcher now reacts to policy edits within a few ms on happy path\n(fsnotify) and degrades gracefully to 2 s polling when fsnotify can't\nbe initialised (inotify exhaustion, unsupported filesystem, etc).\n\nAtomic-replace aware: it watches the parent directory and filters\nevents by basename, so edito\n[…]\nmediately\".\n\nTests cover: event-driven reload, atomic-replace, bad-yaml-keeps-alive,\nmissing-file-returns-error, Close idempotence. All under 1s locally\nwith fsnotify; under 5s on poll-fallback paths.",
          "is_bot": false,
          "headline": "[phase-2.4] policy: fsnotify watcher with poll fallback",
          "author_name": "Caua Ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-04-18T15:58:33Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "fe565d5e0e0fc486eea268d0c9c74af3aaf54508",
          "body": "Replaces the old silent \"evict the oldest live session\" behavior with\nreject-new-with-503. Previously, a thundering herd of dashboard tabs\nwould quietly sign out a real operator mid-approval; now they see a\nvisible 503 with Retry-After: 5 and the active session keeps its seat.\n\n- SessionStore.Create\n[…]\ne_ConcurrentCreate now tolerates (and asserts non-zero)\n  ErrSessionStoreFull results so it continues to exercise the new path\n  and not just regress to \"sometimes passed because Create never failed\".",
          "is_bot": false,
          "headline": "[phase-2.3] proxy: session store rejects new logins when full",
          "author_name": "Caua Ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-04-18T15:51:10Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "007604ed7ec441218f5096cdbfb74afbecfe67d1",
          "body": "Replaces the bulk \"drop every resolved entry at once\" eviction in\nApprovalQueue.Add with LRU-on-CreatedAt: evict exactly the oldest\nresolved entry and leave other resolved entries alone so /v1/status\npolls continue to resolve.\n\nWhen the queue is at capacity and every slot is still unresolved,\nAdd re\n[…]\ne_EvictsResolved (asserted the old bulk\n  behavior) with TestApprovalQueue_EvictsOldestResolvedOnly; adds\n  TestApprovalQueue_FullRejectsWhenAllUnresolved and\n  TestHandleCheck_503OnApprovalQueueFull.",
          "is_bot": false,
          "headline": "[phase-2.2] proxy: LRU approval-queue eviction + 503 Retry-After",
          "author_name": "Caua Ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-04-18T15:31:35Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2f84de98bb5205a1392d66f7d2e161547735d079",
          "body": "V0.4.1",
          "is_bot": false,
          "headline": "Merge pull request #5 from Caua-ferraz/v0.4.1",
          "author_name": "Cauã Ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-04-18T03:57:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6a4f7bf03c8588803afce250f6f8f1a75b5f1c07",
          "body": "A test that fails after 2027-07-01 with an action list in the failure\nmessage. Makes the removal plan (v0.4.3, per docs/DEPRECATIONS.md)\nvisible in code rather than buried in a doc that only gets read during\nincidents.\n\nRationale: \"remember to delete old migrations\" has a poor track record.\nA failin\n[…]\nrtest path from \"oops we\nleft this in\" to \"cleanup PR merged\". If the v0.4.3 release genuinely\nslips, the deadline is easy to push and the slip gets documented in\nDEPRECATIONS.md — which is the point.",
          "is_bot": false,
          "headline": "[phase-2.1f] migrate: removal-deadline tripwire for v040_to_v041",
          "author_name": "Caua Ferraz",
          "author_login": "Caua-ferraz",
          "committed_at": "2026-04-18T03:53:06Z",
          "body_truncated": true,
          "is_coding_agent": false
        }
      ],
      "releases_count": 13,
      "commits_last_year": 155,
      "latest_release_at": "2026-07-22T14:13:56Z",
      "latest_release_tag": "v1.0.0",
      "releases_from_tags": false,
      "days_since_last_push": 2,
      "active_weeks_last_year": 13,
      "days_since_latest_release": 8,
      "mean_days_between_releases": 12.9
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": true,
      "health_percentage": 100,
      "has_issue_template": false,
      "has_code_of_conduct": true,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "github.com/Caua-ferraz/AgentGuard",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": true,
          "registry_url": "https://pkg.go.dev/github.com/Caua-ferraz/AgentGuard",
          "is_deprecated": false,
          "latest_version": "v1.0.0",
          "repository_url": "https://github.com/Caua-ferraz/AgentGuard",
          "versions_count": 6,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-22T03:45:10Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 9
        }
      ]
    },
    "popularity": {
      "forks": 1,
      "stars": 19,
      "watchers": 1,
      "fork_history": {
        "days": [
          {
            "date": "2026-04-01",
            "count": 1
          }
        ],
        "complete": true,
        "collected": 1,
        "total_forks": 1
      },
      "star_history": null,
      "open_issues_and_prs": 6
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [
        "examples"
      ],
      "has_llms_txt": false,
      "has_dockerfile": true,
      "has_mcp_signal": false,
      "bootstrap_files": [
        "Makefile"
      ],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [
        "plugins/typescript/tsconfig.json"
      ],
      "toolchain_manifests": [
        "go.mod"
      ],
      "largest_source_bytes": 101319,
      "source_files_sampled": 235,
      "oversized_source_files": 3,
      "agent_instruction_files": [],
      "agent_instruction_max_bytes": null
    },
    "dependencies": {
      "manifests": [
        "go.mod"
      ],
      "advisories": {
        "error": null,
        "scope": "repository_graph",
        "source": "osv",
        "findings": [],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {},
        "advisory_count": 0,
        "affected_count": 0,
        "assessed_count": 21,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 16,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "go"
      ],
      "dependencies": [
        {
          "name": "github.com/fsnotify/fsnotify",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.10.1"
        },
        {
          "name": "github.com/jackc/pgx/v5",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v5.9.2"
        },
        {
          "name": "gopkg.in/yaml.v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.0.1"
        },
        {
          "name": "modernc.org/sqlite",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.38.2"
        }
      ],
      "all_dependencies": {
        "error": null,
        "source": "github-sbom",
        "packages": [
          {
            "name": "github.com/fsnotify/fsnotify",
            "direct": true,
            "version": "v1.10.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jackc/pgx/v5",
            "direct": true,
            "version": "v5.9.2",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/yaml.v3",
            "direct": true,
            "version": "v3.0.1",
            "ecosystem": "go"
          },
          {
            "name": "modernc.org/sqlite",
            "direct": true,
            "version": "v1.38.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/dustin/go-humanize",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/uuid",
            "direct": false,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jackc/pgpassfile",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jackc/pgservicefile",
            "direct": false,
            "version": "v0.0.0-20240606120523-5a60cdf6a761",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jackc/puddle/v2",
            "direct": false,
            "version": "v2.2.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/kr/text",
            "direct": false,
            "version": "v0.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-isatty",
            "direct": false,
            "version": "v0.0.20",
            "ecosystem": "go"
          },
          {
            "name": "github.com/ncruces/go-strftime",
            "direct": false,
            "version": "v0.1.9",
            "ecosystem": "go"
          },
          {
            "name": "github.com/remyoudompheng/bigfft",
            "direct": false,
            "version": "v0.0.0-20230129092748-24d4a6f8daec",
            "ecosystem": "go"
          },
          {
            "name": "github.com/rogpeppe/go-internal",
            "direct": false,
            "version": "v1.15.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/exp",
            "direct": false,
            "version": "v0.0.0-20250620022241-b7579e27df2b",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sync",
            "direct": false,
            "version": "v0.21.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sys",
            "direct": false,
            "version": "v0.45.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.39.0",
            "ecosystem": "go"
          },
          {
            "name": "modernc.org/libc",
            "direct": false,
            "version": "v1.66.3",
            "ecosystem": "go"
          },
          {
            "name": "modernc.org/mathutil",
            "direct": false,
            "version": "v1.7.1",
            "ecosystem": "go"
          },
          {
            "name": "modernc.org/memory",
            "direct": false,
            "version": "v1.11.0",
            "ecosystem": "go"
          },
          {
            "name": "@types/jest",
            "direct": false,
            "version": "^30.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "@types/node",
            "direct": false,
            "version": "^22.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "jest",
            "direct": false,
            "version": "^30.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "ts-jest",
            "direct": false,
            "version": "^29.4.0",
            "ecosystem": "npm"
          },
          {
            "name": "typescript",
            "direct": false,
            "version": "^6.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "browser-use",
            "direct": false,
            "version": null,
            "ecosystem": "pypi"
          },
          {
            "name": "crewai",
            "direct": false,
            "version": null,
            "ecosystem": "pypi"
          },
          {
            "name": "langchain",
            "direct": false,
            "version": null,
            "ecosystem": "pypi"
          },
          {
            "name": "langchain-core",
            "direct": false,
            "version": null,
            "ecosystem": "pypi"
          },
          {
            "name": "mcp",
            "direct": false,
            "version": null,
            "ecosystem": "pypi"
          },
          {
            "name": "playwright",
            "direct": false,
            "version": null,
            "ecosystem": "pypi"
          },
          {
            "name": "pytest",
            "direct": false,
            "version": null,
            "ecosystem": "pypi"
          },
          {
            "name": "pytest-asyncio",
            "direct": false,
            "version": null,
            "ecosystem": "pypi"
          },
          {
            "name": "pytest-cov",
            "direct": false,
            "version": null,
            "ecosystem": "pypi"
          },
          {
            "name": "responses",
            "direct": false,
            "version": null,
            "ecosystem": "pypi"
          },
          {
            "name": "setuptools",
            "direct": false,
            "version": null,
            "ecosystem": "pypi"
          }
        ],
        "collected": true,
        "truncated": false,
        "total_count": 37,
        "direct_count": 4,
        "indirect_count": 33
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 6,
        "merged_prs": 11,
        "open_issues": 0,
        "closed_ratio": null,
        "closed_issues": 0,
        "closed_unmerged_prs": 23
      },
      "bus_factor": 1,
      "bot_contributors": 0,
      "top_contributors": [
        {
          "type": "User",
          "login": "Caua-ferraz",
          "commits": 155,
          "avatar_url": "https://avatars.githubusercontent.com/u/124847643?v=4"
        }
      ],
      "contributors_sampled": 1,
      "top_contributor_share": 1
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "ci.yml",
        "publish-pypi.yml",
        "release-sbom.yml"
      ],
      "has_docs_dir": true,
      "linter_configs": [
        ".golangci.yml"
      ],
      "has_editorconfig": false,
      "has_linter_config": true,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "go.sum"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 10,
            "reason": "3 out of 3 merged PRs checked by a CI test -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/10 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 0,
            "reason": "project has 0 contributing companies or organizations -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 10,
            "reason": "update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 10,
            "reason": "project is fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 10,
            "reason": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": null,
            "reason": "packaging workflow not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 0,
            "reason": "dependency not pinned by hash detected -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 10,
            "reason": "SAST tool is run on all commits",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 10,
            "reason": "security policy file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": 0,
            "reason": "Project has not signed or included provenance with any releases.",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 10,
            "reason": "0 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "abcfb0f840bcb499e8adb10a7a0ba25f86a628e5",
        "ran_at": "2026-07-31T09:17:29Z",
        "aggregate_score": 6,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": true,
      "has_dependabot_config": true
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-29T09:14:30Z",
      "oldest_open_prs": [
        {
          "number": 33,
          "created_at": "2026-07-15T09:13:48Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 35,
          "created_at": "2026-07-15T09:14:12Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 37,
          "created_at": "2026-07-22T03:37:01Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 38,
          "created_at": "2026-07-22T09:14:01Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 39,
          "created_at": "2026-07-22T09:14:05Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 40,
          "created_at": "2026-07-29T09:14:13Z",
          "last_comment_at": null,
          "last_comment_author": null
        }
      ],
      "last_merged_pr_at": "2026-07-22T03:34:44Z",
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": []
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/Caua-ferraz/AgentGuard",
    "host": "github.com",
    "name": "AgentGuard",
    "owner": "Caua-ferraz"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "good",
      "name": "Overall health",
      "note": "The weighted overall 63 is calibrated to 71 on the published index scale (record calibration 2026-08-02).",
      "notes": [
        {
          "code": "overall_calibration",
          "params": {
            "raw": 63,
            "calibrated": 71,
            "calibration": "2026-08-02"
          }
        }
      ],
      "value": 71,
      "inputs": {
        "security": 68,
        "vitality": 80,
        "community": 50,
        "governance": 37,
        "calibration": "2026-08-02",
        "engineering": 80,
        "ai_readiness": 68,
        "weighted_overall_raw": 63
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "excellent",
        "name": "Vitality",
        "value": 80,
        "weight": 0.21,
        "metrics": [
          {
            "key": "development_activity",
            "band": "good",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 73,
            "inputs": {
              "commits_last_year": 155,
              "human_commit_share": 1,
              "days_since_last_push": 2,
              "active_weeks_last_year": 13
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 2 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 2
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "13/52 weeks with commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 13
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "155 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 155
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": null,
            "notes": [],
            "value": 90,
            "inputs": {
              "releases_count": 13,
              "latest_release_tag": "v1.0.0",
              "releases_from_tags": false,
              "days_since_latest_release": 8,
              "mean_days_between_releases": 12.9
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "13 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 13
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 8 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 8
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~12.9 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 12.9
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "exceptional",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "moderate",
        "name": "Community & Adoption",
        "value": 50,
        "weight": 0.17,
        "metrics": [
          {
            "key": "popularity",
            "band": "at_risk",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 20,
            "inputs": {
              "forks": 1,
              "stars": 19,
              "watchers": 1,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "19 stars",
                "points": 20.4,
                "status": "partial",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 19
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "1 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "1 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "excellent",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "readme_badges": null,
              "has_contributing": true,
              "has_issue_template": false,
              "has_code_of_conduct": true,
              "readme_badge_services": [],
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (Apache-2.0)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "Apache-2.0"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 18,
                "status": "met",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 13.5,
                "status": "met",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "weak",
        "name": "Sustainability & Governance",
        "value": 37,
        "weight": 0.23,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 10,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 1,
              "top_contributor_share": 1
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 100% of commits",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 100
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "1 contributors",
                "points": 1.4,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 0 contributing companies or organizations -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "at_risk",
            "name": "Issue & PR responsiveness",
            "note": "Excluded from scoring (no data or not applicable): Issue resolution, Newcomer PR acceptance. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "issue_resolution",
                    "newcomer_pr_acceptance"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 22,
            "inputs": {
              "merged_prs": 11,
              "open_issues": 0,
              "closed_issues": 0,
              "prs_merged_7d": null,
              "prs_decided_7d": null,
              "prs_merged_30d": null,
              "prs_decided_30d": null,
              "issue_closed_ratio": null,
              "closed_unmerged_prs": 23,
              "first_time_authors_30d": null,
              "first_time_prs_merged_30d": null,
              "first_time_prs_decided_30d": null
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "no issues or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_issues_or_data",
                    "params": {}
                  }
                ],
                "max_points": 42
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "11/34 decided PRs merged",
                "points": 9.7,
                "status": "partial",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 11,
                      "decided": 34
                    }
                  }
                ],
                "max_points": 30
              },
              {
                "key": "newcomer_pr_acceptance",
                "name": "Newcomer PR acceptance",
                "detail": "no first-time contributor's PR decided in 30d",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_newcomer_prs",
                    "params": {
                      "days": 30
                    }
                  }
                ],
                "max_points": 13
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/10 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "at_risk",
            "name": "Ownership & stewardship",
            "note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "verified_domain"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 34,
            "inputs": {
              "followers": 4,
              "owner_type": "User",
              "is_verified": null,
              "owner_login": "Caua-ferraz",
              "public_repos": 5,
              "account_age_days": 1268
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "personal (user) account",
                "points": 10,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_personal",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": "not applicable to user accounts",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_applicable_to_user_accounts",
                    "params": {}
                  }
                ],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "4 followers of Caua-ferraz",
                "points": 5,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 4,
                      "login": "Caua-ferraz"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "5 public repos, account ~3 yr old",
                "points": 12.6,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 5
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 3
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "exceptional",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "github.com/Caua-ferraz/AgentGuard"
              ],
              "ecosystems": "go",
              "any_deprecated": false,
              "min_days_since_publish": 9
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on go",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "go"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 9 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 9
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "6 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 6
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "excellent",
        "name": "Engineering Quality",
        "value": 80,
        "weight": 0.19,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "excellent",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 84,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": true,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "3 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 3
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": ".golangci.yml",
                "points": 16,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yml"
                    }
                  }
                ],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "3 out of 3 merged PRs checked by a CI test -- score normalized to 10",
                "points": 20,
                "status": "met",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "good",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 75,
            "inputs": {
              "topics": [],
              "has_wiki": true,
              "homepage": null,
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "good",
        "name": "Security",
        "value": 68,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "moderate",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): Packaging. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "packaging"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 60,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 17,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 1,
              "scorecard_aggregate": 6
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "3 out of 3 merged PRs checked by a CI test -- score normalized to 10",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/10 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 0 contributing companies or organizations -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "update tool detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is fuzzed",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow not detected",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool is run on all commits",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "0 existing vulnerabilities detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "exceptional",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 21 resolved dependencies against OSV; 16 could not be assessed (no resolved version, an unsupported ecosystem, or beyond the reported package list). This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "indirect_dependencies_free_of_known_advisories",
                    "no_advisories_left_outstanding"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_repository",
                "params": {
                  "assessed": 21
                }
              },
              {
                "code": "advisories_unassessed",
                "params": {
                  "count": 16
                }
              },
              {
                "code": "advisories_repo_graph_caveat",
                "params": {}
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "source": "osv",
              "advisories": 0,
              "affected_packages": 0,
              "assessed_packages": 21,
              "unassessed_packages": 16,
              "affected_by_severity": "none",
              "direct_affected_packages": 0
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "no direct dependency carries a known advisory",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "no_direct_advisories",
                    "params": {}
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "transitive set not separable from development and test dependencies in this scope",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_scope_not_separable",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory carries a publication date",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_no_publication_date",
                    "params": {}
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "exceptional",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 21,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "good",
        "name": "AI Readiness",
        "value": 68,
        "weight": 0.04,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "weak",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 0.82,
              "agent_instruction_files": [],
              "agent_instruction_max_bytes": null
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "no CLAUDE.md / AGENTS.md / editor rules",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_instructions",
                    "params": {}
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "82 of 100 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 82,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "excellent",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 87,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "go.sum"
              ],
              "has_dockerfile": true,
              "typed_language": true,
              "bootstrap_files": [
                "Makefile"
              ],
              "has_devcontainer": false,
              "has_linter_config": true,
              "typecheck_configs": [
                "plugins/typescript/tsconfig.json"
              ],
              "agent_commit_share": 0.35,
              "toolchain_manifests": [
                "go.mod"
              ],
              "dependency_bot_commit_share": 0
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "Makefile",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Makefile"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": ".golangci.yml",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yml"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "plugins/typescript/tsconfig.json",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "plugins/typescript/tsconfig.json"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "Dockerfile, lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Dockerfile, lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "35 of the last 100 commits agent-authored or agent-credited",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "agent_authored_commits",
                    "params": {
                      "count": 35,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "dependency automation configured, none observed in the sampled commits",
                "points": 5,
                "status": "partial",
                "details": [
                  {
                    "code": "dependency_bot_config_only",
                    "params": {}
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "exceptional",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 99,
            "inputs": {
              "primary_language": "Go",
              "largest_source_bytes": 101319,
              "source_files_sampled": 235,
              "oversized_source_files": 3
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Go (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "3/235 source files over 60KB",
                "points": 54.3,
                "status": "partial",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 235,
                      "oversized": 3
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "weak",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "example_dirs": [
                "examples"
              ],
              "has_mcp_signal": false,
              "api_schema_files": []
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": "examples",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "examples"
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? Carries a deliberately small weight: agent tooling is a real maintenance signal, but its absence must never gate the top of the scale (calibration saturates at raw 91, so 100/100 remains reachable with AI Readiness at zero)."
      }
    ],
    "classification": {
      "labels": [
        "library"
      ],
      "scores": {
        "library": 6
      },
      "primary": "library",
      "evidence": [
        {
          "tier": "distribution",
          "label": "library",
          "source": "registry:go",
          "weight": 6
        }
      ],
      "artifacts": [],
      "confidence": "medium",
      "host_extension": false,
      "runs_as_process": false,
      "consumed_by_code": true
    },
    "metrics_version": "2.3.1"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-31T09:17:41.158346Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/c/Caua-ferraz/AgentGuard.svg",
  "full_name": "Caua-ferraz/AgentGuard",
  "license_state": "standard",
  "license_spdx": "Apache-2.0"
}