JPHutchins / code-review

The resolved dependency set could not be collected for this report: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository

Installing npm:@jphutchins/code-review@0.1.0-alpha.1 pulls in 12 packages, direct and transitive: 0 carry known advisories, of which 0 are direct dependencies.

No known advisories affect the assessed dependencies.

An advisory means the version recorded in the dependency graph falls inside an advisory’s affected range. Reachability is not analysed, and the graph includes development and test pins — a finding may concern tooling rather than shipped software.

{
  "data": {
    "repo": {
      "topics": [],
      "is_fork": false,
      "size_kb": 1382,
      "has_wiki": true,
      "homepage": null,
      "languages": {
        "Shell": 8561,
        "Python": 1460,
        "JavaScript": 65314,
        "TypeScript": 521207
      },
      "pushed_at": "2026-07-17T00:02:04Z",
      "created_at": "2026-07-01T23:55:24Z",
      "owner_type": "User",
      "updated_at": "2026-07-20T05:33:22Z",
      "description": null,
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "MIT",
      "default_branch": "main",
      "license_spdx_raw": "MIT",
      "primary_language": "TypeScript",
      "significant_languages": [
        "TypeScript",
        "JavaScript"
      ]
    },
    "owner": {
      "blog": "https://www.crumpledpaper.tech",
      "name": "JP Hutchins",
      "type": "User",
      "login": "JPHutchins",
      "company": "@Intercreate",
      "location": "San Francisco, CA",
      "followers": 41,
      "avatar_url": "https://avatars.githubusercontent.com/u/34154542?v=4",
      "created_at": "2017-12-01T07:52:00Z",
      "is_verified": null,
      "public_repos": 85,
      "account_age_days": 3154
    },
    "license": {
      "state": "standard",
      "spdx_id": "MIT",
      "raw_spdx": "MIT",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.1.0-alpha.25",
          "kind": "prerelease",
          "published_at": "2026-07-17T00:00:07Z"
        },
        {
          "tag": "v0.1.0-alpha.24",
          "kind": "prerelease",
          "published_at": "2026-07-15T22:01:47Z"
        },
        {
          "tag": "v0.1.0-alpha.23",
          "kind": "prerelease",
          "published_at": "2026-07-15T19:22:44Z"
        },
        {
          "tag": "v0.1.0-alpha.22",
          "kind": "prerelease",
          "published_at": "2026-07-15T18:29:01Z"
        },
        {
          "tag": "v0.1.0-alpha.21",
          "kind": "prerelease",
          "published_at": "2026-07-15T06:40:10Z"
        },
        {
          "tag": "v0.1.0-alpha.20",
          "kind": "prerelease",
          "published_at": "2026-07-15T05:47:20Z"
        },
        {
          "tag": "v0.1.0-alpha.19",
          "kind": "prerelease",
          "published_at": "2026-07-15T01:14:09Z"
        },
        {
          "tag": "v0.1.0-alpha.18",
          "kind": "prerelease",
          "published_at": "2026-07-14T18:49:23Z"
        },
        {
          "tag": "v0.1.0-alpha.17",
          "kind": "prerelease",
          "published_at": "2026-07-14T00:58:26Z"
        },
        {
          "tag": "v0.1.0-alpha.16",
          "kind": "prerelease",
          "published_at": "2026-07-14T00:31:14Z"
        },
        {
          "tag": "v0.1.0-alpha.15",
          "kind": "prerelease",
          "published_at": "2026-07-13T23:37:36Z"
        },
        {
          "tag": "v0.1.0-alpha.14",
          "kind": "prerelease",
          "published_at": "2026-07-13T20:04:50Z"
        },
        {
          "tag": "v0.1.0-alpha.13",
          "kind": "prerelease",
          "published_at": "2026-07-10T00:19:08Z"
        },
        {
          "tag": "v0.1.0-alpha.12",
          "kind": "prerelease",
          "published_at": "2026-07-09T05:16:11Z"
        },
        {
          "tag": "v0.1.0-alpha.11",
          "kind": "prerelease",
          "published_at": "2026-07-09T03:41:17Z"
        },
        {
          "tag": "v0.1.0-alpha.10",
          "kind": "prerelease",
          "published_at": "2026-07-09T00:25:49Z"
        },
        {
          "tag": "v0.1.0-alpha.9",
          "kind": "prerelease",
          "published_at": "2026-07-08T04:48:23Z"
        },
        {
          "tag": "v0.1.0-alpha.8",
          "kind": "prerelease",
          "published_at": "2026-07-08T02:29:26Z"
        },
        {
          "tag": "v0.1.0-alpha.7",
          "kind": "prerelease",
          "published_at": "2026-07-07T05:55:26Z"
        },
        {
          "tag": "v0.1.0-alpha.6",
          "kind": "prerelease",
          "published_at": "2026-07-06T23:06:31Z"
        },
        {
          "tag": "v0.1.0-alpha.5",
          "kind": "prerelease",
          "published_at": "2026-07-06T04:55:52Z"
        },
        {
          "tag": "v0.1.0-alpha.4",
          "kind": "prerelease",
          "published_at": "2026-07-06T02:40:41Z"
        },
        {
          "tag": "v0.1.0-alpha.3",
          "kind": "prerelease",
          "published_at": "2026-07-06T02:15:17Z"
        },
        {
          "tag": "v0.1.0-alpha.2",
          "kind": "prerelease",
          "published_at": "2026-07-05T23:53:32Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "58b5de8fc769a98917e981a664ba829bfd11b4a4",
          "body": "…(alpha.25) (#94)\n\nThe `/code-review` comment trigger is no longer DIY, and no longer CI-blind.\n\nReusable front-end: a new `review-on-comment-reusable.yaml` owns the mechanical\nplumbing (parse the comment args, resolve the PR head, the 👀/🚀 ack, and the\nreview dispatch), nested-calling the same `revi\n[…]\ned in both reusables alongside package.json/lock and the example @refs.\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "feat: CI-result-aware on-demand comment trigger + reusable front-end …",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-17T00:00:07Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "57aa63d13c2b9257fbc0a775a82a17426ddf595d",
          "body": "…start (#93)\n\nFollows #65 / v0.1.0-alpha.24 — points readers at the review-on-comment recipe\nand its security model. (Also serves as the first live dogfood of the trigger.)\n\n\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD\n\nCo-authored-by: claude-opus-4-8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: mention the on-demand /code-review comment trigger in the Quick…",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-15T22:50:33Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "f0e0c5c2eb4d721dd0f47613043cb1de4734353c",
          "body": "Dogfooding the on-comment trigger surfaced an HTTP 403 \"Resource not accessible\nby integration\" on the 👀 reaction: a reaction on a PULL REQUEST comment is\nscoped to Pull requests, so the gate/ack jobs need pull-requests:write —\nissues:write does not cover it. Fix both the dogfood workflow and the example\nrecipe (the gate also resolves the PR head, which write covers).\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "fix: react to PR comments needs pull-requests:write, not issues:write",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-15T22:15:05Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "217343086de30cdf3f017e9a02362d7e3d51e4a5",
          "body": "Adds the /code-review comment trigger to this repo (delegating to the reusable\nworkflow by local ref, like review.yaml), so the on-comment path can be\nexercised end-to-end on real PRs. Follows #65 / v0.1.0-alpha.24.\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "ci: dogfood the on-demand ChatOps trigger on code-review itself",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-15T22:03:55Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "c73aab7995058dc25484368ef20c624e28d7dcf1",
          "body": "Ships the on-demand ChatOps review trigger (#65): the parse-command and react\nCLI subcommands, the duration_override/usd_override/extra_instructions inputs\non the reusable workflow, and the review-on-comment example recipe.\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "chore(release): v0.1.0-alpha.24",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-15T22:01:47Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "a77223cbc6e4a0140a451f939b914a6f3f5c9dd2",
          "body": "…#92)\n\nAdditive, opt-in comment trigger: `/code-review [24m] [$1.00] <instructions>`\non a PR runs a review on demand, optionally with a bigger time/cost budget and\na one-off focus.\n\nThe reusable workflow stays trigger-agnostic — it gains only three TRUSTED\noverride inputs (duration_override, usd_ove\n[…]\ns trust boundary,\nAPI head resolution, self-trigger guard.\n\nCloses #65.\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "feat: on-demand ChatOps review trigger (/code-review 24m $1.00 ...) (…",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-15T22:00:10Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "50ac91600446ceef924ce9bb1e73e8e0cea852eb",
          "body": "Ships #90 — the revised reusable-workflow input surface (required models,\ntime-limit/grace-period/USD-cap inputs, node_version + code_review_version\nremoved). Breaking for consumers; the CLI is unchanged from alpha.22.\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "chore(release): v0.1.0-alpha.23",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-15T19:22:44Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "c982a7ce0013d507a0df23fd856e7a0468b21a94",
          "body": "BREAKING — models are now required (model_full/model_mechanic, no default);\nwalls renamed to full_review_time_limit/mechanic_time_limit; hard-kill is now a\ngrace-period delta (full_review_grace_period 12m / mechanic_grace_period 3m,\nsummed to the same 36m/9m SIGTERM); new full_review_usd_limit ($1) \n[…]\ns\nits input. Own callers + the README example pass the required models.\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "feat!: revise reusable-workflow input surface (#90) (#91)",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-15T19:21:36Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "f4f0ace3d45683a8ba4de221913fb829d755a715",
          "body": "Ships #71 (same-commit vs new-commit re-review seeding), #61 (last-valid\n$DRAFT snapshot + adapt fallback), #68 (pipeline diagnostics + dedup), and the\nunreleased CLAUDE.md audit. Bumps the reusable workflow's code_review_version\ndefault to alpha.22 so the new --head-sha / --agent-file-fallback flags resolve.\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "chore(release): v0.1.0-alpha.22",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-15T18:29:01Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "5069e40aa8516e5ab3d8d8f2256bc5c49373c1c9",
          "body": "…eview, not \"did not complete\" (#61) (#88)\n\nThe budget hook snapshots $DRAFT to findings-draft.last-valid.json whenever it\npasses the extraction ladder (main agent only); adapt falls back to it, tried\nafter --agent-file and before the native envelope, so a wall-kill that truncated\nthe live draft rec\n[…]\neps the snapshot gate and\nsingle-writer deny consistent on agent_id \"\".\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "feat: last-valid $DRAFT snapshot — a wall-kill posts the last valid r…",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-15T18:27:07Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "549f67c11a4cbb13a60e5137f8bb4f4741a07d2b",
          "body": "Four low-risk workflow cleanups (both the reusable workflow and its\ncopy-paste twin; no happy-path behavior change):\n\n- Non-timeout agent failures were silent — only 124/137 warned. A non-zero\n  exit that isn't the hard-kill (API 5xx, auth, crash) now warns instead of\n  flowing into adapt unremarked\n[…]\ne schema-version\nSSOT via scaffold-* subcommands (a new CLI surface).\n\n\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD\n\nCo-authored-by: claude-opus-4-8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: surface swallowed pipeline diagnostics + dedup (#68) (#89)",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-15T18:09:40Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "44b1c7d150d0e1ed3db827611677d78b38e40953",
          "body": "* feat: branch re-review seeding on same-commit vs new-commit (#71)\n\nseed-draft now compares the prior review's embedded reviewed-sha against\nthe current head SHA (new --head-sha) and reports a richer mode so the\nworkflow tailors the agent's guidance to the actual scenario:\n\n- prior-same: the code h\n[…]\nst.\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD\n\n---------\n\nCo-authored-by: claude-opus-4-8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: branch re-review seeding on same-commit vs new-commit (#71) (#87)",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-15T17:40:34Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "bbbed50a662caa13ea0971943559d76ca4a5b408",
          "body": "…audit #82 3/N] (#85)\n\n* refactor(docs): purge internal refs from the reusable-workflow comments (#82)\n\nAudit #82 group 7. The reusable workflow and its copy-paste twin are public and\nconsumer-read; their comments carried internal code-review refs (issue #NN, §N.N,\n26 in all) that mean nothing to an\n[…]\n#82\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD\n\n---------\n\nCo-authored-by: claude-opus-4-8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "refactor(docs): purge internal refs from reusable-workflow comments […",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-15T15:38:29Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "45370078a49ea07ce28808e74238a613247cf401",
          "body": "… (#86)\n\nAudit #82 groups 4-6 (code dedup; no behavior change):\n\n- Group 4: add errMsg(e) to util.ts and replace the 22 copies of\n  `err instanceof Error ? err.message : String(err)` (post/index/gather/stop-gate).\n- Group 5: `fail` already returns `never`, so use it as an expression\n  (`return fail(\n[…]\n-object still yield the same\nundefined/null via asRecord).\n\nRefs: #82\n\n\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD\n\nCo-authored-by: claude-opus-4-8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "refactor: dedup errMsg, fail-as-expression, shared tryParseJson (#82)…",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-15T15:36:25Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "072b28cc6bc040d233b975f49f67d30eb5ef058b",
          "body": "…t.ts), subcommand SSOT [audit #82 1/N] (#83)\n\n* refactor(docs): purge internal refs + trim docstrings in index.ts/budget.ts (#82)\n\nAudit #82 groups 1-3, scoped to the two files read in full:\n\n- Group 1: strip internal issue/§ refs from shipped text — including the\n  user-facing `code-review --help`\n[…]\n#82\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD\n\n---------\n\nCo-authored-by: claude-opus-4-8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "refactor(docs): purge internal refs + trim docstrings (index.ts/budge…",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-15T15:30:42Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "7c735ef665ca67fa4f734cc03839227ae4b7cdb8",
          "body": "Honest pipeline failures (#67 openssl fail-closed, #77 infra-vs-gate messaging,\n#74 extra_endpoints single-line guard), plus review-response hardening\n(compute the triage delimiter once from openssl-or-/dev/urandom; distinct\ngate-block message for a reasonless unsafe verdict).\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "chore(release): v0.1.0-alpha.21",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-15T06:40:10Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "ae3cf1660662ce621adc64c08783f618c8f87585",
          "body": "…gate, #74 extra_endpoints) (#81)\n\n* fix: honest pipeline failures (#67, #74, #77)\n\nThree pre-existing pipeline-bash issues, applied to both the reusable workflow\nand the copy-paste example:\n\n- #67: fail closed if openssl is unavailable. The triage heredoc delimiter is\n  seeded by `openssl rand`; wi\n[…]\nts.\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD\n\n---------\n\nCo-authored-by: claude-opus-4-8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: honest pipeline failures (#67 openssl fail-closed, #77 infra-vs-…",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-15T06:39:31Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "aadff5b28cbfaccb67e45417304a214fd8e3b1ce",
          "body": "Pins harden-runner to the fail-closed fork (JPHutchins/harden-runner@ee143ec)\nuntil step-security/harden-runner#676 merges, so block-mode reviews on repos\nwith a cold harden-runner cache (e.g. jphfmt) enforce egress instead of\nfail-closing at the canary. See #79.\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "chore(release): v0.1.0-alpha.20",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-15T05:47:20Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "f39d88ac777886db7f7dfbb610213cd22379fee2",
          "body": "…rges (#80)\n\nharden-runner's egress-policy: block silently degrades to audit when it cannot\nresolve the Actions cache host during arming (a cold cache, or a lost cache\nreservation race): GetCacheEntryDownloadURL returns no URL, new URL(undefined)\nthrows, and the catch downgrades block -> audit. The \n[…]\n#79, step-security/harden-runner#675, step-security/harden-runner#676\n\n\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD\n\nCo-authored-by: claude-opus-4-8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: pin harden-runner to the fail-closed fork until upstream #676 me…",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-15T05:45:36Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "99168ff706362cd903e12be2cc351da39f85bd4e",
          "body": "Bump package.json + sync the lockfile, and roll the code_review_version\ndefault (reusable workflow), the copy-paste example CLI pins, the README\ncaller pin, and the dogfood consumer's illustrative pin to 0.1.0-alpha.19.\n\nalpha.19 = #73 (forced-background subagent spawns + draft-existence\nfan-out gate) + #72 (egress canary, fail closed on a silent block→audit\ndowngrade).\n\nCo-Authored-By: claude-fable-5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "chore(release): v0.1.0-alpha.19",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-15T01:14:09Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "99a00988f0e95ca37689d21a9ec32d6ad70776c3",
          "body": "…o audit (#76)\n\n* feat: egress canary — fail the job closed when the block policy silently did not engage\n\nharden-runner's egress-policy: block can silently degrade to audit at\narm time (Unable to fetch cacheURL TypeError: Invalid URL → Switching\negress-policy to audit mode), filed upstream as\nstep-\n[…]\nlock.\n\nCo-Authored-By: claude-fable-5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD\n\n---------\n\nCo-authored-by: claude-fable-5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: egress canary — fail closed when harden-runner silently drops t…",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-14T23:56:21Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "eb8de1be854bc36ac2fa267c299af38021598309",
          "body": "…n-out (#75)\n\n* feat: force subagent spawns to the background + gate fan-out on a first-pass draft\n\nA main agent that issues N parallel subagent spawns blocks on the batch\njoin and becomes unhookable: it makes no tool calls while waiting, so\nbudget steers and forced-convergence denies have no surfac\n[…]\nloor.\n\nCo-Authored-By: claude-fable-5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD\n\n---------\n\nCo-authored-by: claude-fable-5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: forced-background subagent spawns + draft-existence gate for fa…",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-14T23:55:50Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "bec52dce7e17c21260503fbfc55bde9fd9f8980c",
          "body": "Co-Authored-By: claude-fable-5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "chore: remove throwaway harden-runner probes",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-14T19:10:24Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "24332a8a66d0d56b553017d2f2ebd9f3189227e2",
          "body": "Co-Authored-By: claude-fable-5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "probe: + restricted per-job permissions (review-job shape)",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-14T19:05:36Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "9ee177ab60a66f598aedb9870bb01cbe74b01c76",
          "body": "…way)\n\nCo-Authored-By: claude-fable-5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "probe: harden-runner block under a workflow_run-triggered job (throwa…",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-14T19:04:18Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "e922d10f3cd804a9b0adac4e9faa674be8098bea",
          "body": "Co-Authored-By: claude-fable-5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "docs: roll the README caller example pin to alpha.18",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-14T18:49:43Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "cdfa986c6f1008235428d03d3931d198f736df7e",
          "body": "… wall\n\nField data (a full-route review SIGTERM'd at 13m where one slow subagent\nconsumed the entire 3m grace and the main agent never got its post-join\nsynthesis window) showed the over-budget grace has two consumers: subagents\nwinding down AND main's synthesis + $DRAFT write after the fan-out join\n[…]\nhe reusable workflow and the single-file example. Roll pins to\nalpha.18.\n\nCo-Authored-By: claude-fable-5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "chore(release): v0.1.0-alpha.18 — hard-kill grace = 50% of the budget…",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-14T18:49:23Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "7569a6a2329793fae1d2b451e236110c5a5b15dc",
          "body": "Replaces the closed #69 with alpha.17-accurate docs: the \"two ways to\nconsume it\" split, a minimal STATIC-by-default reusable caller pinned at\nalpha.17, and a \"check-running with the reusable workflow\" section covering\nthe two opt-in hooks — install_command (shell) and use_setup_action (the\nconsumer\n[…]\nith a Nix example). Generalizes the setup steps to apply\nto both paths.\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "docs: document the reusable-workflow consumer path (alpha.17)",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-14T01:09:46Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "7a93c9edcb2e629c53a13de27ba4f098cdd83592",
          "body": "Ships the consumer-owned-setup refactor (#70): the reusable workflow no\nlonger embeds any ecosystem toolchain/cache action. Roll code_review_version\ndefault + example pins to alpha.17; sync package-lock.\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "chore(release): v0.1.0-alpha.17",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-14T00:58:26Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "4e24795ddfe9ef39bfa56a541d295379f24d5904",
          "body": "…tup) (#70)\n\nalpha.16 embedded nix-community/cache-nix-action (and a setup: nix|python\nenum) directly in the shared reusable workflow — making it own specific\necosystems' toolchain installers and cache systems. That's a slippery slope\n(npm/cargo/pip/bazel caches next) and pollutes a file every consu\n[…]\n:-based ecosystems (Nix) now go through the consumer's own composite.\n\n\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD\n\nCo-authored-by: claude-opus-4-8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: keep the reusable workflow ecosystem-agnostic (consumer-owned se…",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-14T00:57:54Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "367690da4bfcd60ee425aa43bcef18c842240065",
          "body": "…alpha.16)\n\nAdd nix-community/cache-nix-action to the review job when setup == 'nix',\nkeyed on the caller's flake/nix/lock files, so the dev shell persists across\nreview runs instead of being refetched from cache.nixos.org + rebuilt from\nsource every time (jphfmt's own CI already caches this way). O\n[…]\nsion default + single-file example\npins to alpha.16; sync package-lock.\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "feat: cache the Nix store in the reusable workflow's setup:nix path (…",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-14T00:31:14Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "b8572a938bbccd2149cb26a3153122c27d5ccaf2",
          "body": "First release shipping the reusable workflow (.github/workflows/review-reusable.yaml,\non: workflow_call). Rolls the code-review CLI pin to alpha.15 in the reusable workflow's\ncode_review_version default and the single-file example, and syncs package-lock.json\n(was stale at alpha.10). Consumers can n\n[…]\nins/code-review/.github/workflows/review-reusable.yaml@v0.1.0-alpha.15.\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "chore(release): v0.1.0-alpha.15",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-13T23:37:36Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "f79b5b1d536357304bd6e597b6c3a0887a1d9a75",
          "body": "Distills the ~527-line pipeline into a reusable workflow (workflow_call) with full per-repo-delta input parity, preserving the two-job permission boundary and harden-runner timing. This repo's own reviewer becomes the thin consumer (local ./ ref); adds a workflow_dispatch self-test. Closes #64. Foll\n[…]\nChatOps trigger), #67 (openssl fail-closed), #68 (pipeline-bash hardening). Two automated + Copilot review rounds; all in-scope findings fixed.\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: package the review pipeline as a reusable workflow (#66)",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-13T23:35:23Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "f4d8e4dc3d1e76217a88ed7e31eb69de85e90601",
          "body": "Rolls the CLI pin to alpha.14 and regenerates .github/workflows/review.yaml\nfrom the canonical example, bringing the single-writer prompt and the\nbudget/hard-kill split to the dogfood workflow (parity restored — only the\nnpm-ci install block differs).\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "chore(review): roll review.yaml to code-review alpha.14",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-13T20:04:50Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "4ca5bf0ccf177883edd27f7094b421e6a01ea881",
          "body": "Co-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "chore(release): v0.1.0-alpha.14",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-13T20:04:50Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "3a596bc34d3cea80da6332b5efe00949871fa4d7",
          "body": "Deterministic single-writer $DRAFT enforcement (budget-hook denies subagent draft writes, keyed on agent_id) + decoupled budget wall from the timeout hard-kill so the agent gets over-budget grace to land a valid draft. Two dogfood-review rounds applied.\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "feat: enforce single-writer $DRAFT + budget/hard-kill split (#62) (#63)",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-13T20:02:37Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "0dd0c74199e41a4c0087a741587eae9c3211aed3",
          "body": "Roll both the canonical example and this repo's own review.yaml to\n@jphutchins/code-review@0.1.0-alpha.13, and regenerate .github from the example\nso it carries the seed-draft wiring (deferred from #55 until the CLI shipping\nit is published) — parity restored (only the npm-ci project edit differs).\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "chore(review): roll review.yaml to code-review alpha.13",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-10T00:19:08Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "4aff2fc41473e05d225a63950b3f7cf3e9da509f",
          "body": "alpha.13: fancy sticky header (#54); seed $DRAFT with prior findings, valid\ndraft from turn 0 (#53, #52); unify sticky out-of-diff findings with the inline\nformat (#56); salvage valid inline comments on a rejected review (#57); derive\nwall + turns from the transcript for fan-out reviews (#59).\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "chore(release): v0.1.0-alpha.13",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-10T00:19:08Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "efc0252cecd763c65a314085b3d4f32e246e101d",
          "body": "…(#59) (#60)\n\nDerive the review's wall + turn count from the transcript tree (which spans the subagents) instead of the native envelope's main-only figures, which under-report a fan-out badly (a 12-subagent ~12-min run reported \"5 turns, 42s\"). Per-model usage stays native-authoritative — the transc\n[…]\nied (all minor/nit: stale docs, test fidelity, robustness).\n\nCloses #59\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "fix: alpha.13 — wall + turns from the transcript for fan-out reviews …",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-10T00:17:26Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "16a0e2cab41ec6215e136bd275a950319975c1da",
          "body": "…57) (#58)\n\nSalvage valid inline comments when GitHub's atomic batched review POST is rejected: post the review body-only, then re-post each comment individually, keeping the ones GitHub accepts and surfacing only the rejected findings in the sticky (retitled \"Findings\" with a note). The disposition\n[…]\ngfood review applied (it confirmed the salvage core sound).\n\nCloses #57\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "fix: alpha.13 — salvage valid inline comments on a rejected review (#…",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-09T23:33:36Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "c8d1d36ffe5a07f8c45611066babba1b7f94a9c2",
          "body": "…ays (#56) (#55)\n\nalpha.13 round, part 1:\n\n- #54: fancy sticky header — one `<sub>` meta line under the verdict.\n- #53/#52: `code-review seed-draft` writes a valid $DRAFT from turn 0 (prior\n  findings on re-review, else an empty scaffold); post.ts posts the fresh\n  review then dismisses priors (neve\n[…]\ns-exit-0 seed-draft, and follow-ups).\n\nCloses #54\nCloses #53\nCloses #56\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "feat: alpha.13 — fancy header (#54), seed $DRAFT (#53,#52), unify str…",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-09T22:27:55Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "5aba8ed5f5f93b0fb8e3cb5d96e2737a05778d1a",
          "body": "Co-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "chore(review): roll review.yaml to code-review alpha.12",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-09T05:16:11Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "0b690769418c704fcc0ff71187399ed09875439e",
          "body": "Co-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "chore(release): v0.1.0-alpha.12",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-09T05:16:11Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "c970e5842d5fd83b108ef7ae5b50be5149ec991d",
          "body": "* chore(tasks): bump camas[mcp] pin to 0.1.24\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD\n\n* feat(#45): land a valid $DRAFT early and correctly-shaped\n\nThe alpha.11 jphfmt#11 replay proved the deadline anchor and fo\n[…]\nin.\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD\n\n---------\n\nCo-authored-by: claude-opus-4-8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(#45): land a valid $DRAFT early and correctly-shaped (#51)",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-09T05:15:02Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "8eb66d48ade2f010731a7a0ba062eee8f8dabdf4",
          "body": "Both the example template and the live dogfood workflow. alpha.11 adds the\nCODE_REVIEW_DEADLINE_EPOCH export (already wired in the example diff) and the\n--transcript cost recovery on the adapt step.\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "chore(review): roll review.yaml to code-review alpha.11",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-09T03:41:17Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "dd88a206d3939f7b74e11d99f8b383a8a005fbef",
          "body": "Fan-out deadline anchor (#45), transcript cost recovery + subagent-dir fix (#47),\nstray reasoning-under-fix (#42), always-submit-a-review (#43).\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "chore(release): v0.1.0-alpha.11",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-09T03:41:17Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "a5aa69c8be5a1fec5e2168fe44ec73e092ba8b02",
          "body": "… always-review\n\nThe #48→#50 PRs merged up the stack instead of into main (the gh pr edit --base\nretargets silently failed), leaving main with only #46. fix/42 accumulated all\nfour fixes via the cascade; this brings the remaining three onto main.\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "Complete the alpha.11 stack: #47 cost recovery, #42 render order, #43…",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-09T03:37:51Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "7d122fe2c81c03146e797401f1a1c25a4501e854",
          "body": "feat(post): always submit a review, even with no in-diff comments (#43)",
          "is_bot": false,
          "headline": "Merge #50: always submit a review (#43)",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-09T03:34:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5856d0f5214886f222bb465d7606e3422e8268a6",
          "body": "fix(budget): anchor elapsed to a shared run deadline so fan-out subagents steer (#45)",
          "is_bot": false,
          "headline": "Merge #46: fan-out deadline anchor (#45)",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-09T03:34:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2744f0860b6f2bf7a4eec99feba367b8c86e445f",
          "body": "Tooling and humans routinely miss an updated sticky comment because no PR\n\"review\" event fires when a review has no inline comments. Post a COMMENT\nreview on every run: its body points at the sticky (for humans) and carries\nthe findings-JSON marker (for agents), with an empty comments[] when nothing\n[…]\ny-only review leaves the sticky's none-in-diff/clean wording unchanged.\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "feat(post): always submit a review, even with no in-diff comments (#43)",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-09T03:06:04Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "650975b80e9ddc6f8d49e886cdbbcee198ec5a43",
          "body": "…(#49 review)\n\nThe #42 ordering assertions used bare indexOf comparisons that pass vacuously if\na search string is absent (-1 < positiveIndex). Guard that both strings render\nbefore comparing; add a patch-carrying stray asserting fix < suggestion < reasoning;\nguard the structural test's section/list\n[…]\nregex on the backtick-wrapped path so a dash in prose can't inflate it.\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "test(render): harden the stray-ordering tests against vacuous passes …",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-09T02:44:03Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "d170c5b55d56d42d46d723e7ba65fa11dbf800ad",
          "body": "…x (#42)\n\nFor findings outside the diff, the sticky rendered the Reasoning fold directly\nunder the bullet, above the recommended fix and any suggestion — the opposite\nof the inline template, which shows the fix first and folds reasoning last.\nReorder the stray block to match: bullet → recommended fi\n[…]\nold. Uniform single blank line between blocks; no Eta per-row artifact.\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "fix(render): put a stray finding's reasoning under its recommended fi…",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-09T02:41:31Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "7e7c79589fb7bae0dcef4e51410d70c55531219f",
          "body": "…n (#48 review)\n\n`adapt --transcript` read and summed the whole transcript tree eagerly, even\nwhen the native envelope already had per-model usage — wasted I/O (megabytes on\na large fan-out) on every clean review. Pass the fallback as a thunk that\n`resolveTelemetry` invokes only when the native has \n[…]\nhavior is\nunchanged; the read just no longer happens on the happy path.\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "perf(adapt): make the transcript fallback lazy — no I/O on a clean ru…",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-09T02:41:30Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "d89c913afd9ef784fcb4fa0b4d264dcfa0b39ae3",
          "body": "…(#47)\n\nA review killed at its wall leaves envelope.json empty (issue #39), so\n`adapt` produced models:[] and the comment rendered cost:$0.00 — even though\nthe transcript records the real spend (camas#194). Two coupled bugs:\n\n1. `adapt` read telemetry only from the native envelope; the transcript\n  \n[…]\nrenders $0.1095, not $0.00, and check-cost now sums main + 3 subagents.\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "fix(cost): recover real telemetry from the transcript on a wall kill …",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-09T02:39:33Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "b2482072d5ac95453c87e68b002e6be7768c0be7",
          "body": "…#46 review)\n\nUnder NO_ANCHOR=1 the script only logged; a CODE_REVIEW_DEADLINE_EPOCH already\npresent in the calling environment would leak to `claude -p` and silently defeat\nthe A/B against pre-#45 per-transcript behavior. Unset it so the pre-fix arm is\nguaranteed anchor-free.\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "fix(dogfood): unset CODE_REVIEW_DEADLINE_EPOCH in the NO_ANCHOR arm (…",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-09T02:39:21Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "72046a8b57a2d1b656db844c08ec225bbb9fe93e",
          "body": "…ents steer (#45)\n\nThe budget hook derived elapsed from the transcript in its hook payload\n(`Date.now() - firstTsMs`). During the /code-review skill's parallel\nsubagent fan-out that transcript is per-agent: a freshly-spawned subagent's\ntranscript is seconds old, so its hook reads ~0% elapsed and nev\n[…]\nstic tests assert the anchor wins over a fresh\nsubagent's ~0 firstTsMs.\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "fix(budget): anchor elapsed to a shared run deadline so fan-out subag…",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-09T01:49:58Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "0f8ac33dc356a3e59327ebc7d5b060dd1e0c5761",
          "body": "Install @jphutchins/code-review@0.1.0-alpha.10 (published) in both the review and\ncommenter jobs — closes the window where main's review.yaml called `print-settings`\n(alpha.10 wiring) while still installing alpha.9 (no such command). Example + repo\nrolled together.\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "chore(review): roll review.yaml to code-review alpha.10",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-09T00:28:13Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "b118c5bc6ad1b99b096c30c9b758b35613e2f21e",
          "body": "…ore)\n\nThe Release workflow's `npm install -g npm@latest` pulled npm 12.0.0, whose bundled\nprovenance path fails with 'Cannot find module sigstore', breaking `npm publish\n--provenance`. Pin to npm@11 (the line alpha.9 published with).\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "fix(release): pin npm to 11.x — npm 12.0.0 breaks --provenance (sigst…",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-09T00:25:49Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "76c62fbf7e0a7f7fdbe6ec2b6b8a2392d645beaa",
          "body": "Co-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "chore(release): v0.1.0-alpha.10",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-09T00:21:14Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "3868f7103a4d9a4e5ad3b566c447999d85446d86",
          "body": "feat: alpha.10 — deterministic budget discipline via CLI-owned hooks (#38)",
          "is_bot": false,
          "headline": "Merge pull request #41 from JPHutchins/feat/38-budget-discipline",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-09T00:17:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "274d964cbc1b0dd456c7f917065ce9a3a2435ad9",
          "body": "…eading)\n\nSo downstream repos adopting the example start from current best practice. The\nexample and this repo's .github/workflows/review.yaml are now identical except the\none intended project-specific edit: the example keeps `npm ci` as a commented\n'swap for your ecosystem' template; this repo unco\n[…]\nirect\ndownload endpoint) and the adapt-telemetry note into the example.\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "chore(review): sync example review.yaml with the repo's copy (#19 thr…",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-09T00:16:09Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "8e863e2b22dbf3eef3c6369f2e6f3c12c78d6ba2",
          "body": "The alpha.10 self-review on PR #41 caught real gaps in the fixes:\n- invokesCodeReviewValidate: `\\bcode-review\\s+validate\\b` also matched\n  `code-review validate-patches` (a findings-mutating command) via the word\n  boundary before the hyphen, so it would pass the hard-phase gate. Tighten with a\n  `(\n[…]\ntranscript) and readFileOrNull\n  (transcript/extract) into src/util.ts.\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "fix(budget): review-response fixes + de-slop (#41 self-review)",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-09T00:11:26Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "a7bfdeee719f9359569f24510c10c548615b0c6e",
          "body": "…10 dogfood\"\n\nThis reverts commit e7a1deecb5a19547ddc179027624415165f2f232.",
          "is_bot": false,
          "headline": "Revert \"chore(review): TEMP build code-review from feat/38 for alpha.…",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-08T23:58:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e7a1deecb5a19547ddc179027624415165f2f232",
          "body": "Brings the alpha.10 review wiring (print-settings + budget hooks) onto main and\nbuilds the CLI from feat/38 source instead of installing released alpha.9, so a\nbogus PR is reviewed by the unreleased alpha.10 code end-to-end. REVERT after the\ndogfood — merging PR #41 restores the released-install form.\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "chore(review): TEMP build code-review from feat/38 for alpha.10 dogfood",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-08T23:42:59Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "4fb460979efe8773b20bad3bcd53291b49d0d104",
          "body": "…#38)\n\nA maintainer tool for validating the review agent's budget hooks end-to-end against a\nreal headless `claude -p` — the layer vitest can't reach (live endpoint, secrets, the\nofficial /code-review plugin), so it lives under test/manual/, out of CI. It produced\nthe alpha.10 dogfood evidence: dedu\n[…]\n the test).\n- README.md: endpoint + plugin setup and how to read a run.\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "test(dogfood): add manual live-endpoint budget-discipline smoke kit (…",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-08T23:36:30Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "f2cbfd210ffeec220215ed723644ced703c39179",
          "body": "…iew)\n\nThe dogfood self-review of PR #41 caught that adapt's `native === undefined`\nguard does not catch `null`: a native envelope file containing the JSON literal\n`null` (JSON.parse → null) slipped past the tolerant-degradation path into\nClaudeCodeEnvelopeCodec.decode(null) → Left → hard exit, losi\n[…]\n refresh the stale JSDoc that\nreferenced the removed `adaptClaudeCode`.\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "fix(adapt): treat a literal `null` native envelope as absent (#39 rev…",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-08T22:38:45Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "5bfe9aeef1cca455af1bb2eac7516c80c52938e1",
          "body": "…ce, headroom reserve (#38)\n\nA live dogfood on DeepSeek plus Copilot's PR #41 review surfaced three issues in\nthe alpha.10 budget hooks. This addresses all three:\n\n- transcript: dedup usage by message.id before summing. A parallel tool-use turn\n  is logged once per content-block line, each repeating\n[…]\nols no longer denied, clean\nsoft→hard convergence, valid draft emitted.\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "fix(budget): dogfood + review fixes — dedup spend, denylist convergen…",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-08T22:38:45Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "ec6c5f81b0e852513d38f632971a124c8bcf5ffa",
          "body": "…(#38)\n\nRealizes the Path A design of record (#38): make a headless review agent\nbudget-disciplined with hooks the CLI already emits, rather than relying on the\nbuilt-in skill or reimplementing the harness.\n\nNew CLI surface:\n- check-cost: sum real per-model USD spend from a Claude Code transcript tr\n[…]\n keeping the\ntimeout/AGENT_WALL as the hard backstop beneath the hooks.\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "feat: alpha.10 — deterministic budget discipline via CLI-owned hooks …",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-08T21:27:53Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "1ca23ea1e64f665a8739d0b5322d56223a6deb80",
          "body": "…nvelope\n\nfix: adapt tolerates an empty/truncated native envelope (#39)",
          "is_bot": false,
          "headline": "Merge pull request #40 from JPHutchins/fix/39-adapt-tolerant-native-e…",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-08T21:26:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "42725df775c286dd672d6ab15f1f7b92bfc713c8",
          "body": "…review)\n\nreadJSONOrAbsent flattened every readFileSync failure to \"missing or empty\",\nmasking EACCES/EISDIR and making real filesystem/config errors hard to diagnose\n(Copilot review on PR #40). Capture the error and name the specific degrade\ncause on stderr — unreadable (with the error), empty, or \n[…]\nthe existing \"no native telemetry\" assertion still holds on every path.\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01Qgqy11vvMbUtCmrBML85sD",
          "is_bot": false,
          "headline": "fix: name the real read error in adapt's tolerant native reader (#39 …",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-08T21:23:41Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "e286f3f822204189fffe9bd673945bd5306e1d31",
          "body": "A wall-clock `timeout` kill (issue #25's per-route bound) leaves `envelope.json`\nempty or truncated mid-flush. `code-review adapt` then crashed on `JSON.parse`\n(readJSON → fail → exit 1), failing the review step BEFORE it could honor\n`--agent-file \"$DRAFT\"` or reach adapt's graceful telemetry-only b\n[…]\n notice\n(was exit 1); truncated envelope + valid `--agent-file` → exit 0, review recovered;\nwrong-shape native → still exit 1. 493 tests green.\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: adapt tolerates an empty/truncated native envelope (#39)",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-08T18:39:40Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "98c7f45853015c96dfe62cd198a6176b7a0d5374",
          "body": "…ets, #29 stop-gate)\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(review): roll review.yaml to code-review alpha.9 (#25 wall budg…",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-08T05:02:52Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "0771d6f4aff74cfc16f35ad5f52c6a3a1d71ae62",
          "body": "…ion patches, inline hygiene (#37)\n\nBound the review agent's wall-clock per route + remove the job cap (#25); wire the stop-gate Stop hook (#29); keep valid pure-insertion patches instead of dropping them (#30); per-comment findings marker + minimize stale bot threads (#31). Driven by field tests where full/xhigh reviews hit the 30-min wall and lost both the review and its cost record.",
          "is_bot": false,
          "headline": "feat: alpha.9 — wall-budget reviews, wire stop-gate, keep pure-insert…",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-08T04:48:23Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d436a61f9d9cb27e0bc45c352bb18d1e4564f153",
          "body": "Co-Authored-By: claude-opus-4-8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(review): roll review.yaml to code-review alpha.8",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-08T02:40:17Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "3e681a57b36ac9d173ecfe3ca42814a3e833e5d7",
          "body": "Co-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01TCDFCDFCdqZHWamCSVitqj",
          "is_bot": false,
          "headline": "chore(release): v0.1.0-alpha.8",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-08T02:29:26Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "951c6ff7c92fad51bc7dc333cf914dfa9a54c553",
          "body": "Closes #23, #26, #27, #28. See PR #35 for the full description and the rendered template preview.\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01TCDFCDFCdqZHWamCSVitqj",
          "is_bot": false,
          "headline": "alpha.8: SSOT SPEC recast + presentation polish (#35)",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-08T02:28:16Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "62ee41cb5e040aa27631f4908373eadfbb0823e6",
          "body": "Co-Authored-By: claude-sonnet-5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "ci: bump dogfood pin to code-review alpha.7; add prices.json",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-07T06:02:50Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "893e3512ab324cc0fa2ffa98d7a8ee2e48d6de78",
          "body": "Stop-gate hook + review-output unification (#18/#19/#21/#22), findings schema 0.4.0, cost-as-N/A without a price map, and stop-gate robustness fixes from the automated review.\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(release): v0.1.0-alpha.7",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-07T05:55:26Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "d1461c69ebb78521fb3bffb85c125c8f62a91002",
          "body": "…review\n\nAddresses the automated review of the merged stop-gate/schema-0.4 work:\n\n- [CRITICAL] stop-gate infinite-block: bump the nudge counter FIRST and emit the\n  block ONLY after the increment is durably persisted. If the write fails, allow\n  the stop and log (\"cannot persist nudge counter … → al\n[…]\npe is removed.\n- DEFER: documented the drainStdin held-open-pipe edge as a known low-risk\n  non-production path rather than changing the logic.\n\nCo-Authored-By: claude-sonnet-5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: stop-gate robustness + review-fix cleanups from the merged-code …",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-07T05:51:20Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "da470231e86fdc3f21a5d7b3db4caf25b5679586",
          "body": "feat: stop-gate — a Stop hook that enforces the findings deliverable",
          "is_bot": false,
          "headline": "Merge pull request #20 from JPHutchins/feat/stop-gate-hook",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-07T05:06:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "02aeef52a5639b88dc89179860d8d83a20467bc0",
          "body": "…ired, patch-only fixes\n\nBreaking redesign of the findings shape (schema 0.4.0), settled with JP:\n\n- Finding fields: rename `body` → `description` (required); make `reasoning`\n  and `confidence` required; add optional `recommendation` (markdown prose\n  \"what to do\", distinct from the machine `patch`\n[…]\nma/VERSIONING.md (v0.4.0 current,\n  v0.3.0 superseded); README command table.\n- Fixtures + tests migrated to 0.4.0 across the suite (469 pass).\n\nCo-Authored-By: claude-sonnet-5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(schema)!: findings 0.4.0 — description/reasoning/confidence requ…",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-07T05:00:07Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "f1e166dee5d0287c0bef493da1971013255c5fbd",
          "body": "… is provided\n\nWhen --prices is omitted, the CLI falls back to the bundled all-zero\nprices.example.json purely to satisfy the codec shape — but the disclosure then\nrendered every cost cell as $0.00, a lie (the run spent real money; we just have\nno rates). Make price provenance explicit end-to-end in\n[…]\nyperlinking SPEC §6.2. The existing stderr warning is\nkept, reworded to say cost is N/A. Inline comments render no cost, so they are\nuntouched.\n\nCo-Authored-By: claude-sonnet-5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(output): report cost as N/A (not a false $0.00) when no price map…",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-07T04:18:21Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "725e39e13020f037a186b382209c90a8f29d4380",
          "body": "… reprompt\n\nFixes 9 findings from a self-review of the stop-gate feature: write the block\nJSON to stdout before bumping the nudge counter and never let a counter-write\nfailure suppress an already-written block (fail-open bug); wrap draftState's\nfinal validateAgainstSchema call so a validator crash d\n[…]\n and reusing registry.ts's declaredVersion; simplify bumpNudges to\nread-increment-write internally instead of taking a redundant current count.\n\nCo-Authored-By: claude-sonnet-5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: address stop-gate self-review findings; kind-aware output-format…",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-07T03:35:14Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "f01c3f377c21c2636d1dd21c04e36d56355cf074",
          "body": "…T; truthful cross-links; real telemetry on failed runs (#18 #19 #21 #22)\n\nConsolidates the drifted findings-json marker into one serializer (src/surface.ts)\nshared by the sticky, every inline comment, and the review body, each prefixed with\nan AGENTS:STOP directive so any single surface is self-des\n[…]\n a Left (#18); review.yaml's --json-url now points at the findings\nartifact's own direct download endpoint instead of the run's artifacts list.\n\nCo-Authored-By: claude-sonnet-5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "refactor(output): one findings-pointer serializer + inline.eta as SSO…",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-07T03:28:39Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "6f7491df4315905ac0f239ba0b38c3240bef2618",
          "body": "…-expressions)\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01TCDFCDFCdqZHWamCSVitqj",
          "is_bot": false,
          "headline": "fix: String()-wrap numeric template interpolations (restrict-template…",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-07T01:30:58Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "3bf586049756d552a946ef391e2028b7c81a3282",
          "body": "…eliverable\n\nThe review agent's only deliverable is a findings JSON that validates against the\nschema, written to $DRAFT before it ends its turn. On camas PR #188 a weaker model\nfinished with a prose summary and never wrote $DRAFT, so the extraction ladder\nrecovered nothing and the review job failed\n[…]\nvalidateAgainstSchema. Covered by 17 unit tests plus a CLI wiring test.\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01TCDFCDFCdqZHWamCSVitqj",
          "is_bot": false,
          "headline": "feat: stop-gate subcommand — a Stop hook that enforces the findings d…",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-07T01:27:06Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "24c5cf80883a8188f716b2670fccb6b5ea36b192",
          "body": "Co-Authored-By: claude-opus-4-8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "ci: dogfood the code-review workflow (alpha.6)",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-06T23:24:30Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "2a3076965ab57f87bd7e408d4453491795998297",
          "body": "feat: resolve #6–#16 — review-output polish + patch-based suggestions (alpha.6)",
          "is_bot": false,
          "headline": "Merge pull request #17 from JPHutchins/feat/review-output-polish",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-06T23:06:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6321bc84a9f96c49cdad098185f7c9e08bb36a1a",
          "body": "…implify disclosure\n\nThe sticky's findings-json pointer previously linked to an artifact that\neventually expires, breaking agent traceability, and paired it with a\nhuman-visible advisory line that's clutter (agents read HTML comments via the\nAPI, not prose). Embed the findings JSON directly in the s\n[…]\nthe LLM Disclosure to\na one-line model attribution, dropping the boilerplate about the CI runner\nthat added no information PR reviewers needed.\n\nCo-Authored-By: claude-sonnet-5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: embed findings JSON in sticky (base64), drop visible advisory, s…",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-06T22:21:52Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "91f403022f790df367a538dbb8e0d7104ff28c01",
          "body": "- review.yaml: rewrite Phase-2 --append-system-prompt to lead with the JSON\n  deliverable, then a short bulleted list (reviewer found it unclear)\n- review.yaml: drop retention-days from both upload-artifact steps so\n  traceability links (#13/#15) use the repo's default (max) retention\n- review.yaml:\n[…]\n LLM-facing contract and not GitHub-specific\n- README: drop the patch-lowering mechanism paragraph; that detail lives in\n  SPEC, not the README\n\nCo-Authored-By: claude-sonnet-5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: address PR review comments on review.yaml, schema, and README",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-06T22:09:17Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "8561ef11daa20fd77dc42e214308f3ed5fed5613",
          "body": "…s into review.yaml (alpha.6)\n\nSnapshots the applied PR-head tree before the agentic review edits anything, then\nresets and runs `lower-suggestions` against that clean tree so a finding's `patch`\nvalidates against GitHub's real PR-head content (issue #10). Uploads a separate\nbest-effort `code-review\n[…]\n. Steers the review agent to emit `patch` over hand-authored `suggestion`.\nBumps package.json + the reference workflow's pins to 0.1.0-alpha.6.\n\nCo-Authored-By: claude-sonnet-5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: wire suggestion lowering + transcript artifacts + run/json link…",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-06T20:26:53Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "30c9e49958d9445b9c51074cd1260f3b6571bf3b",
          "body": "Add an optional `patch` field to the findings schema (0.3, additive) so the\nreview agent can emit a unified diff of an edit it actually made instead of a\nhand-authored `suggestion`, which is prone to wrong indentation or too-wide\nranges. `lowerPatch` (src/patch.ts) deterministically validates a sing\n[…]\ner a findings JSON file\nagainst a repo root, overriding any hand-authored suggestion with the lowered\none and reporting drop reasons to stderr.\n\nCo-Authored-By: claude-sonnet-5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: patch->suggestion lowering pipeline (issue #10)",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-06T20:12:18Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "165397876e8ca6c28ddc0585b05edccabf3b92f2",
          "body": "… its fold\n\nFree-form model reasoning often contains embedded newlines. A single\n`<%= it.reasoning %>` prefixed only the first line, so continuation lines\nlanded at column 0 — in inline.eta they broke OUT of the `> [!TIP]` alert\nblockquote (terminating it early); in comment.eta's stray fold they los\n[…]\nmitted per iteration (same class of fix as the alpha.5\ncost-table bug). Per-line `<%=` escaping preserves the `</details>` breakout\nprotection.\n\nCo-Authored-By: claude-sonnet-5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: render multi-paragraph reasoning line-by-line so it stays inside…",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-06T19:55:14Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "335284f6fb93d1e4a58b3d21a41de8262ed1cb66",
          "body": "…review links, markdown formatter pass\n\nInline comments now open with a severity header and (template path) an LLM\nDisclosure with model/confidence/reasoning fold and a findings-json marker\n(#12, #15-inline, #16-inline). The sticky and the review now link to each\nother: the review posts with a link \n[…]\ns on every posted body to collapse stray blank lines without disturbing\ntables or suggestion blocks (#14). Adds --run-url/--json-url to `post`.\n\nCo-Authored-By: claude-sonnet-5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: severity + disclosure on inline comments, bidirectional sticky/…",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-06T19:43:32Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "9692204e68a8ff402e768229674f61af3671f457",
          "body": "Co-Authored-By: claude-opus-4-8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "style: italicize the sticky disclosure footer",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-06T19:25:59Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "aa2c7ebe4075f30adda703c0c3648b4d9bbab558",
          "body": "…st table into disclosure\n\nAdds three optional RenderInput fields (runUrl, jsonUrl, reviewUrl) threaded\nthrough the Eta context for the wiring implementer to populate later:\n\n- #6: meta line now also shows models and total cost when usage is available.\n- #8: the LLM Disclosure aside becomes a [!WARN\n[…]\ns one contiguous block;\nrender.test.ts asserts this with the \"> \" prefix included, and the mutation\nwas verified to fail before being reverted.\n\nCo-Authored-By: claude-sonnet-5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: point sticky at run/JSON/review, fold stray reasoning, merge co…",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-06T19:16:21Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "0b7db770f97c48550286b181d4f2eba61466f7f9",
          "body": "…ema 0.3.0)\n\n- formatCost now renders $X.XX (was 3dp), with `<$0.01` for a nonzero cost\n  that would otherwise round to a misleading $0.00. Internal cost math is\n  untouched (still full precision).\n- Confirmed `confidence` (issue #9) is unchanged and still present in both\n  the schema and codec.\n- A\n[…]\nEMA_VERSION-literal assertions in adapt.test.ts,\n  extract.test.ts, and index.test.ts's print-schema tests that assumed 0.2\n  was still latest.\n\nCo-Authored-By: claude-sonnet-5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: cost display to 2dp; add optional finding `reasoning` field (sch…",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-06T18:56:57Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "0874e355b320b0343708ab51dae2d4b844e57bd7",
          "body": "Bumps the package version and the reference review.yaml CLI pins to\nalpha.5, carrying the summary-only sticky redesign and the #5\nreview-identity dedup fix.\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "release: v0.1.0-alpha.5",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-06T04:55:52Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "809c8f14ce2410e9c7f1820b599acc9aa0763996",
          "body": "…entity (#5)\n\nThe sticky comment is now a summary-only cumulative anchor — verdict,\nwalkthrough, severity counts, an honest inline-disposition pointer, and\nstrays (findings with no in-diff home) — whose primary job is carrying the\nreviewed-sha marker. The per-finding detail lives in the inline revie\n[…]\n parity, not substring) so the blank-line-per-row\ntable bug cannot ship silently again.\n\nCo-Authored-By: claude-opus-4-8 <noreply@anthropic.com>\nCo-Authored-By: claude-sonnet-5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: sticky summarizes, review carries the detail; dedup on review id…",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-06T04:55:42Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "87a016d265effc307e39c60908d6defebdd169e9",
          "body": "Ships the xhigh review-effort default and the extraction-ladder\ndebuggability (stderr rung trace + triage.json in the artifact). Bumps\nthe reference workflow pin to match.\n\nCo-Authored-By: claude-fable-5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "release: v0.1.0-alpha.4",
          "author_name": "JP Hutchins",
          "author_login": "JPHutchins",
          "committed_at": "2026-07-06T02:40:41Z",
          "body_truncated": false,
          "is_coding_agent": true
        }
      ],
      "releases_count": 24,
      "commits_last_year": 130,
      "latest_release_at": "2026-07-17T00:00:07Z",
      "latest_release_tag": "v0.1.0-alpha.25",
      "releases_from_tags": true,
      "days_since_last_push": 4,
      "active_weeks_last_year": 3,
      "days_since_latest_release": 4,
      "mean_days_between_releases": 0.3
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": false,
      "has_contributing": false,
      "health_percentage": 28,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "@jphutchins/code-review",
          "exists": true,
          "license": "MIT",
          "keywords": [
            "code-review",
            "pull-request",
            "agentic",
            "llm",
            "ci",
            "github",
            "findings",
            "json-schema"
          ],
          "ecosystem": "npm",
          "matches_repo": true,
          "registry_url": "https://www.npmjs.com/package/@jphutchins/code-review",
          "is_deprecated": false,
          "latest_version": "0.1.0-alpha.1",
          "repository_url": "https://github.com/JPHutchins/code-review",
          "versions_count": 25,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": 1,
          "monthly_downloads": 4033,
          "first_published_at": "2026-07-05T23:09:30.998000Z",
          "latest_published_at": "2026-07-05T23:09:31.291000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 15
        }
      ]
    },
    "popularity": {
      "forks": 0,
      "stars": 1,
      "watchers": 1,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 0
      },
      "star_history": {
        "days": [
          {
            "date": "2026-07-20",
            "count": 1
          }
        ],
        "complete": true,
        "collected": 1,
        "total_stars": 1
      },
      "open_issues_and_prs": 7
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [
        "examples"
      ],
      "has_llms_txt": false,
      "has_dockerfile": false,
      "has_mcp_signal": true,
      "bootstrap_files": [],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [
        "tsconfig.json"
      ],
      "toolchain_manifests": [],
      "largest_source_bytes": 82601,
      "source_files_sampled": 58,
      "oversized_source_files": 2,
      "agent_instruction_files": [],
      "agent_instruction_max_bytes": null
    },
    "dependencies": {
      "manifests": [
        "package.json"
      ],
      "advisories": {
        "error": null,
        "scope": "published_package",
        "source": "osv",
        "findings": [],
        "collected": true,
        "truncated": false,
        "by_severity": {},
        "advisory_count": 0,
        "affected_count": 0,
        "assessed_count": 12,
        "assessed_package": "npm:@jphutchins/code-review@0.1.0-alpha.1",
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "npm"
      ],
      "dependencies": [
        {
          "name": "ajv",
          "manifest": "package.json",
          "ecosystem": "npm",
          "version_constraint": "^8.17.1"
        },
        {
          "name": "ajv-formats",
          "manifest": "package.json",
          "ecosystem": "npm",
          "version_constraint": "^3.0.1"
        },
        {
          "name": "citty",
          "manifest": "package.json",
          "ecosystem": "npm",
          "version_constraint": "^0.1.6"
        },
        {
          "name": "eta",
          "manifest": "package.json",
          "ecosystem": "npm",
          "version_constraint": "^3.5.0"
        },
        {
          "name": "fp-ts",
          "manifest": "package.json",
          "ecosystem": "npm",
          "version_constraint": "^2.16.9"
        },
        {
          "name": "io-ts",
          "manifest": "package.json",
          "ecosystem": "npm",
          "version_constraint": "^2.2.22"
        },
        {
          "name": "parse-diff",
          "manifest": "package.json",
          "ecosystem": "npm",
          "version_constraint": "^0.12.0"
        }
      ],
      "all_dependencies": {
        "error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
        "source": null,
        "packages": [],
        "collected": false,
        "truncated": false,
        "total_count": null,
        "direct_count": null,
        "indirect_count": null
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 28,
        "open_issues": 7,
        "closed_ratio": 0.883,
        "closed_issues": 53,
        "closed_unmerged_prs": 7
      },
      "bus_factor": 1,
      "bot_contributors": 0,
      "top_contributors": [
        {
          "type": "User",
          "login": "JPHutchins",
          "commits": 130,
          "avatar_url": "https://avatars.githubusercontent.com/u/34154542?v=4"
        }
      ],
      "contributors_sampled": 1,
      "top_contributor_share": 1
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "ci.yaml",
        "release.yaml",
        "review-on-comment-reusable.yaml",
        "review-on-comment.yaml",
        "review-reusable.yaml",
        "review-selftest.yaml",
        "review.yaml"
      ],
      "has_docs_dir": true,
      "linter_configs": [
        "eslint.config.js"
      ],
      "has_editorconfig": false,
      "has_linter_config": true,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "package-lock.json"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 10,
            "reason": "11 out of 11 merged PRs checked by a CI test -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/30 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 3,
            "reason": "project has 1 contributing companies or organizations -- score normalized to 3",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 0,
            "reason": "no update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 0,
            "reason": "project was created within the last 90 days. Please review its contents carefully",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": 10,
            "reason": "packaging workflow detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 3,
            "reason": "dependency not pinned by hash detected -- score normalized to 3",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "SAST tool is not run on all commits -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 0,
            "reason": "security policy file not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": null,
            "reason": "no releases found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 9,
            "reason": "1 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "58b5de8fc769a98917e981a664ba829bfd11b4a4",
        "ran_at": "2026-07-21T16:22:06Z",
        "aggregate_score": 3.7,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": false,
      "has_dependabot_config": false
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/JPHutchins/code-review",
    "host": "github.com",
    "name": "code-review",
    "owner": "JPHutchins"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "moderate",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 58,
      "inputs": {
        "security": 50,
        "vitality": 69,
        "community": 33,
        "governance": 56,
        "engineering": 76
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "moderate",
        "name": "Vitality",
        "value": 69,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "moderate",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 56,
            "inputs": {
              "commits_last_year": 130,
              "human_commit_share": 1,
              "days_since_last_push": 4,
              "active_weeks_last_year": 3
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 4 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 4
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "3/52 weeks with commits",
                "points": 2.1,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 3
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "130 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 130
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 88,
            "inputs": {
              "releases_count": 24,
              "latest_release_tag": "v0.1.0-alpha.25",
              "releases_from_tags": true,
              "days_since_latest_release": 4,
              "mean_days_between_releases": 0.3
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "24 version tags (no GitHub releases)",
                "points": 16.2,
                "status": "partial",
                "details": [
                  {
                    "code": "version_tags_no_releases",
                    "params": {
                      "count": 24
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 4 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 4
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~0.3 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 0.3
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "at_risk",
        "name": "Community & Adoption",
        "value": 33,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 1,
            "inputs": {
              "forks": 0,
              "stars": 1,
              "watchers": 1,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "below_threshold"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "1 stars",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "0 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "1 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "moderate",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 50,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": false,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (MIT)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "MIT"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          },
          {
            "key": "ecosystem_adoption",
            "band": "moderate",
            "name": "Ecosystem adoption (downloads)",
            "note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "registry_dependents"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 60,
            "inputs": {
              "packages": [
                "@jphutchins/code-review"
              ],
              "dependents": null,
              "ecosystems": "npm",
              "total_downloads": null,
              "monthly_downloads": 4033
            },
            "components": [
              {
                "key": "monthly_downloads",
                "name": "Monthly downloads",
                "detail": "4,033 downloads/month across npm",
                "points": 48.1,
                "status": "partial",
                "details": [
                  {
                    "code": "downloads_monthly",
                    "params": {
                      "count": 4033,
                      "ecosystems": "npm"
                    }
                  }
                ],
                "max_points": 80
              },
              {
                "key": "registry_dependents",
                "name": "Registry dependents",
                "detail": "not reported by this ecosystem",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_reported_by_this_ecosystem",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "moderate",
        "name": "Sustainability & Governance",
        "value": 56,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 13,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 1,
              "top_contributor_share": 1
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 100% of commits",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 100
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "1 contributors",
                "points": 1.4,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 1 contributing companies or organizations -- score normalized to 3",
                "points": 3,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "good",
            "name": "Issue & PR responsiveness",
            "note": null,
            "notes": [],
            "value": 72,
            "inputs": {
              "merged_prs": 28,
              "open_issues": 7,
              "closed_issues": 53,
              "issue_closed_ratio": 0.883,
              "closed_unmerged_prs": 7
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "88% of issues closed",
                "points": 41.3,
                "status": "partial",
                "details": [
                  {
                    "code": "issues_closed_share",
                    "params": {
                      "share": 88
                    }
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "28/35 decided PRs merged",
                "points": 30.6,
                "status": "partial",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 28,
                      "decided": 35
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "moderate",
            "name": "Ownership & stewardship",
            "note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "verified_domain"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 58,
            "inputs": {
              "followers": 41,
              "owner_type": "User",
              "is_verified": null,
              "owner_login": "JPHutchins",
              "public_repos": 85,
              "account_age_days": 3154
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "personal (user) account",
                "points": 10,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_personal",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": "not applicable to user accounts",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_applicable_to_user_accounts",
                    "params": {}
                  }
                ],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "41 followers of JPHutchins",
                "points": 11.7,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 41,
                      "login": "JPHutchins"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "85 public repos, account ~8 yr old",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 85
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 8
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "@jphutchins/code-review"
              ],
              "ecosystems": "npm",
              "any_deprecated": false,
              "min_days_since_publish": 15
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on npm",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "npm"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 15 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 15
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "25 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 25
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "good",
        "name": "Engineering Quality",
        "value": 76,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "good",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 84,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": true,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "7 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 7
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": "eslint.config.js",
                "points": 16,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "eslint.config.js"
                    }
                  }
                ],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "11 out of 11 merged PRs checked by a CI test -- score normalized to 10",
                "points": 20,
                "status": "met",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "moderate",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 65,
            "inputs": {
              "topics": [],
              "has_wiki": true,
              "homepage": null,
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "moderate",
        "name": "Security",
        "value": 50,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "at_risk",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 38,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 17,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 1,
              "scorecard_aggregate": 3.7
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "11 out of 11 merged PRs checked by a CI test -- score normalized to 10",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 1 contributing companies or organizations -- score normalized to 3",
                "points": 0.8,
                "status": "partial",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "no update tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 3",
                "points": 1.5,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool is not run on all commits -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file not detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "1 existing vulnerabilities detected",
                "points": 6.8,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "excellent",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): No advisories left outstanding. Remaining weights renormalized. Matched the npm:@jphutchins/code-review@0.1.0-alpha.1 runtime dependency closure — what installing the published package pulls in — 12 packages. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "no_advisories_left_outstanding"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_published",
                "params": {
                  "package": "npm:@jphutchins/code-review@0.1.0-alpha.1",
                  "assessed": 12
                }
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "source": "osv",
              "advisories": 0,
              "affected_packages": 0,
              "assessed_packages": 12,
              "unassessed_packages": 0,
              "affected_by_severity": "none",
              "direct_affected_packages": 0
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "no direct dependency carries a known advisory",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "no_direct_advisories",
                    "params": {}
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "no indirect dependency carries a known advisory",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "no_indirect_advisories",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory carries a publication date",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_no_publication_date",
                    "params": {}
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 12,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 2
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "moderate",
        "name": "AI Readiness",
        "value": 62,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "at_risk",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 0.99,
              "agent_instruction_files": [],
              "agent_instruction_max_bytes": null
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "no CLAUDE.md / AGENTS.md / editor rules",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_instructions",
                    "params": {}
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "99 of 100 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 99,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "moderate",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 67,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "package-lock.json"
              ],
              "has_dockerfile": false,
              "typed_language": true,
              "bootstrap_files": [],
              "has_devcontainer": false,
              "has_linter_config": true,
              "typecheck_configs": [
                "tsconfig.json"
              ],
              "agent_commit_share": 0.92,
              "toolchain_manifests": [],
              "dependency_bot_commit_share": 0
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": "eslint.config.js",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "eslint.config.js"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "tsconfig.json",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "tsconfig.json"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "92 of the last 100 commits agent-authored or agent-credited",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "agent_authored_commits",
                    "params": {
                      "count": 92,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "no automated dependency updates observed",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_dependency_automation",
                    "params": {}
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 3",
                "points": 3,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 98,
            "inputs": {
              "primary_language": "TypeScript",
              "largest_source_bytes": 82601,
              "source_files_sampled": 58,
              "oversized_source_files": 2
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "TypeScript (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "TypeScript"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "2/58 source files over 60KB",
                "points": 53.1,
                "status": "partial",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 58,
                      "oversized": 2
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "moderate",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 60,
            "inputs": {
              "example_dirs": [
                "examples"
              ],
              "has_mcp_signal": true,
              "api_schema_files": []
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 20,
                "status": "met",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": "examples",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "examples"
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-21T16:22:19.042329Z",
  "schema_version": "0.23.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/j/JPHutchins/code-review.svg",
  "full_name": "JPHutchins/code-review",
  "license_state": "standard",
  "license_spdx": "MIT"
}