RoryGlenn / commitment-issues

When each star and fork was added, collected from GitHub and bucketed by day. Cumulative growth sits directly above the daily additions it is made of, so the two read against each other: steady organic accretion looks nothing like an abrupt, short-lived burst. Where that difference is measurable, it is reported as growth authenticity.

Full resolved dependency set from the GitHub dependency graph: 4 direct and 264 indirect (transitive) packages. The transitive closure is complete when the repository commits a lockfile.

This repository publishes no package the index resolves, so its own dependency graph was assessed — 268 packages, which also include development and test pins that never ship: 0 carry known advisories, of which 0 are direct.

No known advisories affect the assessed dependencies.

An advisory means the version recorded in the dependency graph falls inside an advisory’s affected range. Reachability is not analysed, and the graph includes development and test pins — a finding may concern tooling rather than shipped software.

{
  "data": {
    "repo": {
      "topics": [
        "developer-tools",
        "eslint",
        "git-hooks",
        "pre-commit",
        "prettier",
        "husky",
        "lint-staged"
      ],
      "is_fork": false,
      "size_kb": 6338,
      "has_wiki": true,
      "homepage": null,
      "languages": {
        "JavaScript": 2061603
      },
      "pushed_at": "2026-07-22T03:59:27Z",
      "created_at": "2026-06-27T14:57:32Z",
      "owner_type": "User",
      "updated_at": "2026-07-22T03:59:29Z",
      "description": "For developers who overthink every commit.  GitHub Actions catches mistakes after they become expensive. Commitment Issues catches them while they are still cheap.  Stop test failures, staged secrets, and Git mistakes before they reach your repo.",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "MIT",
      "default_branch": "main",
      "license_spdx_raw": "MIT",
      "primary_language": "JavaScript",
      "significant_languages": [
        "JavaScript"
      ]
    },
    "owner": {
      "blog": null,
      "name": "Rory Glenn",
      "type": "User",
      "login": "RoryGlenn",
      "company": null,
      "location": null,
      "followers": 13,
      "avatar_url": "https://avatars.githubusercontent.com/u/32777747?v=4",
      "created_at": "2017-10-13T17:35:59Z",
      "is_verified": null,
      "public_repos": 57,
      "account_age_days": 3203
    },
    "license": {
      "state": "standard",
      "spdx_id": "MIT",
      "raw_spdx": "MIT",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v3.4.0",
          "kind": "minor",
          "published_at": "2026-07-17T12:23:24Z"
        },
        {
          "tag": "v3.3.2",
          "kind": "patch",
          "published_at": "2026-07-12T13:33:16Z"
        },
        {
          "tag": "v3.3.0",
          "kind": "minor",
          "published_at": "2026-07-12T11:50:24Z"
        },
        {
          "tag": "v3.2.0",
          "kind": "minor",
          "published_at": "2026-07-10T12:37:50Z"
        },
        {
          "tag": "v3.1.0",
          "kind": "minor",
          "published_at": "2026-07-10T02:03:11Z"
        },
        {
          "tag": "v3.0.1",
          "kind": "patch",
          "published_at": "2026-07-08T19:50:04Z"
        },
        {
          "tag": "v3.0.0",
          "kind": "major",
          "published_at": "2026-07-08T19:17:00Z"
        },
        {
          "tag": "v2.5.1",
          "kind": "patch",
          "published_at": "2026-07-08T15:30:10Z"
        },
        {
          "tag": "v2.4.0",
          "kind": "minor",
          "published_at": "2026-07-08T15:45:54Z"
        },
        {
          "tag": "v2.3.0",
          "kind": "minor",
          "published_at": "2026-07-05T21:20:52Z"
        },
        {
          "tag": "v2.2.0",
          "kind": "minor",
          "published_at": "2026-07-05T20:52:12Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "e8f7fa3b6d36998a4c3f34fb441eddc0fbf50218",
          "body": "Establish recurring Repository Health Reviews with a versioned control catalog, issue forms, an offline-first generator, duplicate-safe live pilot, and maintainer documentation.\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "feat: establish Repository Health Reviews (#297)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-22T03:59:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5d927ba77ef87c7542723c1bcf0232bb316da050",
          "body": "Inventory active, legacy, duplicate, and cross-stage hook-manager entries while preserving manager-owned files.\n\nRetain the missing own-stage remediation for cross-stage-only hooks and make the Git-for-Windows shell fixture portable across supported hosts.\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix: harden hook-manager integration checks (#277)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-22T03:27:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "deb1bd19c7f4de5c57ab52980a37cd15a3d94a7c",
          "body": "Closes #279.\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "feat: add model-independent semantic context gateway (#280)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-22T02:44:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ef7c67ff5cf63e2a1263916b3437d7321becaab0",
          "body": "Closes #275.\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "feat: add generated semantic project graph (#278)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-22T02:32:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "122bfa9fabdd708005e5fe2a6e9a655283f80fcd",
          "body": "Closes #147\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "feat: support hook-manager coexistence (#272)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-21T23:06:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1e89f826e2591739930d93ba80a5606a7710737e",
          "body": "## Summary\n\n- add an opt-in, advisory-only staged debug-artifact scan for curated\nJavaScript, Python, Ruby, and temporary-comment patterns\n- reuse the structurally validated staged-diff parser and a single Git\ninvocation shared with secret scanning\n- add deterministic default/generated-path composit\n[…]\nfecycle:npm`: 10/10 packed lifecycle phases passed\n- focused debug/config/JSON/docs regression suite: 85/85 passed\n\nCloses #107\n\nSigned-off-by: Rory Glenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Detect staged debug artifacts (#273)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-21T02:51:55Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "340df9ebf3de88f42fbcf37e77bbdadc958c4b9a",
          "body": "Closes #111\n\nSigned-off-by: Rory Glenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "feat: add a safe read-only Git panic guide (#271)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-20T19:09:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "93f207d0bc6cc661c1d790df7d987192d33cc952",
          "body": "Closes #175\n\nSigned-off-by: Rory Glenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Structure lifecycle integration tests into named phases (#270)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-20T18:00:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6331caeceb2ddc5dad95b5acc1aa7a8da01eaed9",
          "body": "Closes #117\n\nSigned-off-by: Rory Glenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Add a disposable-repository tutorial (#269)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-20T17:46:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8456f924dee78b389b2d940f3d3b8b18c9734dc5",
          "body": "Closes #267\n\nSigned-off-by: Rory Glenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Fix large-index file-size guard buffering (#268)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-20T17:30:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9eb6e148da0df60a2c0b80bb444438333f791a3e",
          "body": "Closes #212\n\n## What changed\n\n- add one shared argument-size model: 24,000 UTF-8 bytes on POSIX and\n6,000 conservative command-line units on Windows\n- batch ESLint, Prettier, staged tests, and pushed tests while\npreserving ordered paths, aggregate findings, one overall timeout,\nhostile-path handling\n[…]\n6,000 |\n\nBoth enforced benchmark tiers pass. The Git index probe remains one\nfixed-size invocation (109 modeled Windows units).\n\nSigned-off-by: Rory Glenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Fix hook argument batching for large path sets (#266)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-20T16:51:15Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "81142e6a71c2df078e9f2eea2f593d38706c57e0",
          "body": "Update all setup-node pins and annotations to v7, and update the release-integrity assertion.\n\nSigned-off-by: Rory Glenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": true,
          "headline": "ci(deps): bump actions/setup-node from 6.4.0 to 7.0.0 (#265)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-20T15:47:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5103d9e63a1b62a21cb1088d29fe4dc4d141d590",
          "body": "Closes #144\n\n## What changed\n\n- Adds optional `--json` output to the repository-only demo comparator.\n- Reports the pass decision, threshold, best shift, every evaluated\nscore, frame rate, and stable mask names as numeric machine-readable\ndata.\n- Preserves exit 0 for a pass, exit 1 for a visual mism\n[…]\nn format:check`\n- `git diff --check`\n\nNo changelog entry is required because this affects an unpublished\nmaintenance tool only.\n\nSigned-off-by: Rory Glenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Add JSON output to the demo visual-comparison tool (#264)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-20T15:15:53Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e7dc31e276a90bbdba5d98c9cecc239ddeb3d7a0",
          "body": "Closes #143\n\n## What changed\n\n- Adds `npm run coverage:scope`, a read-only report of the runtime\ncoverage policy.\n- Lists measured runtime sources, explicit maintenance exclusions, test\npatterns, and the 100% line/branch/function thresholds from the existing\nsource-of-truth constants.\n- Rejects inva\n[…]\nit --audit-level=high` — 0 vulnerabilities\n\nNo changelog entry is required because this is repository-only\ncontributor tooling.\n\nSigned-off-by: Rory Glenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Add a coverage-scope inspection command (#263)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-20T15:15:28Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "fd5f83d78ec17fac2887f6a0cc2a48b560c78698",
          "body": "Closes #115\n\n## What changed\n\n- Adds a plain-language Git glossary to the existing FAQ.\n- Explains all eleven terms named by the issue, including staged and\nunstaged changes, hooks, upstream branches, detached HEAD, and reflog.\n- Links the glossary from the README and the canonical documentation\nind\n[…]\naudit --audit-level=high` — 0 vulnerabilities\n\nNo changelog entry is required because this adds explanatory\ndocumentation only.\n\nSigned-off-by: Rory Glenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Add a beginner-friendly Git terminology glossary (#262)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-20T15:14:53Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3c2a7ddca2c1097cf9657a50cd050b1f53db87f7",
          "body": "Closes #168\n\n## What changed\n\n- Labels `npm ci` as the first-time contributor dependency setup\ncommand.\n- Labels `npm run doctor` as the anytime Git-hook verification and\nrepair command.\n- Updates the package-manager-aware first-commit welcome and its exact\ndocumentation preview.\n- Adds regression c\n[…]\ns:check`\n- `npm run states`\n- `npm pack --dry-run --json --ignore-scripts`\n- `npm audit --audit-level=high` — 0 vulnerabilities\n\nSigned-off-by: Rory Glenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Clarify first-time setup and hook repair (#261)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-20T15:14:15Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5e983e0fd1864685121955a4ea1b1d6c4827be53",
          "body": "Closes #235\n\n## Summary\n\n- record the filename, SHA-256, release tag, source commit, hosted\nrunner, Node version, and npm version for every hosted release candidate\n- define the hosted archive accepted by recovery/publication as the\nnormal release authority, while keeping local `npm pack` output as\n\n[…]\ne`\n- `npm audit --audit-level=high` — 0 vulnerabilities\n- `npm pack --dry-run --json --ignore-scripts` — 54 files and within\npackage budgets\n\n---------\n\nSigned-off-by: Rory Glenn <glennrory@gmail.com>",
          "is_bot": false,
          "headline": "Fix release candidate identity evidence (#260)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-20T03:01:26Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "dbf7f3035f6b0e37e114664d019dc7a4ab1dc48d",
          "body": "## Summary\n\nThe v3.4.0 trusted publish succeeded, but the immediate attestation\nlookup returned HTTP 404 before npm had finished propagating it. That\nmade a healthy publication look broken.\n\nThis change:\n\n- retries only exact-version metadata and exact-attestation HTTP 404\nresponses after the npm pu\n[…]\nfor user-visible\nchanges.\n- [x] Updated docs where behavior changed.\n- [x] I used `Closes #...` only because merging this PR fully completes\nthe issue.\n\nSigned-off-by: Rory Glenn <glennrory@gmail.com>",
          "is_bot": false,
          "headline": "fix: tolerate npm attestation propagation (#259)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-20T02:12:50Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "216a7a8b5f0c7e5fc4abcb73d40a3013cb82f46a",
          "body": "## Summary\n\n- add an upload-ready Product Hunt media pack: a 240×240 square\nthumbnail and four 1270×760 gallery cards covering the plain-language\nbefore/after story, setup, the default-advisory warning, and the safe\nfix\n- add ready-to-enter listing fields that fit Product Hunt's stricter\ncurrent lim\n[…]\nnges.\n- [x] Updated docs (`README.md` / `docs/`) where behavior changed.\n- [x] I used `Closes #...` only if merging this PR fully completes that\nissue.\n\nSigned-off-by: Rory Glenn <glennrory@gmail.com>",
          "is_bot": false,
          "headline": "docs: prepare Product Hunt launch media (#258)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-20T01:15:18Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "822c71e4a60cc8704b2436bdfa101cd466435af9",
          "body": "## Summary\n\nFixes two misleading messages found during installed-package QA:\n\n- the once-per-clone welcome now describes Commitment Issues generically\ninstead of claiming every consumer repository “uses its own product”\n- `init --dry-run` omits the apply instruction when the project is\nalready confi\n[…]\nible\nchanges.\n- [x] Updated docs (`README.md` / `docs/`) where behavior changed.\n- [x] I used `Closes #...` only if merging this PR fully completes that\nissue.\n\nSigned-off-by: Codex <codex@openai.com>",
          "is_bot": false,
          "headline": "fix: correct installed message guidance (#257)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-19T23:28:01Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5628e5c6f16c620e64644467e0d43cbefff12b62",
          "body": "Closes #204\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "docs: complete issue 204 CI evidence (#255)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-19T06:51:48Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4be8a48aff93d3f87f6783f2fa3ac4558c681928",
          "body": "Related to #204\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "ci: summarize trusted routing decisions (#251)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-19T06:43:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "04804936c62db16a44f335a5186b43fa5984ca55",
          "body": "Prove package-manager changes retain the full compatibility graph and record the hosted routing evidence for #204.\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "refactor: make lifecycle manager support immutable (#250)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-19T06:27:08Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5f85b396acc7c721d03376b3a08cd2d59825fb48",
          "body": "## Summary\n\n- replace the runtime's intermediate-array Node-version comparison with\nan explicit first-differing-component loop without changing behavior\n- add the missing below/above patch-number assertions\n- record a three-run, first-attempt runtime-only CI cohort against the\ntrusted classifier\n- p\n[…]\nior is unchanged).\n- [x] Updated docs where evidence changed.\n- [x] I used `Closes #...` only if merging this PR fully completes that\nissue.\n\n---------\n\nSigned-off-by: Rory Glenn <glennrory@gmail.com>",
          "is_bot": false,
          "headline": "refactor: prove runtime changes run full CI (#249)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-19T05:59:41Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3d78891dfade9778bad8a9c802f9140ebed6419a",
          "body": "## Summary\n\n- record that the fail-closed classifier from #247 reached `main`\n- define a three-run, first-attempt documentation-only timing cohort\n- add the exact routing, job-result, wall-clock, and runner-time\nevidence ledger that this PR will fill across consecutive revisions\n\nThis is the first r\n[…]\ner evidence only).\n- [x] Updated docs where behavior changed.\n- [x] I used `Closes #...` only if merging this PR fully completes that\nissue.\n\n---------\n\nSigned-off-by: Rory Glenn <glennrory@gmail.com>",
          "is_bot": false,
          "headline": "docs: measure documentation-only CI routing (#248)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-18T18:32:11Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ad25036d36a691e81a8cbb710c08708e438e904a",
          "body": "## Summary\n\n- add a NUL-safe, fail-closed classifier for runtime/CLI,\npackage-manager, tests/fixtures, workflows/releases,\ndocumentation/metadata, demo/assets, and unknown changes\n- allow only pure documentation/metadata additions and modifications\nonto the small route; deletions, renames, copies, m\n[…]\nce, coverage, scenario, performance,\nand audit documentation.\n- [x] I used `Closes #...` only if merging this PR fully completes that\nissue.\n\n---------\n\nSigned-off-by: Rory Glenn <glennrory@gmail.com>",
          "is_bot": false,
          "headline": "ci: route documentation changes safely (#247)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-18T18:18:10Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "140f219136496d2c9cfd43ebc9e41e64a1e26f0e",
          "body": "## Summary\n\n- split each Windows test lane into Node's native, complementary file\nshards `1/2` and `2/2` on Node 22.11.0 and Node 24\n- keep the complete macOS suites, both authoritative Ubuntu 100%\ncoverage/badge lanes, and both Windows npm lifecycle lanes unchanged\n- require every Windows shard and\n[…]\nuired.\n- [x] Updated documentation where CI behavior changed.\n- [x] I used `Closes #...` only if merging this PR fully completes that\nissue.\n\n---------\n\nSigned-off-by: Rory Glenn <glennrory@gmail.com>",
          "is_bot": false,
          "headline": "ci: shard Windows test files (#246)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-18T17:30:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "74240e4f667b484607ab1221a2ce87e52e4898b2",
          "body": "## Summary\n\n- record a reproducible 34-job CI baseline for issue #204, including\nwall-clock time, summed runner time, p50/p95, slow-job evidence, and the\npure-documentation reference run\n- keep the complete Windows test suite in the existing Node 22.11.0/24\nmatrix, but move the unchanged prebuilt np\n[…]\nntry is\nrequired.\n- [x] Updated documentation where CI behavior changed.\n- [x] I used `Closes #...` only if merging this PR fully completes that\nissue.\n\nSigned-off-by: Rory Glenn <glennrory@gmail.com>",
          "is_bot": false,
          "headline": "ci: parallelize Windows npm lifecycle (#245)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-18T15:53:18Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f9ca8bdbcf58c65e055c49f1807596b929c5af08",
          "body": "## Summary\n\n- Add an accessible 1200×675 before/after SVG and social PNG that a\nnontechnical viewer can understand at a glance: without Commitment\nIssues, send → wait → mistake found → redo; with it, spot → fix → send\nonce.\n- Keep the graphic to 34 visible words, remove software jargon, and make\nCom\n[…]\nte.\n- [x] I have updated documentation where appropriate.\n- [x] I used `Closes #…` only if merging this PR fully completes the\nlinked issue.\n\n---------\n\nSigned-off-by: Rory Glenn <glennrory@gmail.com>",
          "is_bot": false,
          "headline": "Add a before/after workflow story (#244)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-18T15:09:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "0a0992ef1cd739db3e37bcac3a4d6f486d99af03",
          "body": "## Summary\n\n- replace the obsolete Show HN preparation guidance with a Product Hunt\nlaunch checklist\n- point the adoption plan at #240 and use DEV's canonical-link\ncross-posting path\n- update the documented verified launch baseline from v3.3.2 to v3.4.0\n- connect the posting checklist to milestone #\n[…]\nx prettier --check ADOPTION.md promo/launch.md`\n- `git diff --check origin/main...HEAD`\n- `node tools/check-dco-range.mjs <origin-main-sha> <head-sha>`\n\nSigned-off-by: Rory Glenn <glennrory@gmail.com>",
          "is_bot": false,
          "headline": "Retarget launch planning to Product Hunt (#241)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-18T13:31:49Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "411d781fa19059607ca9cf38c608820794510f6f",
          "body": "## Summary\n\n- add a root `AGENTS.md` that routes agents to canonical contributor\ndocumentation and task-specific skills\n- audit every tracked `.github` file against package metadata,\nworkflows, the v3.4.0 release, and live repository governance\n- refresh Copilot and governance guidance with the curr\n[…]\n-dry-run --json` — `AGENTS.md` and `.github` remain\nexcluded\n- `node tools/check-dco-range.mjs <merge-base> <head-sha>`\n- `git diff --check`\n\n---------\n\nSigned-off-by: Rory Glenn <glennrory@gmail.com>",
          "is_bot": false,
          "headline": "Refresh repository agent and GitHub guidance (#242)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-18T13:31:25Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d93aa171b2382d05be58ffdf09d40054c78acf87",
          "body": "## Summary\n\n- show `help <command>` as a supported top-level usage form\n- list `commit-msg` in a separate Integration section as normally\ninvoked automatically by Git\n- keep the low-level `fix-staged-js` compatibility command and hidden\n`vows` Easter egg out of primary help\n- update the external-int\n[…]\n] Updated `CHANGELOG.md` under `## [Unreleased]`.\n- [x] Updated canonical documentation where behavior changed.\n- [x] No issue-closing keyword is used.\n\nSigned-off-by: Rory Glenn <glennrory@gmail.com>",
          "is_bot": false,
          "headline": "Expose commit message integration in CLI help (#243)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-18T13:21:47Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ab88d2ca73024b2bafeaa75a13fb939a39e2779d",
          "body": "## Summary\n\n- centralize command filenames, visibility, groups, summaries, usage,\nand supported options in one dispatcher metadata source\n- redesign global help around setup, check, and fix actions with the\ninstalled version, product explanation, examples, and documentation link\n- add safe `help <co\n[…]\n, branches, and functions\n- `npm run lint`\n- `npm run format:check`\n- `git diff --check`\n- `git verify-commit HEAD`\n\nCloses #238\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "feat: redesign CLI help around developer actions (#239)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-18T12:39:29Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b561790ecaafc24942c3c5a00ff381850bc281b8",
          "body": "Record the final Audit 9 pass, exact v3.4.0 candidate evidence, and explicit post-launch disposition of the unverified GUI-client lanes in #231.\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "docs: finalize Audit 9 verification (#233)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-17T03:55:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "279c78ff7ae0bab64ed7b295e65c430ef7ccc84d",
          "body": "## What changed\n\n- classify the four unavailable v3.4.0 GUI-client UI lanes as unverified\ninstead of a release blocker\n- narrow compatibility and FAQ claims so required shell CI is not\npresented as GUI evidence\n- document the explicit deferral rule in the definition of done,\nmaintainer checklist, sc\n[…]\nommit HEAD`\n- `node tools/check-dco-range.mjs\n5d82371bc399472587ce73a582e4deaf24636483\nabe73e848a77ada0574c3d952843c7e2696f3da0`\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "docs: defer unavailable GUI client tests (#232)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-17T03:39:19Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5d82371bc399472587ce73a582e4deaf24636483",
          "body": "Prepare the v3.4.0 package, lockfile, changelog, and prospective release-metadata assertion.\n\nNo tag, npm publication, or GitHub Release is created by this change.\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "release: prepare v3.4.0 candidate (#230)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-17T03:13:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0d22618f87347a2fdbe39e1b967e602e882fcb0c",
          "body": "Record the completed external-fork evidence for #180, reconcile downstream audit reports, update regression assertions, and remove the inert probe marker from #227.\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "docs: record external fork CI evidence (#228)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-17T01:28:29Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7dfeeb40b6e31fca72f2595743e253ba682a4d05",
          "body": "## Purpose\n\nExercise the complete current CI graph from a maintainer-controlled\nexternal fork under the restricted `pull_request` security boundary\nrequired by #180.\n\n## Scope\n\n- README-only inert probe comment\n- no shipped behavior or package contents change\n- test PR only; **do not merge**\n\n## Exp\n[…]\nrite-authority\npath should be available.\n\nTracks #180. Does not close it until both stages and the hosted evidence\nare verified.\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "test: exercise current external fork CI (#227)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-17T01:18:24Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1ac62ee7cdfa8656c1901839122cf995756c7732",
          "body": "## Summary\n\n- Refactor `tools/gen-message-state-svgs.mjs` to separate SVG production\nfrom writing, then add a non-writing `--check` mode that renders every\ngenerator-owned asset in memory and compares it byte-for-byte with the\ncommitted file in `assets/`.\n- `--check` reports every missing or stale a\n[…]\nMade with [Cursor](https://cursor.com)\n\nSigned-off-by: rahul-aravind-opti <rahul-aravind-opti@users.noreply.github.com>\nCo-authored-by: rahul-aravind-opti <rahul-aravind-opti@users.noreply.github.com>",
          "is_bot": false,
          "headline": "ci: add --check mode for message-state SVG generator (#142) (#226)",
          "author_name": "Rahul Aravind Mehalingam",
          "author_login": "rahul-aravind-opti",
          "committed_at": "2026-07-17T00:51:59Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7936a3b29e5be02da0af8334c516a804546c25b1",
          "body": "## Summary\n\n- record the 2026-07-16 owner-authenticated OpenSSF project-description\ncorrection and exact public read-back\n- reconcile Audit 8, Audit 9, release, security-review, and OpenSSF\nevidence surfaces with the completed #199 control\n- add a metadata regression that prevents the stale external\n[…]\ne`\n- `git diff --check`\n- signed commit verified with `git verify-commit HEAD`; DCO trailer\npresent\n\nCloses #199\nRelated to #138\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "docs: record OpenSSF profile correction (#225)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-16T21:00:39Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "63d4385f81e3af3a0828e970b1ef0a34f827c939",
          "body": "## Summary\n\n- record the 2026-07-16 owner-authenticated npm trusted-publisher and\naccess-policy review\n- mark the Audit 7 npm control complete while preserving the remaining\n#138 release gates\n- update the independent final-verification report and add regression\nassertions for the privacy-bounded ev\n[…]\n0`\n- `git diff --check`\n- signed commit verified with `git verify-commit HEAD`; DCO trailer\npresent\n\nCloses #195\nRelated to #138\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "docs: record npm publisher verification (#223)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-16T20:18:40Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9b1b29de56ead8e7e0080284adf5c68d93b365a2",
          "body": "Records the narrow public exception for the malformed Audit 9 squash trailer and restores prospective DCO enforcement without rewriting protected history.\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "ci: record malformed DCO trailer exception (#221)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-16T16:56:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "495d25a2dcfea5f4ee7857fed2b3a1d845ca9a19",
          "body": "Records the independently reproduced Audit 9 preflight evidence while leaving the final audit open for the documented external and version-candidate gates.\\n\\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "docs: record independent final-verification preflight (#138)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-16T16:40:52Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2c65e26d3d01536aa5f76c8566bd68f0c77d08a0",
          "body": "## Summary\n\n- add the final Audit 8 report for documentation, governance, security\nclaims, links, and promotional assets\n- map every #137 acceptance criterion to merged repository and live\nexternal evidence\n- separate completed repository work from the remaining\nowner-authenticated #180, #195, and #\n[…]\nhigh` (0 vulnerabilities)\n- `git diff --check`\n- required hosted CI on integrated `main` run 29511127093\n\nCloses #137\n\n---------\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "docs: complete documentation and governance audit (#219)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-16T15:50:38Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "db3ccf039c625764e8eabe6d6c23589d42ef07b8",
          "body": "Closes #99\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "docs: refresh integrated security review (#218)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-16T15:26:08Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e7d096d70a297da19fe6d8b7e78f1c83a767b21d",
          "body": "## Summary\n\n- record the live ruleset 18531369 CodeQL thresholds and unchanged\npre-existing controls\n- link disposable PR #216 as the blocked Error/Critical negative control\n- update governance and Audit 6 from selected policy to live enforcement\n- use this clean PR as the positive merge-protection \n[…]\n\n- npm run format:check\n- npm audit --audit-level=high (zero vulnerabilities)\n- signed commits verified\n\nCloses #177.\n\n---------\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "docs: complete CodeQL merge-protection evidence (#217)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-16T14:58:02Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f114f6ed984ae61275ccb7e75c98253bee0fee5b",
          "body": "## Summary\n\n- fail full performance benchmarks unless both hook JSON results are\nclean\n- cover clean and advisory status handling with a regression test\n\n## Verification\n\n- node --test test/performance-benchmark.test.mjs\n- node scripts/run-branch-coverage.mjs (860 tests; 100% line, branch,\nand funct\n[…]\ncheck\n\nFollow-up to #213 and #95. This addresses the automated review finding\non the merged benchmark implementation.\n\n---------\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix: reject advisory performance benchmark hooks (#215)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-16T14:20:32Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c748d38c187b8872d62278afd65d5d64d684ca44",
          "body": "## Summary\n\n- add bounded smoke, 250-pair full-hook, and 1,000-pair\nargument-pressure tiers using disposable real-Git repositories and\nhostile long paths\n- report discovery time, hook latency, process-tree RSS, fixture size,\noutput volume, host budgets, and conservative Windows argv boundaries\nwitho\n[…]\nANGELOG.md` under `## [Unreleased]` for user-visible\nchanges.\n- [x] Updated docs (`README.md` / `docs/`) where behavior changed.\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "perf: benchmark large hook workloads (#213)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-16T04:42:21Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f5d293836898cdfb0dbc0947667c32ac629abf4c",
          "body": "## Summary\n\n- add a required packed-artifact matrix for Linux `/bin/sh`, Bash, and\nFish; macOS `/bin/sh` and Zsh; and Windows PowerShell and Command Prompt\n- exercise install, init, advisory commit, push to a local bare remote,\ndoctor, and uninstall offline from hostile paths with a stripped `PATH`\n\n[…]\ntegrated terminal proves the selected shell, not the\nGUI client's inherited Git environment.\n\nCloses #83\nPart of #101\n\n---------\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "test: add cross-shell and Git-client compatibility coverage (#211)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-16T04:04:16Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ac605f5a5ee13d3bc1fffe5ad215fb1c3b7a27db",
          "body": "## Summary\n\n- add a dependency-free terminal text boundary that visibly escapes\nC0/C1 controls and removes repository-supplied CSI/OSC sequences\n- preserve intentional model line breaks, Unicode, spaces, and the\nexisting product-owned bold/dim/severity styling\n- keep raw child-process passthrough un\n[…]\n-check`\n\nThe required pinned Bun lifecycle remains covered by the PR CI matrix.\n\nCloses #207\nPart of #99\nPart of #137\n\n---------\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix: escape terminal control characters (#209)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-16T03:39:08Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "132ecc3f3cc88cc0d5f75a1361103263960443ec",
          "body": "## Summary\n\n- add an isolated, integrity-locked `@yarnpkg/cli-dist` 4.17.0 fixture\nwithout replacing the existing Yarn Classic 1.22.22 executable\n- run Yarn Berry `nodeLinker: node-modules` as a distinct required\nlifecycle identity across Ubuntu, macOS, and Windows at Node 24 plus\nUbuntu at the exac\n[…]\nlled in the local environment; the required pinned Bun\nlanes remain delegated to hosted CI.\n\nCloses #100\nPart of #101\n\n---------\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "test: verify Yarn Berry node-modules lifecycle (#210)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-16T02:58:56Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "da2567d8d084f6a01eb5a0d8b8d733e9276a7041",
          "body": "## Summary\n\n- select CodeQL tool-severity Errors and High/Critical security alerts\nas the launch merge-protection thresholds\n- document the distinction between required CodeQL execution and\nalert-based blocking\n- record GitHub's merge-queue/default-setup Dependabot exceptions, the\nexisting admin byp\n[…]\nactly matches the captured pre-change\npayload\n- proposed payload differs only by the documented CodeQL rule\n- `git diff --check`\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "docs: prepare CodeQL alert merge protection (#214)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-16T02:58:30Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7e433b0f2e2c61ecc15e985bbfcce86add2d2aab",
          "body": "## Summary\n\n- reject symbolic links and non-regular `package.json`, `.gitignore`,\nand `.commitmentrc.json` paths before setup or removal can mutate a\nproject\n- write through a verified file descriptor, use exclusive creation for\nmissing files, and recheck standalone-config identity immediately befor\n[…]\nipts`\n- `npm audit --audit-level=high` (0 vulnerabilities)\n- `git diff --check`\n\nCloses #206\nPart of #99\nPart of #137\n\n---------\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "security: guard mutable project file writes (#208)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-16T02:47:05Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "cec595e30ed47e6cde32b7ef768ec9493bc12f10",
          "body": "## Summary\n\n- classify `.husky` with `lstat` and preserve symlink, non-directory,\nand unreadable roots\n- recheck directory and file identities before removing legacy Husky\nwiring\n- preserve filesystem identities as exact integers so replacement checks\nremain reliable on Windows\n- keep the existing m\n[…]\nrmat, release validation, pack dry-run, and audit pass\n- commit signature and DCO verified\n\nCloses #203\nPart of #99\nPart of #137\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "security: preserve linked legacy Husky paths (#205)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-15T18:55:01Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "87ceda1aa20fc2e92eecd16aa2a17b2bfab212c2",
          "body": "## Summary\n\n- resolve Yarn Classic 1.22.22 from the reviewed npm lockfile\n- remove both global Yarn installation steps from CI\n- expose the Yarn migration fixture through an npm script so workflows\nuse the lockfile-provided binary\n- add policy tests that prevent an unpinned global bootstrap from\nret\n[…]\ndation, package dry-run, and\nhigh-severity audit — passed\n- signed commit and DCO verified\n\nCloses #201\nPart of #99\nPart of #137\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "ci: lock Yarn Classic bootstrap (#202)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-15T16:53:22Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "859c0459a7d601856a63d1b4ffb1f7b580b57f3c",
          "body": "## Summary\n\n- distinguish v3.3.2's verified immutable assets from its documented\nlegacy empty release notes\n- name the exact supported package managers in adoption and launch\nmaterial\n- qualify `commit:fix` against the local Git evidence it can actually\ninspect\n- update the security boundary for loc\n[…]\n commit and DCO range verified\n- demo contact sheet and live 1280×640 social preview visually inspected\n\nPart of #137\n\n---------\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "docs: correct Audit 8 public claims (#200)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-15T16:32:34Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "0704b1ee24c23a05fe783b5cbe0093272decdba6",
          "body": "## Summary\n\n- replace the trailing-separator regular expression in Husky\n`core.hooksPath` recognition with a bounded linear-time scan\n- add normalization coverage for Windows separators and repeated\ntrailing separators\n- add a regression test for a long adversarial separator run\n- document the secur\n[…]\n `npm audit --audit-level=high` — 0 vulnerabilities\n- signed commit and DCO range verified\n\nCloses #197\nPart of #99\nPart of #137\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "security: make hooksPath normalization linear-time (#198)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-15T16:15:55Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "dad5af6dbd5cf45d0f0f51619f7bb095c0caaa70",
          "body": "## Summary\n\n- finalize Audit 7 with the merged repair evidence from PRs #188 through\n#194\n- record an exact public-registry v3.3.2 download, digest match, npm\nsignature/provenance verification, and clean external CLI/hook lifecycle\n- accept #175 as a non-blocking test-structure refactor\n- keep npm p\n[…]\nt --audit-level=high` — zero vulnerabilities\n- signed commit and DCO verification\n- pre-push metadata suite — 29/29\n\nCloses #136\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "docs: complete release packaging audit (#196)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-15T15:46:22Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a4ae5a4ae99cc4d7c00b4db30f7eddc4bcdcbc56",
          "body": "## Summary\n\n- record the two current write collaborators as time-bounded designated\ncontributors for issues #141 and #142\n- distinguish broad personal-repository write capability from approved\nmaintainer, release, npm, administration, and private-security authority\n- add an effective authority matri\n[…]\nidate`\n- focused metadata suite — 28/28\n- signed commit and DCO range verification\n- pre-push focused suite — 28/28\n\nCloses #187\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "docs: reconcile sensitive access authority (#194)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-15T15:13:47Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6690c2b90eae9a0720f47b1d801d242d3d45b3c4",
          "body": "## Summary\n\n- validate relative Markdown links against the exact `npm pack` file\nmanifest\n- recheck those links from the clean installed package in every\npackage-manager lifecycle\n- replace seven repository-only relative targets with canonical GitHub\nURLs\n- document the intentional boundary between \n[…]\ncycle:npm`\n- pinned pnpm 10, Yarn 1.22.22, and Bun 1.3.14 lifecycle runs\n- signed commit and DCO range verification\n\nCloses #186\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix: validate links in packed markdown (#193)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-15T14:54:17Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "236fb51d200169bd5f2552357b818ccca48c57d6",
          "body": "## Summary\n\n- replace the directory-wide `scripts/` package rule with an explicit\nallowlist for all 28 installed runtime modules\n- keep the six lifecycle and coverage maintenance modules\nrepository-only\n- verify the real pack manifest contains the public bin, every CLI\ncommand target, and the comple\n[…]\n11, pnpm 10, Yarn Classic 1.22.22,\nand Bun 1.3.14\n- `git diff --check`\n- signed commit and DCO trailer\n\nCloses #185\nPart of #136\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix: exclude maintenance scripts from npm package (#192)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-15T14:29:23Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4ff15ca04c5204eac8d0926286a7a115e684fd23",
          "body": "## Summary\n\n- add one dependency-free release validator for the package version,\nboth lockfile roots, exact tag, canonical changelog section, reviewed\nnotes, and fixed historical release ledger\n- run the validator in pull-request, tag, manual-incident, and\ndirect-root publication paths, then publish\n[…]\n schema-lag suppression\n- `npm pack --dry-run --json --ignore-scripts`\n- `git diff --check`\n\nCloses #184\nPart of #136\n\n---------\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix: enforce consistent release metadata (#191)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-15T14:04:55Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "63634dee086ec838fc0af3449a4f876373296145",
          "body": "## Summary\n\n- add digest-pinned v2.5.1, v3.2.0, and v3.3.2 upgrade fixtures with\nreal commit and push checks\n- require the npm migration lane in pull requests and release\nvalidation, with scheduled pnpm, Yarn, and Bun coverage\n- keep the tested release candidate byte-identical across the\nunprivilege\n[…]\n Bun 1.3.14 —\nall pinned historical fixtures passed\n- exact supplied candidate tarball migration on npm\n\nCloses #96\nPart of #136\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "test: automate cross-version lifecycle migrations (#190)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-15T13:13:51Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5e8129713801c3d07895557c961f439e06b89ab8",
          "body": "## What\n\n- add a read-only release recovery classifier for `before-npm`,\n`after-npm`, and `complete`\n- make the publish workflow skip duplicate npm publication only after\nexact source, byte, provenance, npm `latest`, and GitHub draft checks\n- cryptographically verify SLSA provenance before a draft c\n[…]\n= complete; v3.3.0 = refused as\npublished partial\n- independent security review: no remaining blockers\n\nCloses #183\nPart of #136\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix: make partial releases safely resumable (#189)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-15T04:43:40Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "74595573077b899adae6eeb684f6c8eeed8ac6bd",
          "body": "## Summary\n\n- require every release-tag commit to belong to the reviewed\n`origin/main` history before dependency installation, packing, or\npublication\n- pack once and pass the exact tarball through lifecycle verification,\nhashing, artifact upload, npm publication, provenance, and the immutable\nGitHu\n[…]\nintainer documentation.\n\nCloses #94\nCloses #182\nRefs #136\nRefs #175\nRefs #183\nRefs #184\nRefs #185\nRefs #186\nRefs #187\n\n---------\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix: enforce reviewed exact release artifacts (#188)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-15T03:57:58Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7a8504863eb798bed1b687a3f06f61b21780af3b",
          "body": "## Summary\n\n- record the successful hosted CI and release-workflow validation from\n#178\n- add the post-merge `main` CI, standalone CodeQL, Repository Health,\nand Scorecard runs\n- replace provisional Audit 6 wording with the evidence-backed\ncompletion verdict\n- preserve the current external-fork evid\n[…]\n passed\n- [post-merge\nScorecard](https://github.com/RoryGlenn/commitment-issues/actions/runs/29381843821)\n— passed\n\nCloses #135.\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "docs: record Audit 6 hosted completion evidence (#181)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-15T02:54:21Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4d1a2a801c3cfd347d8a4040e020710b738a7081",
          "body": "## Summary\n\n- add a required static-quality and workflow-policy lane to the main CI\naggregate\n- make CodeQL reusable from pull-request CI while retaining scheduled\nand manual scans\n- harden workflow permissions, checkout credentials, timeouts,\nconcurrency, release queueing, and shell input boundarie\n[…]\n5 open until this PR's hosted fork, reusable-CodeQL,\nrelease-queue, and aggregate-gate evidence is recorded in the audit\nreport.\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix: complete CI/CD and GitHub Actions audit (#178)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-15T01:31:39Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ce8c9a33e1b013fc8494aaaa6ff9661f3886eb8a",
          "body": "## Summary\n\n- define the exact supported package-manager, Node.js, operating-system,\nshell, lifecycle, and Git-client boundary in a shipped compatibility\nguide and completion report\n- make generated hooks invoke only the project-local binary, add a clear\nminimum-Node diagnostic, pin floor-compatible\n[…]\nEAD`\n\nThe PR remains draft until the expanded hosted package-manager/OS matrix\nsupplies the final closure evidence.\n\nCloses #134\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix: complete package-manager and cross-platform audit (#176)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-15T00:43:26Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6779edbaf92809f23d96b67d0a39d48ca815417b",
          "body": "## Summary\n\n- enforce the one-box invariant by deferring the once-per-clone welcome\nwhenever a warning or error is the final pre-commit outcome\n- harden the shared Boxen renderer against malformed or impossibly\nnarrow `COLUMNS` values and make `FORCE_COLOR=0` remove both\npreformatted body escapes an\n[…]\n- `npm pack --dry-run --json --ignore-scripts`\n- pre-push affected-file suite — 160/160 passed\n- `git diff --check`\n\nCloses #133\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix: complete terminal UX and output architecture audit (#174)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-15T00:00:49Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2e5fccdc338a29fe80f3ad2ddbec6cd2ec3ec4b8",
          "body": "## Summary\n\n- center the Commit Owl artwork independently of its decorative heart\n- update the documented welcome state\n- add alignment assertions for the tuft, face, body, feet, and heart\n\n## Root cause\n\nFollow-up to #170. The welcome centered `(O,O) <3` as one nine-character\nstring, which shifted \n[…]\n unchanged.\n\n## Validation\n\n- `node --test test/welcome.test.mjs`\n- `npm run lint`\n- `npm run format:check`\n- `git diff --check`\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Center the Commit Owl independently of its heart (#173)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-14T22:44:26Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "27fbf411e72757fd9077a3fca59b049d19701277",
          "body": "## Summary\n\n- show a default-on Commit Owl welcome before the first human-readable\npre-commit checks in each clone\n- store a versioned marker under Git's common directory so linked\nworktrees share the once-per-clone state\n- add the `showWelcomeOnFirstCommit: false` opt-out,\npackage-manager-aware doc\n[…]\nheck`\n- `git verify-commit HEAD`\n\nCloses #167\n\n---------\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>\nSigned-off-by: Rory Glenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Show a one-time welcome before contributors' first commit (#170)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-14T22:28:10Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "85b838e9b7b78be34d08d88a8cc2d2761ea91980",
          "body": "Signed-off-by: Rory Glenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Update README.md",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-14T21:53:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "fdc2e86582e6fb79570c48df31b00e80e11287ca",
          "body": "Signed-off-by: Rory Glenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Update README.md",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-14T21:51:34Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a525adf04139feb3bf754263d71d3599712950ac",
          "body": "## Summary\n\n- identify Commitment Issues as a local Git hooks tool in the opening\ntagline\n- replace the vague description of “mistakes” with concrete examples\n- remove the duplicate Node.js requirement badge while retaining the\nrequirement in the support line\n\nThis makes the project category and val\n[…]\narrowly scoped.\n- [x] The documented Node.js requirement remains unchanged.\n- [x] No runtime behavior or configuration changed.\n\nSigned-off-by: Rory Glenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Clarify README value proposition (#171)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-14T21:41:52Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9dd4ea29055216b5f40847fad21775cb03807da6",
          "body": "## Summary\n\n- restore the established “For developers who overthink every commit”\ntagline at the top of the README;\n- replace the feature-heavy opening paragraph with the plain-language\ncontrast between catching mistakes early and after they become\nexpensive;\n- align the hero-image alternative text \n[…]\nchangelog are updated.\n- [x] Tests, lint, and formatting pass.\n- [x] Every commit is cryptographically signed and DCO-compliant.\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Restore the project elevator pitch (#169)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-14T17:27:18Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "db573a504523a5deb29913941d4c8be3baed2e3b",
          "body": "## What changed\n\n- add a canonical Definition of Done for changes, releases, and public\npromotion\n- add a stop rule so new ideas do not become retroactive launch blockers\n- define the entry criteria and allowed scope for **feature complete —\nmaintenance mode**\n- require an explicit evidence-backed r\n[…]\n\n- verified internal relative links and referenced issue targets\n- no runtime tests run because the change is documentation-only\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Document the project definition of done (#164)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-14T16:38:52Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "52f61b10f63e9849520fb7833c4c4b562bbcf86e",
          "body": "## Summary\n\n- make the aggregate `CI Success` gate fail closed unless DCO, the\nOS/Node checks, and the package-manager lifecycle matrix each report\nexplicit success\n- add executable ownership for all 26 runtime modules and lock the two\njustified coverage suppressions\n- add regressions for combined s\n[…]\n under `## [Unreleased]` for user-visible\nchanges.\n- [x] Updated docs (`README.md` / `docs/`) where behavior changed.\n\n---------\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "test: complete meaningful coverage audit (#163)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-14T02:20:53Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "564d6e5a3fccd3c280ab1d580ad1b97f3caac583",
          "body": "Completes #131\nCloses #97\nCloses #159\n\n## Summary\n\n- make enforced secret scanning fail closed when Git cannot produce a\nvalid staged patch\n- protect Node test paths from option parsing while preserving custom\nrunner arguments\n- refuse automatic hook repair through symlinks and isolate pre-push\nrepo\n[…]\n vulnerabilities\n- `git diff --check`: passed\n\nBoth commits are SSH-signed and include a DCO `Signed-off-by` trailer.\n\n---------\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "security: complete secrets and subprocess audit (#162)",
          "author_name": "Rory Glenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-13T20:09:17Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "73def8fbb07b30604b36122abbb74200d781bf97",
          "body": "Update softprops/action-gh-release from 3.0.1 to 3.0.2 using the upstream release commit digest.\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": true,
          "headline": "ci(deps): bump softprops/action-gh-release to 3.0.2 (#155)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-13T18:09:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3a4c1a9550074f921a84316c16ccce99ad575d3e",
          "body": "## Summary\n\n- record the single unsigned roadmap commit as an explicit governance\nexception\n- move the operational DCO audit baseline to `265d2e6` in both workflows\nand the shared checker\n- preserve the original July 10 policy-adoption record and July\nsecurity-review evidence snapshot\n- keep workflo\n[…]\ncal hook can mutate the caller repository. All\nequivalent focused and full validation ran manually before the push.\n\nCloses #160\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "ci: restore prospective DCO enforcement (#161)",
          "author_name": "RoryGlenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-13T17:55:54Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "da0efa085971fdd7535c4ada2268339aface0c29",
          "body": "Accept valid DCO sign-offs that follow Dependabot commit-message metadata while continuing to reject matching lines in earlier body paragraphs.\n\nCloses #156.\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix: accept Dependabot DCO trailers (#158)",
          "author_name": "RoryGlenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-13T17:32:11Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3853f63935657f163f973dc37f000ed2449d4fbc",
          "body": "## Summary\n\n- reject unsupported CLI options and excess positional arguments before\ncommand dispatch can mutate state\n- preflight project-file access before init/uninstall changes hooks, and\nreplace raw filesystem exceptions with bounded recovery guidance\n- add regression coverage for interrupted se\n[…]\n\n- `git diff --check`\n- pre-push affected-test gate — 280 passed\n\nCompletes #130\n\nSigned-off-by: Rory Glenn <glennrory@gmail.com>\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "fix: complete core CLI and Git audit (#151)",
          "author_name": "RoryGlenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-13T16:33:47Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "17709b22f630476acfa69a8d69a3912c8f615c6b",
          "body": "## Summary\n\n- establish a repository documentation index with explicit user,\ncompatibility, trust, and maintainer audiences\n- consolidate dependency, package, and repository maintenance guidance\ninto one maintainer operations guide\n- shorten the README, FAQ, external interface, and feature-planning\n\n[…]\n all 39 Markdown files checked for valid relative file targets\n- commit signature verified with `git verify-commit`\n\nCloses #152\n\nSigned-off-by: RoryGlenn <32777747+RoryGlenn@users.noreply.github.com>",
          "is_bot": false,
          "headline": "docs: consolidate documentation architecture (#153)",
          "author_name": "RoryGlenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-13T16:13:17Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "265d2e6c9c12349a1c06fa8a9a6c6d3ac957e6d5",
          "body": null,
          "is_bot": false,
          "headline": "Updating roadmap",
          "author_name": "RoryGlenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-13T03:02:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a2d9fb7df74a8855425facac3481ba93482a0403",
          "body": "## Summary\n\n- add a prominent README section built around: “GitHub Actions catches\nmistakes after they become expensive. Commitment Issues catches them\nwhile they are still cheap.”\n- add `docs/why-before-ci.md` with CI-only and early-feedback timelines\n- explain where teams save time, engineering co\n[…]\nrified 37 relative links across the README and new document; 0\nmissing\n\nSigned-off-by: Codex <codex@openai.com>\nSigned-off-by: Rory Glenn <glennrory@gmail.com>\nCo-authored-by: Codex <codex@openai.com>",
          "is_bot": false,
          "headline": "docs: explain the value of feedback before CI (#150)",
          "author_name": "RoryGlenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-13T02:09:22Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "fd2d7d6b1b4d06ca45c42ca02947789b804a0add",
          "body": "## Summary\n\n- refresh contributor setup around `npm ci`, an `upstream` remote, and a\nbranch based on current `main`\n- align the project layout and validation guidance with the current\nruntime, integration tests, maintenance tools, coverage gate, and\npackage lifecycle checks\n- repair contributor navi\n[…]\nssage-state contributor workflow remains tracked by #118 and is\nintentionally left for its new contributor.\n\n---------\n\nSigned-off-by: Codex <codex@openai.com>\nCo-authored-by: Codex <codex@openai.com>",
          "is_bot": false,
          "headline": "docs: refresh contributing guide (#140)",
          "author_name": "RoryGlenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-13T01:39:48Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2cf439ccedccb6a6444b68a524af3a68ce733916",
          "body": "## Summary\n\n- distinguish non-bare working trees from bare repositories before\ninstalling or reporting local hooks\n- distinguish an unset `core.hooksPath` from failed Git probes and\nwithhold health claims when the active hook location is unknown\n- resolve configured hook directories through Git, inc\n[…]\ncle:npm`\n- `npm pack --dry-run --json --ignore-scripts`\n- pre-push affected-test gate — 217 tests passed\n\nPart of #130\n\nSigned-off-by: Codex <codex@openai.com>\nCo-authored-by: Codex <codex@openai.com>",
          "is_bot": false,
          "headline": "fix: harden core Git hook discovery (#139)",
          "author_name": "RoryGlenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-12T22:42:13Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3acd640cccee483214d24a59c7765ae3c6761ed2",
          "body": "## Summary\n\n- resolve package and standalone configuration through one shared\neffective-config path\n- make `init` derive optional `commit-msg` wiring and setup claims from\nstandalone-over-package precedence\n- preserve invalid higher-precedence values for diagnostics instead of\nrewriting or reviving \n[…]\nent\n- `npm run test:lifecycle:npm` — packed mixed-source lifecycle passed\n- `npm run lint`\n- `npm run format:check`\n- `npm run states`\n\nCloses #98\nPart of #101\n\nSigned-off-by: Codex <codex@openai.com>",
          "is_bot": false,
          "headline": "fix: honor standalone commit message hook config (#102)",
          "author_name": "RoryGlenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-12T18:57:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f84d971c360633196598058927eaa7d95f62be04",
          "body": "Signed-off-by: Codex <codex@openai.com>",
          "is_bot": false,
          "headline": "ci: normalize volatile demo comparisons (#104)",
          "author_name": "RoryGlenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-12T17:31:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ad8f54dda8b7247ab14970c3132c58351f3234af",
          "body": "Signed-off-by: Codex <codex@openai.com>\nCo-authored-by: Codex <codex@openai.com>",
          "is_bot": false,
          "headline": "docs: refresh v3.3.2 documentation (#93)",
          "author_name": "RoryGlenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-12T14:40:50Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5e034b243dc61dd39fce14618cd6641c54160b7d",
          "body": "Signed-off-by: Codex <codex@openai.com>",
          "is_bot": false,
          "headline": "docs: expand FAQ trust and platform guidance (#92)",
          "author_name": "RoryGlenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-12T14:03:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "57ac737538af1d9d7da7e2c3415f1d7d39a5320d",
          "body": "Validate reusable release-workflow permissions before immutable tags are pushed.\n\nSigned-off-by: Codex <codex@openai.com>",
          "is_bot": false,
          "headline": "chore: release v3.3.2 with pre-merge publish validation (#91)",
          "author_name": "RoryGlenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-12T13:29:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b37d060139717460c20ea0de87b38ca7e18d7d64",
          "body": "Stage the exact npm tarball and signed SLSA provenance before immutable release publication.\n\nSigned-off-by: Codex <codex@openai.com>",
          "is_bot": false,
          "headline": "chore: release v3.3.1 with immutable assets (#90)",
          "author_name": "RoryGlenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-12T12:14:52Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a653c1d24a8d5fe920fdb285922c91c2ebd14d87",
          "body": "Signed-off-by: Codex <codex@openai.com>",
          "is_bot": false,
          "headline": "chore: release v3.3.0 (#89)",
          "author_name": "RoryGlenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-12T11:41:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "eeeccbcf47670a249c04d3f975f185afb1ea1c28",
          "body": "Signed-off-by: Codex <codex@openai.com>",
          "is_bot": false,
          "headline": "Add vows CLI Easter egg (#88)",
          "author_name": "RoryGlenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-12T11:26:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ecd6a49317b585ef9d918af5880868e2c5f1466c",
          "body": "* test: enforce 100% runtime coverage\n\nSigned-off-by: Codex <codex@openai.com>\n\n* test: make external-path assertions portable\n\nSigned-off-by: Codex <codex@openai.com>\n\n* test: normalize cross-platform path expectations\n\nSigned-off-by: Codex <codex@openai.com>\n\n---------\n\nSigned-off-by: Codex <codex@openai.com>",
          "is_bot": false,
          "headline": "test: enforce 100% runtime coverage (#87)",
          "author_name": "RoryGlenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-12T11:06:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "752a107c7464df22451cce98dc67579e0c4077fc",
          "body": "* feat: add problems-only hook output\n\nSigned-off-by: Codex <codex@openai.com>\n\n* test: keep demo hook output visible\n\nSigned-off-by: Codex <codex@openai.com>\n\n---------\n\nSigned-off-by: Codex <codex@openai.com>",
          "is_bot": false,
          "headline": "feat: add problems-only hook output (#85)",
          "author_name": "RoryGlenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-12T02:38:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2e9abe42ff2e81fb4634dbe9286bcf9b388cfee3",
          "body": "Signed-off-by: Codex <codex@openai.com>",
          "is_bot": false,
          "headline": "fix: limit CLI output to one box (#82)",
          "author_name": "RoryGlenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-12T01:52:29Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "46bc910d487108e1aa0cde7a89a352850ef86f97",
          "body": "Signed-off-by: Codex <codex@openai.com>",
          "is_bot": false,
          "headline": "fix: limit Scorecard to default-branch events (#75)",
          "author_name": "RoryGlenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-12T00:33:36Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "21237a8beff51526a9541bf970e4b3e74a6d392a",
          "body": "Signed-off-by: Codex <codex@openai.com>",
          "is_bot": false,
          "headline": "feat: support Node.js 22.11.0 (#74)",
          "author_name": "RoryGlenn",
          "author_login": "RoryGlenn",
          "committed_at": "2026-07-12T00:17:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        }
      ],
      "releases_count": 11,
      "commits_last_year": 489,
      "latest_release_at": "2026-07-17T12:23:24Z",
      "latest_release_tag": "v3.4.0",
      "releases_from_tags": false,
      "days_since_last_push": 0,
      "active_weeks_last_year": 4,
      "days_since_latest_release": 5,
      "mean_days_between_releases": 1.3
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": true,
      "health_percentage": 100,
      "has_issue_template": false,
      "has_code_of_conduct": true,
      "has_pull_request_template": true
    },
    "ecosystem": {
      "packages": [
        {
          "name": "commitment-issues",
          "exists": true,
          "license": "MIT",
          "keywords": [
            "pre-commit",
            "husky",
            "lint-staged",
            "eslint",
            "prettier",
            "git-hooks",
            "advisory",
            "non-blocking"
          ],
          "ecosystem": "npm",
          "matches_repo": true,
          "registry_url": "https://www.npmjs.com/package/commitment-issues",
          "is_deprecated": false,
          "latest_version": "3.4.0",
          "repository_url": "https://github.com/RoryGlenn/commitment-issues",
          "versions_count": 22,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": 1,
          "monthly_downloads": 2971,
          "first_published_at": "2026-06-29T12:30:08.854000Z",
          "latest_published_at": "2026-07-17T12:20:43.306000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 5
        }
      ]
    },
    "popularity": {
      "forks": 3,
      "stars": 3,
      "watchers": 0,
      "fork_history": {
        "days": [
          {
            "date": "2026-07-12",
            "count": 1
          },
          {
            "date": "2026-07-13",
            "count": 1
          },
          {
            "date": "2026-07-17",
            "count": 1
          }
        ],
        "complete": true,
        "collected": 3,
        "total_forks": 3
      },
      "star_history": null,
      "open_issues_and_prs": 49
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [],
      "has_llms_txt": false,
      "has_dockerfile": false,
      "has_mcp_signal": false,
      "bootstrap_files": [],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [],
      "largest_source_bytes": 180032,
      "source_files_sampled": 129,
      "oversized_source_files": 5,
      "agent_instruction_files": [
        ".github/copilot-instructions.md",
        "AGENTS.md",
        "CLAUDE.md"
      ],
      "agent_instruction_max_bytes": 10338
    },
    "dependencies": {
      "manifests": [
        "package.json"
      ],
      "advisories": {
        "error": null,
        "scope": "repository_graph",
        "source": "osv",
        "findings": [],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {},
        "advisory_count": 0,
        "affected_count": 0,
        "assessed_count": 268,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "npm"
      ],
      "dependencies": [
        {
          "name": "boxen",
          "manifest": "package.json",
          "ecosystem": "npm",
          "version_constraint": "^8.0.1"
        },
        {
          "name": "cross-spawn",
          "manifest": "package.json",
          "ecosystem": "npm",
          "version_constraint": "^7.0.6"
        },
        {
          "name": "js-yaml",
          "manifest": "package.json",
          "ecosystem": "npm",
          "version_constraint": "^4.3.0"
        },
        {
          "name": "picocolors",
          "manifest": "package.json",
          "ecosystem": "npm",
          "version_constraint": "^1.1.1"
        }
      ],
      "all_dependencies": {
        "error": null,
        "source": "github-sbom",
        "packages": [
          {
            "name": "boxen",
            "direct": true,
            "version": "8.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "cross-spawn",
            "direct": true,
            "version": "7.0.6",
            "ecosystem": "npm"
          },
          {
            "name": "js-yaml",
            "direct": true,
            "version": "4.3.0",
            "ecosystem": "npm"
          },
          {
            "name": "picocolors",
            "direct": true,
            "version": "1.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/code-frame",
            "direct": false,
            "version": "7.29.7",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/compat-data",
            "direct": false,
            "version": "7.29.7",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/core",
            "direct": false,
            "version": "7.29.7",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/generator",
            "direct": false,
            "version": "7.29.7",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/helper-compilation-targets",
            "direct": false,
            "version": "7.29.7",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/helper-globals",
            "direct": false,
            "version": "7.29.7",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/helper-module-imports",
            "direct": false,
            "version": "7.29.7",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/helper-module-transforms",
            "direct": false,
            "version": "7.29.7",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/helper-string-parser",
            "direct": false,
            "version": "7.29.7",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/helper-validator-identifier",
            "direct": false,
            "version": "7.29.7",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/helper-validator-option",
            "direct": false,
            "version": "7.29.7",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/helpers",
            "direct": false,
            "version": "7.29.7",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/parser",
            "direct": false,
            "version": "7.29.7",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/template",
            "direct": false,
            "version": "7.29.7",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/traverse",
            "direct": false,
            "version": "7.29.7",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/types",
            "direct": false,
            "version": "7.29.7",
            "ecosystem": "npm"
          },
          {
            "name": "@eslint-community/eslint-utils",
            "direct": false,
            "version": "4.9.1",
            "ecosystem": "npm"
          },
          {
            "name": "@eslint-community/regexpp",
            "direct": false,
            "version": "4.12.2",
            "ecosystem": "npm"
          },
          {
            "name": "@eslint/config-array",
            "direct": false,
            "version": "0.21.2",
            "ecosystem": "npm"
          },
          {
            "name": "@eslint/config-helpers",
            "direct": false,
            "version": "0.4.2",
            "ecosystem": "npm"
          },
          {
            "name": "@eslint/core",
            "direct": false,
            "version": "0.17.0",
            "ecosystem": "npm"
          },
          {
            "name": "@eslint/eslintrc",
            "direct": false,
            "version": "3.3.5",
            "ecosystem": "npm"
          },
          {
            "name": "@eslint/js",
            "direct": false,
            "version": "9.39.4",
            "ecosystem": "npm"
          },
          {
            "name": "@eslint/object-schema",
            "direct": false,
            "version": "2.1.7",
            "ecosystem": "npm"
          },
          {
            "name": "@eslint/plugin-kit",
            "direct": false,
            "version": "0.4.1",
            "ecosystem": "npm"
          },
          {
            "name": "@humanfs/core",
            "direct": false,
            "version": "0.19.2",
            "ecosystem": "npm"
          },
          {
            "name": "@humanfs/node",
            "direct": false,
            "version": "0.16.8",
            "ecosystem": "npm"
          },
          {
            "name": "@humanfs/types",
            "direct": false,
            "version": "0.15.0",
            "ecosystem": "npm"
          },
          {
            "name": "@humanwhocodes/module-importer",
            "direct": false,
            "version": "1.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "@humanwhocodes/retry",
            "direct": false,
            "version": "0.4.3",
            "ecosystem": "npm"
          },
          {
            "name": "@jridgewell/gen-mapping",
            "direct": false,
            "version": "0.3.13",
            "ecosystem": "npm"
          },
          {
            "name": "@jridgewell/remapping",
            "direct": false,
            "version": "2.3.5",
            "ecosystem": "npm"
          },
          {
            "name": "@jridgewell/resolve-uri",
            "direct": false,
            "version": "3.1.2",
            "ecosystem": "npm"
          },
          {
            "name": "@jridgewell/sourcemap-codec",
            "direct": false,
            "version": "1.5.5",
            "ecosystem": "npm"
          },
          {
            "name": "@jridgewell/trace-mapping",
            "direct": false,
            "version": "0.3.31",
            "ecosystem": "npm"
          },
          {
            "name": "@types/estree",
            "direct": false,
            "version": "1.0.9",
            "ecosystem": "npm"
          },
          {
            "name": "@types/json-schema",
            "direct": false,
            "version": "7.0.15",
            "ecosystem": "npm"
          },
          {
            "name": "acorn",
            "direct": false,
            "version": "8.17.0",
            "ecosystem": "npm"
          },
          {
            "name": "acorn-jsx",
            "direct": false,
            "version": "5.3.2",
            "ecosystem": "npm"
          },
          {
            "name": "ajv",
            "direct": false,
            "version": "6.15.0",
            "ecosystem": "npm"
          },
          {
            "name": "ansi-align",
            "direct": false,
            "version": "3.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "ansi-regex",
            "direct": false,
            "version": "5.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "ansi-regex",
            "direct": false,
            "version": "6.2.2",
            "ecosystem": "npm"
          },
          {
            "name": "ansi-styles",
            "direct": false,
            "version": "4.3.0",
            "ecosystem": "npm"
          },
          {
            "name": "ansi-styles",
            "direct": false,
            "version": "6.2.3",
            "ecosystem": "npm"
          },
          {
            "name": "argparse",
            "direct": false,
            "version": "2.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "array-buffer-byte-length",
            "direct": false,
            "version": "1.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "array-includes",
            "direct": false,
            "version": "3.1.9",
            "ecosystem": "npm"
          },
          {
            "name": "array.prototype.findlast",
            "direct": false,
            "version": "1.2.5",
            "ecosystem": "npm"
          },
          {
            "name": "array.prototype.flat",
            "direct": false,
            "version": "1.3.3",
            "ecosystem": "npm"
          },
          {
            "name": "array.prototype.flatmap",
            "direct": false,
            "version": "1.3.3",
            "ecosystem": "npm"
          },
          {
            "name": "array.prototype.tosorted",
            "direct": false,
            "version": "1.1.4",
            "ecosystem": "npm"
          },
          {
            "name": "arraybuffer.prototype.slice",
            "direct": false,
            "version": "1.0.4",
            "ecosystem": "npm"
          },
          {
            "name": "async-function",
            "direct": false,
            "version": "1.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "available-typed-arrays",
            "direct": false,
            "version": "1.0.7",
            "ecosystem": "npm"
          },
          {
            "name": "balanced-match",
            "direct": false,
            "version": "1.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "baseline-browser-mapping",
            "direct": false,
            "version": "2.10.40",
            "ecosystem": "npm"
          },
          {
            "name": "brace-expansion",
            "direct": false,
            "version": "1.1.16",
            "ecosystem": "npm"
          },
          {
            "name": "browserslist",
            "direct": false,
            "version": "4.28.4",
            "ecosystem": "npm"
          },
          {
            "name": "call-bind",
            "direct": false,
            "version": "1.0.9",
            "ecosystem": "npm"
          },
          {
            "name": "call-bind-apply-helpers",
            "direct": false,
            "version": "1.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "call-bound",
            "direct": false,
            "version": "1.0.4",
            "ecosystem": "npm"
          },
          {
            "name": "callsites",
            "direct": false,
            "version": "3.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "camelcase",
            "direct": false,
            "version": "8.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "caniuse-lite",
            "direct": false,
            "version": "1.0.30001799",
            "ecosystem": "npm"
          },
          {
            "name": "chalk",
            "direct": false,
            "version": "4.1.2",
            "ecosystem": "npm"
          },
          {
            "name": "chalk",
            "direct": false,
            "version": "5.6.2",
            "ecosystem": "npm"
          },
          {
            "name": "cli-boxes",
            "direct": false,
            "version": "3.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "color-convert",
            "direct": false,
            "version": "2.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "color-name",
            "direct": false,
            "version": "1.1.4",
            "ecosystem": "npm"
          },
          {
            "name": "concat-map",
            "direct": false,
            "version": "0.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "convert-source-map",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "data-view-buffer",
            "direct": false,
            "version": "1.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "data-view-byte-length",
            "direct": false,
            "version": "1.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "data-view-byte-offset",
            "direct": false,
            "version": "1.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "debug",
            "direct": false,
            "version": "4.4.3",
            "ecosystem": "npm"
          },
          {
            "name": "deep-is",
            "direct": false,
            "version": "0.1.4",
            "ecosystem": "npm"
          },
          {
            "name": "define-data-property",
            "direct": false,
            "version": "1.1.4",
            "ecosystem": "npm"
          },
          {
            "name": "define-properties",
            "direct": false,
            "version": "1.2.1",
            "ecosystem": "npm"
          },
          {
            "name": "doctrine",
            "direct": false,
            "version": "2.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "dunder-proto",
            "direct": false,
            "version": "1.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "electron-to-chromium",
            "direct": false,
            "version": "1.5.381",
            "ecosystem": "npm"
          },
          {
            "name": "emoji-regex",
            "direct": false,
            "version": "10.6.0",
            "ecosystem": "npm"
          },
          {
            "name": "emoji-regex",
            "direct": false,
            "version": "8.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "es-abstract",
            "direct": false,
            "version": "1.24.2",
            "ecosystem": "npm"
          },
          {
            "name": "es-abstract-get",
            "direct": false,
            "version": "1.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "es-define-property",
            "direct": false,
            "version": "1.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "es-errors",
            "direct": false,
            "version": "1.3.0",
            "ecosystem": "npm"
          },
          {
            "name": "es-iterator-helpers",
            "direct": false,
            "version": "1.3.3",
            "ecosystem": "npm"
          },
          {
            "name": "es-object-atoms",
            "direct": false,
            "version": "1.1.2",
            "ecosystem": "npm"
          },
          {
            "name": "es-set-tostringtag",
            "direct": false,
            "version": "2.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "es-shim-unscopables",
            "direct": false,
            "version": "1.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "es-to-primitive",
            "direct": false,
            "version": "1.3.4",
            "ecosystem": "npm"
          },
          {
            "name": "escalade",
            "direct": false,
            "version": "3.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "escape-string-regexp",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "eslint",
            "direct": false,
            "version": "9.39.4",
            "ecosystem": "npm"
          },
          {
            "name": "eslint-plugin-react",
            "direct": false,
            "version": "7.37.5",
            "ecosystem": "npm"
          },
          {
            "name": "eslint-plugin-react-hooks",
            "direct": false,
            "version": "7.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "eslint-scope",
            "direct": false,
            "version": "8.4.0",
            "ecosystem": "npm"
          },
          {
            "name": "eslint-visitor-keys",
            "direct": false,
            "version": "3.4.3",
            "ecosystem": "npm"
          },
          {
            "name": "eslint-visitor-keys",
            "direct": false,
            "version": "4.2.1",
            "ecosystem": "npm"
          },
          {
            "name": "espree",
            "direct": false,
            "version": "10.4.0",
            "ecosystem": "npm"
          },
          {
            "name": "esquery",
            "direct": false,
            "version": "1.7.0",
            "ecosystem": "npm"
          },
          {
            "name": "esrecurse",
            "direct": false,
            "version": "4.3.0",
            "ecosystem": "npm"
          },
          {
            "name": "estraverse",
            "direct": false,
            "version": "5.3.0",
            "ecosystem": "npm"
          },
          {
            "name": "esutils",
            "direct": false,
            "version": "2.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "fast-check",
            "direct": false,
            "version": "4.9.0",
            "ecosystem": "npm"
          },
          {
            "name": "fast-deep-equal",
            "direct": false,
            "version": "3.1.3",
            "ecosystem": "npm"
          },
          {
            "name": "fast-json-stable-stringify",
            "direct": false,
            "version": "2.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "fast-levenshtein",
            "direct": false,
            "version": "2.0.6",
            "ecosystem": "npm"
          },
          {
            "name": "file-entry-cache",
            "direct": false,
            "version": "8.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "find-up",
            "direct": false,
            "version": "5.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "flat-cache",
            "direct": false,
            "version": "4.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "flatted",
            "direct": false,
            "version": "3.4.2",
            "ecosystem": "npm"
          },
          {
            "name": "for-each",
            "direct": false,
            "version": "0.3.5",
            "ecosystem": "npm"
          },
          {
            "name": "function-bind",
            "direct": false,
            "version": "1.1.2",
            "ecosystem": "npm"
          },
          {
            "name": "function.prototype.name",
            "direct": false,
            "version": "1.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "functions-have-names",
            "direct": false,
            "version": "1.2.3",
            "ecosystem": "npm"
          },
          {
            "name": "generator-function",
            "direct": false,
            "version": "2.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "gensync",
            "direct": false,
            "version": "1.0.0-beta.2",
            "ecosystem": "npm"
          },
          {
            "name": "get-east-asian-width",
            "direct": false,
            "version": "1.6.0",
            "ecosystem": "npm"
          },
          {
            "name": "get-intrinsic",
            "direct": false,
            "version": "1.3.0",
            "ecosystem": "npm"
          },
          {
            "name": "get-proto",
            "direct": false,
            "version": "1.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "get-symbol-description",
            "direct": false,
            "version": "1.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "glob-parent",
            "direct": false,
            "version": "6.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "globals",
            "direct": false,
            "version": "14.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "globals",
            "direct": false,
            "version": "17.7.0",
            "ecosystem": "npm"
          },
          {
            "name": "globalthis",
            "direct": false,
            "version": "1.0.4",
            "ecosystem": "npm"
          },
          {
            "name": "gopd",
            "direct": false,
            "version": "1.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "has-bigints",
            "direct": false,
            "version": "1.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "has-flag",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "has-property-descriptors",
            "direct": false,
            "version": "1.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "has-proto",
            "direct": false,
            "version": "1.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "has-symbols",
            "direct": false,
            "version": "1.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "has-tostringtag",
            "direct": false,
            "version": "1.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "hasown",
            "direct": false,
            "version": "2.0.4",
            "ecosystem": "npm"
          },
          {
            "name": "hermes-estree",
            "direct": false,
            "version": "0.25.1",
            "ecosystem": "npm"
          },
          {
            "name": "hermes-parser",
            "direct": false,
            "version": "0.25.1",
            "ecosystem": "npm"
          },
          {
            "name": "ignore",
            "direct": false,
            "version": "5.3.2",
            "ecosystem": "npm"
          },
          {
            "name": "import-fresh",
            "direct": false,
            "version": "3.3.1",
            "ecosystem": "npm"
          },
          {
            "name": "imurmurhash",
            "direct": false,
            "version": "0.1.4",
            "ecosystem": "npm"
          },
          {
            "name": "internal-slot",
            "direct": false,
            "version": "1.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "is-array-buffer",
            "direct": false,
            "version": "3.0.5",
            "ecosystem": "npm"
          },
          {
            "name": "is-async-function",
            "direct": false,
            "version": "2.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "is-bigint",
            "direct": false,
            "version": "1.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "is-boolean-object",
            "direct": false,
            "version": "1.2.2",
            "ecosystem": "npm"
          },
          {
            "name": "is-callable",
            "direct": false,
            "version": "1.2.7",
            "ecosystem": "npm"
          },
          {
            "name": "is-core-module",
            "direct": false,
            "version": "2.16.2",
            "ecosystem": "npm"
          },
          {
            "name": "is-data-view",
            "direct": false,
            "version": "1.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "is-date-object",
            "direct": false,
            "version": "1.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "is-document.all",
            "direct": false,
            "version": "1.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "is-extglob",
            "direct": false,
            "version": "2.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "is-finalizationregistry",
            "direct": false,
            "version": "1.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "is-fullwidth-code-point",
            "direct": false,
            "version": "3.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "is-generator-function",
            "direct": false,
            "version": "1.1.2",
            "ecosystem": "npm"
          },
          {
            "name": "is-glob",
            "direct": false,
            "version": "4.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "is-map",
            "direct": false,
            "version": "2.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "is-negative-zero",
            "direct": false,
            "version": "2.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "is-number-object",
            "direct": false,
            "version": "1.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "is-regex",
            "direct": false,
            "version": "1.2.1",
            "ecosystem": "npm"
          },
          {
            "name": "is-set",
            "direct": false,
            "version": "2.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "is-shared-array-buffer",
            "direct": false,
            "version": "1.0.4",
            "ecosystem": "npm"
          },
          {
            "name": "is-string",
            "direct": false,
            "version": "1.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "is-symbol",
            "direct": false,
            "version": "1.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "is-typed-array",
            "direct": false,
            "version": "1.1.15",
            "ecosystem": "npm"
          },
          {
            "name": "is-weakmap",
            "direct": false,
            "version": "2.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "is-weakref",
            "direct": false,
            "version": "1.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "is-weakset",
            "direct": false,
            "version": "2.0.4",
            "ecosystem": "npm"
          },
          {
            "name": "isarray",
            "direct": false,
            "version": "2.0.5",
            "ecosystem": "npm"
          },
          {
            "name": "isexe",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "iterator.prototype",
            "direct": false,
            "version": "1.1.5",
            "ecosystem": "npm"
          },
          {
            "name": "js-tokens",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "jsesc",
            "direct": false,
            "version": "3.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "json-buffer",
            "direct": false,
            "version": "3.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "json-schema-traverse",
            "direct": false,
            "version": "0.4.1",
            "ecosystem": "npm"
          },
          {
            "name": "json-stable-stringify-without-jsonify",
            "direct": false,
            "version": "1.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "json5",
            "direct": false,
            "version": "2.2.3",
            "ecosystem": "npm"
          },
          {
            "name": "jsx-ast-utils",
            "direct": false,
            "version": "3.3.5",
            "ecosystem": "npm"
          },
          {
            "name": "keyv",
            "direct": false,
            "version": "4.5.4",
            "ecosystem": "npm"
          },
          {
            "name": "levn",
            "direct": false,
            "version": "0.4.1",
            "ecosystem": "npm"
          },
          {
            "name": "locate-path",
            "direct": false,
            "version": "6.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "lodash.merge",
            "direct": false,
            "version": "4.6.2",
            "ecosystem": "npm"
          },
          {
            "name": "loose-envify",
            "direct": false,
            "version": "1.4.0",
            "ecosystem": "npm"
          },
          {
            "name": "lru-cache",
            "direct": false,
            "version": "5.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "math-intrinsics",
            "direct": false,
            "version": "1.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "minimatch",
            "direct": false,
            "version": "3.1.5",
            "ecosystem": "npm"
          },
          {
            "name": "ms",
            "direct": false,
            "version": "2.1.3",
            "ecosystem": "npm"
          },
          {
            "name": "natural-compare",
            "direct": false,
            "version": "1.4.0",
            "ecosystem": "npm"
          },
          {
            "name": "node-exports-info",
            "direct": false,
            "version": "1.6.2",
            "ecosystem": "npm"
          },
          {
            "name": "node-releases",
            "direct": false,
            "version": "2.0.50",
            "ecosystem": "npm"
          },
          {
            "name": "object-assign",
            "direct": false,
            "version": "4.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "object-inspect",
            "direct": false,
            "version": "1.13.4",
            "ecosystem": "npm"
          },
          {
            "name": "object-keys",
            "direct": false,
            "version": "1.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "object.assign",
            "direct": false,
            "version": "4.1.7",
            "ecosystem": "npm"
          },
          {
            "name": "object.entries",
            "direct": false,
            "version": "1.1.9",
            "ecosystem": "npm"
          },
          {
            "name": "object.fromentries",
            "direct": false,
            "version": "2.0.8",
            "ecosystem": "npm"
          },
          {
            "name": "object.values",
            "direct": false,
            "version": "1.2.1",
            "ecosystem": "npm"
          },
          {
            "name": "optionator",
            "direct": false,
            "version": "0.9.4",
            "ecosystem": "npm"
          },
          {
            "name": "own-keys",
            "direct": false,
            "version": "1.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "p-limit",
            "direct": false,
            "version": "3.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "p-locate",
            "direct": false,
            "version": "5.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "parent-module",
            "direct": false,
            "version": "1.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "path-exists",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "path-key",
            "direct": false,
            "version": "3.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "path-parse",
            "direct": false,
            "version": "1.0.7",
            "ecosystem": "npm"
          },
          {
            "name": "possible-typed-array-names",
            "direct": false,
            "version": "1.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "prelude-ls",
            "direct": false,
            "version": "1.2.1",
            "ecosystem": "npm"
          },
          {
            "name": "prettier",
            "direct": false,
            "version": "3.9.5",
            "ecosystem": "npm"
          },
          {
            "name": "prop-types",
            "direct": false,
            "version": "15.8.1",
            "ecosystem": "npm"
          },
          {
            "name": "punycode",
            "direct": false,
            "version": "2.3.1",
            "ecosystem": "npm"
          },
          {
            "name": "pure-rand",
            "direct": false,
            "version": "8.4.1",
            "ecosystem": "npm"
          },
          {
            "name": "react-is",
            "direct": false,
            "version": "16.13.1",
            "ecosystem": "npm"
          },
          {
            "name": "reflect.getprototypeof",
            "direct": false,
            "version": "1.0.10",
            "ecosystem": "npm"
          },
          {
            "name": "regexp.prototype.flags",
            "direct": false,
            "version": "1.5.4",
            "ecosystem": "npm"
          },
          {
            "name": "resolve",
            "direct": false,
            "version": "2.0.0-next.7",
            "ecosystem": "npm"
          },
          {
            "name": "resolve-from",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "safe-array-concat",
            "direct": false,
            "version": "1.1.4",
            "ecosystem": "npm"
          },
          {
            "name": "safe-push-apply",
            "direct": false,
            "version": "1.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "safe-regex-test",
            "direct": false,
            "version": "1.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "semver",
            "direct": false,
            "version": "6.3.1",
            "ecosystem": "npm"
          },
          {
            "name": "set-function-length",
            "direct": false,
            "version": "1.2.2",
            "ecosystem": "npm"
          },
          {
            "name": "set-function-name",
            "direct": false,
            "version": "2.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "set-proto",
            "direct": false,
            "version": "1.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "shebang-command",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "shebang-regex",
            "direct": false,
            "version": "3.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "side-channel",
            "direct": false,
            "version": "1.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "side-channel-list",
            "direct": false,
            "version": "1.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "side-channel-map",
            "direct": false,
            "version": "1.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "side-channel-weakmap",
            "direct": false,
            "version": "1.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "stop-iteration-iterator",
            "direct": false,
            "version": "1.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "string-width",
            "direct": false,
            "version": "4.2.3",
            "ecosystem": "npm"
          },
          {
            "name": "string-width",
            "direct": false,
            "version": "7.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "string.prototype.matchall",
            "direct": false,
            "version": "4.0.12",
            "ecosystem": "npm"
          },
          {
            "name": "string.prototype.repeat",
            "direct": false,
            "version": "1.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "string.prototype.trim",
            "direct": false,
            "version": "1.2.11",
            "ecosystem": "npm"
          },
          {
            "name": "string.prototype.trimend",
            "direct": false,
            "version": "1.0.10",
            "ecosystem": "npm"
          },
          {
            "name": "string.prototype.trimstart",
            "direct": false,
            "version": "1.0.8",
            "ecosystem": "npm"
          },
          {
            "name": "strip-ansi",
            "direct": false,
            "version": "6.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "strip-ansi",
            "direct": false,
            "version": "7.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "strip-json-comments",
            "direct": false,
            "version": "3.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "supports-color",
            "direct": false,
            "version": "7.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "supports-preserve-symlinks-flag",
            "direct": false,
            "version": "1.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "type-check",
            "direct": false,
            "version": "0.4.0",
            "ecosystem": "npm"
          },
          {
            "name": "type-fest",
            "direct": false,
            "version": "4.41.0",
            "ecosystem": "npm"
          },
          {
            "name": "typed-array-buffer",
            "direct": false,
            "version": "1.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "typed-array-byte-length",
            "direct": false,
            "version": "1.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "typed-array-byte-offset",
            "direct": false,
            "version": "1.0.4",
            "ecosystem": "npm"
          },
          {
            "name": "typed-array-length",
            "direct": false,
            "version": "1.0.8",
            "ecosystem": "npm"
          },
          {
            "name": "unbox-primitive",
            "direct": false,
            "version": "1.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "update-browserslist-db",
            "direct": false,
            "version": "1.2.3",
            "ecosystem": "npm"
          },
          {
            "name": "uri-js",
            "direct": false,
            "version": "4.4.1",
            "ecosystem": "npm"
          },
          {
            "name": "which",
            "direct": false,
            "version": "2.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "which-boxed-primitive",
            "direct": false,
            "version": "1.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "which-builtin-type",
            "direct": false,
            "version": "1.2.1",
            "ecosystem": "npm"
          },
          {
            "name": "which-collection",
            "direct": false,
            "version": "1.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "which-typed-array",
            "direct": false,
            "version": "1.1.22",
            "ecosystem": "npm"
          },
          {
            "name": "widest-line",
            "direct": false,
            "version": "5.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "word-wrap",
            "direct": false,
            "version": "1.2.5",
            "ecosystem": "npm"
          },
          {
            "name": "wrap-ansi",
            "direct": false,
            "version": "9.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "yallist",
            "direct": false,
            "version": "3.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "yarn",
            "direct": false,
            "version": "1.22.22",
            "ecosystem": "npm"
          },
          {
            "name": "yocto-queue",
            "direct": false,
            "version": "0.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "zod",
            "direct": false,
            "version": "4.4.3",
            "ecosystem": "npm"
          },
          {
            "name": "zod-validation-error",
            "direct": false,
            "version": "4.0.2",
            "ecosystem": "npm"
          }
        ],
        "collected": true,
        "truncated": false,
        "total_count": 268,
        "direct_count": 4,
        "indirect_count": 264
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 2,
        "merged_prs": 137,
        "open_issues": 47,
        "closed_ratio": 0.678,
        "closed_issues": 99,
        "closed_unmerged_prs": 11
      },
      "bus_factor": 1,
      "bot_contributors": 2,
      "top_contributors": [
        {
          "type": "User",
          "login": "RoryGlenn",
          "commits": 480,
          "avatar_url": "https://avatars.githubusercontent.com/u/32777747?v=4"
        },
        {
          "type": "User",
          "login": "rahul-aravind-opti",
          "commits": 1,
          "avatar_url": "https://avatars.githubusercontent.com/u/38707271?v=4"
        }
      ],
      "contributors_sampled": 2,
      "top_contributor_share": 0.998
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "ci.yml",
        "codeql.yml",
        "publish.yml",
        "render-demo.yml",
        "repo-health.yml",
        "scorecard.yml"
      ],
      "has_docs_dir": true,
      "linter_configs": [
        "eslint.config.js"
      ],
      "has_editorconfig": false,
      "has_linter_config": true,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "package-lock.json"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 8,
            "reason": "branch protection is not maximal on development and all release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 10,
            "reason": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 5,
            "reason": "badge detected: Passing",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/29 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 0,
            "reason": "project has 0 contributing companies or organizations -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 10,
            "reason": "update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 10,
            "reason": "project is fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 0,
            "reason": "project was created within the last 90 days. Please review its contents carefully",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": 10,
            "reason": "packaging workflow detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 9,
            "reason": "dependency not pinned by hash detected -- score normalized to 9",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 9,
            "reason": "SAST tool detected but not run on all commits",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 10,
            "reason": "security policy file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": 5,
            "reason": "2 out of the last 4 releases have a total of 2 signed artifacts.",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 10,
            "reason": "GitHub workflow tokens follow principle of least privilege",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 10,
            "reason": "0 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "e8f7fa3b6d36998a4c3f34fb441eddc0fbf50218",
        "ran_at": "2026-07-22T13:30:21Z",
        "aggregate_score": 7.6,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": true,
      "has_security_policy": true,
      "has_dependabot_config": true
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-22T04:08:08Z",
      "oldest_open_prs": [
        {
          "number": 129,
          "created_at": "2026-07-12T20:11:54Z",
          "last_comment_at": "2026-07-20T15:24:29Z",
          "last_comment_author": "RoryGlenn"
        },
        {
          "number": 166,
          "created_at": "2026-07-14T13:03:00Z",
          "last_comment_at": "2026-07-20T15:24:30Z",
          "last_comment_author": "RoryGlenn"
        }
      ],
      "last_merged_pr_at": "2026-07-22T03:59:25Z",
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": [
        {
          "number": 81,
          "created_at": "2026-07-12T01:20:04Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 84,
          "created_at": "2026-07-12T02:24:47Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 86,
          "created_at": "2026-07-12T03:21:49Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 105,
          "created_at": "2026-07-12T18:31:13Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 106,
          "created_at": "2026-07-12T18:31:14Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 108,
          "created_at": "2026-07-12T18:31:16Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 109,
          "created_at": "2026-07-12T18:31:16Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 110,
          "created_at": "2026-07-12T18:31:17Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 112,
          "created_at": "2026-07-12T18:31:18Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 113,
          "created_at": "2026-07-12T18:31:19Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 114,
          "created_at": "2026-07-12T18:41:09Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 116,
          "created_at": "2026-07-12T18:41:10Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 118,
          "created_at": "2026-07-12T18:41:12Z",
          "last_comment_at": "2026-07-12T23:04:57Z",
          "last_comment_author": "RoryGlenn"
        },
        {
          "number": 119,
          "created_at": "2026-07-12T18:59:26Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 120,
          "created_at": "2026-07-12T19:01:07Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 121,
          "created_at": "2026-07-12T19:01:08Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 122,
          "created_at": "2026-07-12T19:01:09Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 123,
          "created_at": "2026-07-12T19:01:10Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 124,
          "created_at": "2026-07-12T19:01:10Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 125,
          "created_at": "2026-07-12T19:01:11Z",
          "last_comment_at": null,
          "last_comment_author": null
        }
      ]
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/RoryGlenn/commitment-issues",
    "host": "github.com",
    "name": "commitment-issues",
    "owner": "RoryGlenn"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "moderate",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 67,
      "inputs": {
        "security": 81,
        "vitality": 72,
        "community": 49,
        "governance": 54,
        "engineering": 84
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "good",
        "name": "Vitality",
        "value": 72,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "moderate",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 57,
            "inputs": {
              "commits_last_year": 489,
              "human_commit_share": 0.98,
              "days_since_last_push": 0,
              "active_weeks_last_year": 4
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 0 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 0
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "4/52 weeks with commits",
                "points": 2.8,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 4
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "489 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 489
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": null,
            "notes": [],
            "value": 95,
            "inputs": {
              "releases_count": 11,
              "latest_release_tag": "v3.4.0",
              "releases_from_tags": false,
              "days_since_latest_release": 5,
              "mean_days_between_releases": 1.3
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "11 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 11
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 5 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 5
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~1.3 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 1.3
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "2 out of the last 4 releases have a total of 2 signed artifacts.",
                "points": 5,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "at_risk",
        "name": "Community & Adoption",
        "value": 49,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 7,
            "inputs": {
              "forks": 3,
              "stars": 3,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "3 stars",
                "points": 4.9,
                "status": "partial",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 3
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "3 forks",
                "points": 2.5,
                "status": "partial",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 3
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "excellent",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 92,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": true,
              "has_issue_template": false,
              "has_code_of_conduct": true,
              "has_pull_request_template": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (MIT)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "MIT"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 18,
                "status": "met",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 13.5,
                "status": "met",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 6.3,
                "status": "met",
                "details": [],
                "max_points": 6.3
              }
            ]
          },
          {
            "key": "ecosystem_adoption",
            "band": "moderate",
            "name": "Ecosystem adoption (downloads)",
            "note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "registry_dependents"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 58,
            "inputs": {
              "packages": [
                "commitment-issues"
              ],
              "dependents": null,
              "ecosystems": "npm",
              "total_downloads": null,
              "monthly_downloads": 2971
            },
            "components": [
              {
                "key": "monthly_downloads",
                "name": "Monthly downloads",
                "detail": "2,971 downloads/month across npm",
                "points": 46.3,
                "status": "partial",
                "details": [
                  {
                    "code": "downloads_monthly",
                    "params": {
                      "count": 2971,
                      "ecosystems": "npm"
                    }
                  }
                ],
                "max_points": 80
              },
              {
                "key": "registry_dependents",
                "name": "Registry dependents",
                "detail": "not reported by this ecosystem",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_reported_by_this_ecosystem",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "moderate",
        "name": "Sustainability & Governance",
        "value": 54,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 12,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 2,
              "top_contributor_share": 0.998
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 100% of commits",
                "points": 0,
                "status": "partial",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 100
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "2 contributors",
                "points": 2.7,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 0 contributing companies or organizations -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "moderate",
            "name": "Issue & PR responsiveness",
            "note": null,
            "notes": [],
            "value": 67,
            "inputs": {
              "merged_prs": 137,
              "open_issues": 47,
              "closed_issues": 99,
              "issue_closed_ratio": 0.678,
              "closed_unmerged_prs": 11
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "68% of issues closed",
                "points": 31.7,
                "status": "partial",
                "details": [
                  {
                    "code": "issues_closed_share",
                    "params": {
                      "share": 68
                    }
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "137/148 decided PRs merged",
                "points": 35.4,
                "status": "partial",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 137,
                      "decided": 148
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/29 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "moderate",
            "name": "Ownership & stewardship",
            "note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "verified_domain"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 54,
            "inputs": {
              "followers": 13,
              "owner_type": "User",
              "is_verified": null,
              "owner_login": "RoryGlenn",
              "public_repos": 57,
              "account_age_days": 3203
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "personal (user) account",
                "points": 10,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_personal",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": "not applicable to user accounts",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_applicable_to_user_accounts",
                    "params": {}
                  }
                ],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "13 followers of RoryGlenn",
                "points": 8.2,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 13,
                      "login": "RoryGlenn"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "57 public repos, account ~8 yr old",
                "points": 24.8,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 57
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 8
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "commitment-issues"
              ],
              "ecosystems": "npm",
              "any_deprecated": false,
              "min_days_since_publish": 5
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on npm",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "npm"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 5 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 5
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "22 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 22
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "good",
        "name": "Engineering Quality",
        "value": 84,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "good",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 84,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": true,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "6 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 6
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": "eslint.config.js",
                "points": 16,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "eslint.config.js"
                    }
                  }
                ],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
                "points": 20,
                "status": "met",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "excellent",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "topics": [
                "developer-tools",
                "eslint",
                "git-hooks",
                "pre-commit",
                "prettier",
                "husky",
                "lint-staged"
              ],
              "has_wiki": true,
              "homepage": null,
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": "7 topics",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "topics_count",
                    "params": {
                      "count": 7
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "good",
        "name": "Security",
        "value": 81,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "good",
            "name": "Security posture",
            "note": null,
            "notes": [],
            "value": 76,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 18,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 0,
              "scorecard_aggregate": 7.6
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection is not maximal on development and all release branches",
                "points": 6,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "badge detected: Passing",
                "points": 1.2,
                "status": "partial",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/29 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 0 contributing companies or organizations -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "update tool detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is fuzzed",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 9",
                "points": 4.5,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool detected but not run on all commits",
                "points": 4.5,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "2 out of the last 4 releases have a total of 2 signed artifacts.",
                "points": 3.8,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "GitHub workflow tokens follow principle of least privilege",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "0 existing vulnerabilities detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "excellent",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 268 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "indirect_dependencies_free_of_known_advisories",
                    "no_advisories_left_outstanding"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_repository",
                "params": {
                  "assessed": 268
                }
              },
              {
                "code": "advisories_repo_graph_caveat",
                "params": {}
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "source": "osv",
              "advisories": 0,
              "affected_packages": 0,
              "assessed_packages": 268,
              "unassessed_packages": 0,
              "affected_by_severity": "none",
              "direct_affected_packages": 0
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "no direct dependency carries a known advisory",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "no_direct_advisories",
                    "params": {}
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "transitive set not separable from development and test dependencies in this scope",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_scope_not_separable",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory carries a publication date",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_no_publication_date",
                    "params": {}
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 268,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 1
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "moderate",
        "name": "AI Readiness",
        "value": 68,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "excellent",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 0.969,
              "agent_instruction_files": [
                ".github/copilot-instructions.md",
                "AGENTS.md",
                "CLAUDE.md"
              ],
              "agent_instruction_max_bytes": 10338
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": ".github/copilot-instructions.md, AGENTS.md, CLAUDE.md",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".github/copilot-instructions.md, AGENTS.md, CLAUDE.md"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "95 of 98 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 95,
                      "sampled": 98
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "moderate",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 60,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "package-lock.json"
              ],
              "has_dockerfile": false,
              "typed_language": false,
              "bootstrap_files": [],
              "has_devcontainer": false,
              "has_linter_config": true,
              "typecheck_configs": [],
              "agent_commit_share": 0,
              "toolchain_manifests": [],
              "dependency_bot_commit_share": 0.02
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": "eslint.config.js",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "eslint.config.js"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "no agent-authored commits among the last 100",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_authored_commits",
                    "params": {
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "2 of the last 100 commits are automated dependency updates",
                "points": 8,
                "status": "met",
                "details": [
                  {
                    "code": "dependency_bot_commits",
                    "params": {
                      "count": 2,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 9",
                "points": 9,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "moderate",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 53,
            "inputs": {
              "primary_language": "JavaScript",
              "largest_source_bytes": 180032,
              "source_files_sampled": 129,
              "oversized_source_files": 5
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "JavaScript without a type-check config",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_typecheck_config_language",
                    "params": {
                      "language": "JavaScript"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "5/129 source files over 60KB",
                "points": 52.9,
                "status": "partial",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 129,
                      "oversized": 5
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
    "deps.dev does not index npm:commitment-issues@3.4.0; advisories assessed against the repository dependency graph instead"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-22T13:30:40.064174Z",
  "schema_version": "0.26.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/r/RoryGlenn/commitment-issues.svg",
  "full_name": "RoryGlenn/commitment-issues",
  "license_state": "standard",
  "license_spdx": "MIT"
}