akua-dev / akua

The resolved dependency set could not be collected for this report: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository

Installing npm:@akua-dev/sdk@0.8.25 pulls in 16 packages, direct and transitive: 0 carry known advisories, of which 0 are direct dependencies.

No known advisories affect the assessed dependencies.

An advisory means the version recorded in the dependency graph falls inside an advisory’s affected range. Reachability is not analysed, and the graph includes development and test pins — a finding may concern tooling rather than shipped software.

{
  "data": {
    "repo": {
      "topics": [
        "devops",
        "helm",
        "infrastructure-as-code",
        "kcl",
        "kubernetes",
        "kustomize",
        "rust",
        "security",
        "webassembly",
        "agentic-infra",
        "aumakua"
      ],
      "is_fork": false,
      "size_kb": 22145,
      "has_wiki": true,
      "homepage": "https://cli.akua.dev",
      "languages": {
        "Go": 10777,
        "KCL": 5485,
        "HTML": 1658098,
        "Rust": 1744189,
        "Shell": 28709,
        "Dockerfile": 829,
        "JavaScript": 29217,
        "PowerShell": 4421,
        "TypeScript": 182905
      },
      "pushed_at": "2026-07-24T12:49:32Z",
      "created_at": "2026-04-17T10:49:09Z",
      "owner_type": "Organization",
      "updated_at": "2026-07-26T16:28:01Z",
      "description": "Replace bureaucratic YAML mass with high-energy, deterministic contracts. The Deno of Infra",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "Apache-2.0",
      "default_branch": "main",
      "license_spdx_raw": "Apache-2.0",
      "primary_language": "Rust",
      "significant_languages": [
        "Rust",
        "HTML"
      ]
    },
    "owner": {
      "blog": "https://akua.dev",
      "name": "Akua - Build autonomous companies ",
      "type": "Organization",
      "login": "akua-dev",
      "company": null,
      "location": "Germany",
      "followers": 11,
      "avatar_url": "https://avatars.githubusercontent.com/u/173261869?v=4",
      "created_at": "2024-06-19T11:06:33Z",
      "is_verified": null,
      "public_repos": 15,
      "account_age_days": 769
    },
    "license": {
      "state": "standard",
      "spdx_id": "Apache-2.0",
      "raw_spdx": "Apache-2.0",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.8.25",
          "kind": "patch",
          "published_at": "2026-07-11T23:50:28Z"
        },
        {
          "tag": "v0.8.24",
          "kind": "patch",
          "published_at": "2026-07-07T20:08:53Z"
        },
        {
          "tag": "v0.8.23",
          "kind": "patch",
          "published_at": "2026-06-23T12:14:59Z"
        },
        {
          "tag": "v0.8.22",
          "kind": "patch",
          "published_at": "2026-06-18T15:35:19Z"
        },
        {
          "tag": "v0.8.21",
          "kind": "patch",
          "published_at": "2026-06-12T18:19:39Z"
        },
        {
          "tag": "v0.8.20",
          "kind": "patch",
          "published_at": "2026-06-09T07:05:39Z"
        },
        {
          "tag": "v0.8.19",
          "kind": "patch",
          "published_at": "2026-06-01T08:55:56Z"
        },
        {
          "tag": "v0.8.18",
          "kind": "patch",
          "published_at": "2026-05-29T19:31:15Z"
        },
        {
          "tag": "v0.8.17",
          "kind": "patch",
          "published_at": "2026-05-29T17:37:06Z"
        },
        {
          "tag": "v0.8.16",
          "kind": "patch",
          "published_at": "2026-05-29T15:30:50Z"
        },
        {
          "tag": "v0.8.15",
          "kind": "patch",
          "published_at": "2026-05-29T14:22:03Z"
        },
        {
          "tag": "v0.8.14",
          "kind": "patch",
          "published_at": "2026-05-29T12:39:28Z"
        },
        {
          "tag": "v0.8.13",
          "kind": "patch",
          "published_at": "2026-05-20T19:44:51Z"
        },
        {
          "tag": "v0.8.11",
          "kind": "patch",
          "published_at": "2026-05-19T18:18:33Z"
        },
        {
          "tag": "v0.8.10",
          "kind": "patch",
          "published_at": "2026-05-16T15:06:57Z"
        },
        {
          "tag": "v0.8.8",
          "kind": "patch",
          "published_at": "2026-05-07T20:20:19Z"
        },
        {
          "tag": "v0.8.7",
          "kind": "patch",
          "published_at": "2026-05-07T13:33:15Z"
        },
        {
          "tag": "akua-v0.8.6",
          "kind": "other",
          "published_at": "2026-05-06T12:47:59Z"
        },
        {
          "tag": "akua-v0.8.5",
          "kind": "other",
          "published_at": "2026-05-04T22:42:25Z"
        },
        {
          "tag": "akua-v0.8.4",
          "kind": "other",
          "published_at": "2026-05-04T21:47:55Z"
        },
        {
          "tag": "akua-v0.8.3",
          "kind": "other",
          "published_at": "2026-04-29T17:45:12Z"
        },
        {
          "tag": "akua-v0.8.1",
          "kind": "other",
          "published_at": "2026-04-29T14:50:30Z"
        },
        {
          "tag": "akua-v0.8.0",
          "kind": "other",
          "published_at": "2026-04-29T12:12:18Z"
        },
        {
          "tag": "akua-v0.7.0",
          "kind": "other",
          "published_at": "2026-04-28T22:43:00Z"
        },
        {
          "tag": "akua-v0.6.0",
          "kind": "other",
          "published_at": "2026-04-28T09:04:03Z"
        },
        {
          "tag": "akua-v0.1.0",
          "kind": "other",
          "published_at": "2026-04-18T19:28:49Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "1b87537aaa2f3b1aa8f6bf5d8d41313511aee6ef",
          "body": "* fix(ci): stop napi prePublish from writing to the immutable Release\n\nThe `native-publish` job's `@akua-dev/native` publish runs its\n`prepublishOnly` hook (`napi prepublish`), which — beyond injecting the\nper-platform `optionalDependencies` and copying addons — attempted to\nupload the per-platform \n[…]\neak\ninstallation). Add a guard comment in the workflow and an AGENTS.md note\nso the hook is never \"fixed\" back to `--ignore-scripts`.\n\n* no-mistakes(document): Document native prepublish release guard",
          "is_bot": false,
          "headline": "fix(napi): prevent prepublish uploads to immutable releases (#83)",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-07-21T10:30:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "275b0d38dfaa5517e068f604660e7d8ac9356462",
          "body": "* fix(release): harden immutable tag recovery\n\n* no-mistakes(review): Bind release publication to immutable source and workflow SHAs\n\n* no-mistakes(document): Refresh release documentation and lint guards\n\n* fix(release): remove Akua core Homebrew ownership\n\n* no-mistakes(review): Harden SHA-bound r\n[…]\ncredential, or provider action was dispatched or used.\n\n* no-mistakes(review): Correct release artifact handoff documentation\n\n* no-mistakes(document): Document immutable assets and clean release lint",
          "is_bot": false,
          "headline": "fix: harden immutable release recovery (#69)",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-07-21T07:08:07Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "25ee8f73abccf1d4a8bc158ce6a76c518d376e5d",
          "body": "* fix(core): use canonical CLI error documentation URLs\n\n* test(site): keep error docs deployment triggers aligned\n\n* no-mistakes(review): fix CLI contract inputs error documentation route\n\n* no-mistakes(document): Refresh authoritative CLI and generated documentation",
          "is_bot": false,
          "headline": "fix(cli): use canonical error documentation URLs (#70)",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-07-13T07:12:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6452eb662445d2ad7c108128f93b9c55138729bb",
          "body": "…uth flows (#68)\n\n* fix(git): preserve configured CA with TLS verification\n\n* no-mistakes(review): Preserve Git CA without leaking ambient HTTP configuration\n\n* no-mistakes(document): Document Git HTTPS CA preservation\n\n* no-mistakes: apply CI fixes\n\n* no-mistakes: apply CI fixes\n\n* no-mistakes: apply CI fixes\n\n* no-mistakes: apply CI fixes\n\n* no-mistakes: apply CI fixes\n\n* no-mistakes: apply CI fixes",
          "is_bot": false,
          "headline": "fix(core): preserve configured Git HTTPS CA bundles during vendored a…",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-07-11T21:02:37Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c40aef40e911067340ed582071f56838a87bc402",
          "body": "Rationale: Package dependency stubs are compiled in the consumer render context. Keeping body-only imports and Akua UI decorators in those stubs can force consumers to resolve upstream render dependencies such as k8s, or fail on render-only decorators, before the real child package render runs. Code\n[…]\nll package_k module tests require helm-engine.wasm in this fresh worktree; package_k::tests::typed_chart_values_reach_helm_template_wrapper previously failed with the documented missing-artifact path.",
          "is_bot": false,
          "headline": "fix(core): keep package stubs schema-only (#66)",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-07-07T19:30:36Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d2ea88780195f315091eb4de46209e60b2d19740",
          "body": "Rationale: Move the SDK OCI inspection entry from Unreleased into the 0.8.23 section before tagging the release that CNAP will consume.\\n\\nRisk: Docs-only release metadata change; no runtime code paths changed.\\n\\nTested:\\n- mise exec -- task release:validate\\n- mise exec -- task sdk:check\\n- mise e\n[…]\nlease:check-workflows\\n\\nNot-tested: Full GitHub release workflow dry-run was not manually dispatched; release.yml already passed on main for the code commit and local release packaging checks passed.",
          "is_bot": false,
          "headline": "docs: prepare 0.8.23 release notes [skip ci]",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-23T11:39:07Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "21884a22e35ea3fcb9fb6eca3ccaf5485e49707f",
          "body": "Adds a server-callable SDK/NAPI path for inspecting published Akua OCI package artifacts without shelling out, extracting to disk, or reading ambient Docker/Akua credential files.\n\nRationale:\nExpose a stable SDK-first OCI package inspection contract before CNAP expands package import/create-version \n[…]\n.test.ts\n- cargo test -p akua-cli inspect_oci_package -- --nocapture\n- GitHub CI: Rust (fmt + clippy + test), SDK (bun + node WASI)\n\nNot-tested:\n- SDK/native package publish was intentionally not run.",
          "is_bot": false,
          "headline": "feat(sdk): inspect published OCI packages",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-23T10:19:36Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "dd71215fd6773a4db24ce98e8a4a53baa017ed51",
          "body": "fix: export KCL boolean defaults as JSON booleans",
          "is_bot": false,
          "headline": "Merge pull request #63 from cnap-tech/codex/export-boolean-defaults",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-18T14:10:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5995dfda4222a4c2905ad1dd64ffc151ba6bf057",
          "body": "Rationale: Codezero package input schemas use KCL boolean defaults for UI controls, and the exported JSON Schema must expose those defaults as JSON booleans rather than strings.\n\nRejected: Treating every KCL default as JSON text first leaves True/False as strings because KCL boolean literals are cap\n[…]\n/input.schema.json\\n- jq '{runtime_enabled: .properties.runtime_enabled.default, velorum_enabled: .properties.velorum_enabled.default}' /tmp/codezero-fixed-schema/input.schema.json\\n- git diff --check",
          "is_bot": false,
          "headline": "fix: export KCL boolean defaults as JSON booleans",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-18T13:38:11Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9f3ac47dd95a3044057b4b6ddf9a9226e1d61bb3",
          "body": "Rationale: release validation uses a live Helm repository example whose manifest and docs promise that a bare chart version is an exact pin. The resolver was passing bare versions directly to semver::VersionReq, which widened them to caret ranges and let newer upstream charts move the lock under the\n[…]\nching the public lockfile contract.\n\nTested: mise exec -- cargo test -p akua-core --lib --features helm-fetch helm_repo_fetcher::tests\n\nTested: mise exec -- cargo fmt --check\n\nTested: git diff --check",
          "is_bot": false,
          "headline": "fix(helm): treat bare repo versions as exact pins",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-12T17:31:28Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2d0ce8eaed976eef1d1192ad3a38c8d5f7cef3ca",
          "body": "Rationale: release validation hit a Bun install race because sdk:test ran sdk:install in parallel with native:install through native:build. Keeping sdk:install as a command preserves package availability before bun test without concurrent Bun workspace installs.\n\nRejected: leaving sdk:install as a d\n[…]\n release-gate failure.\n\nRisk: sdk:test may be slightly slower; behavior is otherwise unchanged.\n\nTested: mise exec -- task sdk:test; mise exec -- task --dry sdk:test; git diff --check -- Taskfile.yml.",
          "is_bot": false,
          "headline": "fix(task): serialize sdk test bun installs",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-12T17:02:58Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d38a8ab15c7daf4d993b03e83895b2b90b7c7fc3",
          "body": "Rationale: task ci runs clippy with -D warnings before release, and clippy rejects the explicit lifetime on resolve_required_token as needless.\n\nRisk: signature-only lifetime elision; Rust infers the same borrow from the only borrowed input.\n\nTested: cargo fmt --check; cargo test -p akua-cli api_config; cargo clippy -p akua-cli --all-targets -- -D warnings.\n\nNot-tested: full task ci after this commit; running next.",
          "is_bot": false,
          "headline": "fix(cli): elide hosted API token lifetime",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-12T16:41:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "adb9970c370e7b4ff46c1e30e867e5fc7fdf7820",
          "body": null,
          "is_bot": false,
          "headline": "docs: prepare 0.8.21 release notes [skip ci]",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-12T16:36:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3f9d064e2cc42e275f57a61fd221a35a66ff80fe",
          "body": "Rationale: publish public-safe CLI docs for akua api/api spec and record the OSS guardrail that local package workflows remain cloud-independent.\n\nRejected: no CodeZero production proof, secret/deploy notes, or internal cloud launch details in OSS docs.\n\nRisk: docs-only plus AGENTS guardrail; no run\n[…]\npackage examples/01-hello-webapp/package.k --format=openapi --json; cargo fmt --check; git diff --check -- AGENTS.md docs/cli.md; git diff --cached --check.\n\nNot-tested: full task ci / task preflight.",
          "is_bot": false,
          "headline": "docs: document hosted API bridge [skip ci]",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-12T12:53:51Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3916a26e0a089d764c87c52da35485606d9c8675",
          "body": "Rationale: complete the first bridge convenience command by routing akua api spec through the same hosted API request machinery as version-relative paths.\n\nRejected: no local filtering for partner, admin, or internal OpenAPI audiences; those remain unsupported until the platform serves authorized au\n[…]\n only.\n\nTested: cargo test -p akua-cli api_spec; cargo test -p akua-cli api; cargo fmt --check; git diff --check; git diff --cached --check.\n\nNot-tested: full task ci and real api.akua.dev spec fetch.",
          "is_bot": false,
          "headline": "feat(cli): fetch hosted API spec",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-12T12:44:12Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e1bd3d6e71b599fe3db85c3a6f2f3352b914c7b6",
          "body": "Rationale: complete the first executable akua api bridge slice by sending planned requests to the configured API base URL and mapping platform error envelopes to the CLI contract.\n\nRejected: no api spec implementation, hosted profile/login storage, or SDK binding in this slice; api spec remains the \n[…]\nkua-cli api; cargo fmt --check; git diff --check; git diff --cached --check.\n\nNot-tested: full task ci and real api.akua.dev calls; integration coverage uses httpmock to avoid production dependencies.",
          "is_bot": false,
          "headline": "feat(cli): execute hosted API requests",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-12T12:36:40Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ab2bfa8105f4a04638dcd479a12855410990a192",
          "body": "Rationale: add the first request-construction layer for the single akua CLI hosted API bridge before wiring network execution.\n\nRejected: no HTTP execution, no stored hosted login/profile state, and no NAPI or TypeScript SDK binding in this slice; the bridge remains CLI-only until the API execution \n[…]\n-token test-token; cargo run -q -p akua-cli -- api /workspaces --token test-token.\n\nNot-tested: full task ci and hosted API HTTP execution; execution is intentionally deferred to the next bridge task.",
          "is_bot": false,
          "headline": "feat(cli): plan hosted API requests",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-12T12:16:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "950c842a549c96309b6b5270e9c1ef65663c8c78",
          "body": "Rationale: establish token, base URL, workspace context, and hosted API error codes before wiring akua api request execution.\n\nRejected: no stored login/profile state, no OCI auth reuse, and no HTTP command execution in this slice; those would expand the first bridge beyond its planned foundation.\n\n\n[…]\nuild:render-worker; cargo fmt --check; git diff --check; git diff --cached --check.\n\nNot-tested: full task ci and end-to-end akua api HTTP execution; the command path is not implemented in this slice.",
          "is_bot": false,
          "headline": "feat(cli): add hosted API config resolution",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-12T11:42:02Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "20ff9b0248301e0b56913020a5e07668b2f72812",
          "body": "Rationale: Close the OSS-safe launch-readiness slice by keeping public SDK docs, generated site output, large render/export regressions, CLI/NAPI/SDK drift guards, and render-worker schema-default coverage aligned on one branch.\n\nRejected: Did not fold the contradictory-defaults render case into the\n[…]\nn; cargo fmt --check; git diff --check; git diff --cached --check.\n\nNot-tested: Full task ci / release:validate not run; this was scoped to focused OSS launch-hardening regressions and generated docs.",
          "is_bot": false,
          "headline": "test: finish Akua OSS launch hardening",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-12T11:10:35Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d32b9df64bc430d3265afbdf2b0c8956c257fdf7",
          "body": "Rationale: Some Helm values.schema.json files publish defaults that contradict their declared type. Akua lowered those defaults directly into generated KCL, which can create schema/default contradictions such as 'field: str = 80' and abort the KCL evaluator during render.\n\nRejected: Did not attempt \n[…]\nrgo test -p akua-cli --features cosign-verify,dev-watch --test helm_union_schema -- renders_chart_with_union_typed_schema_default --nocapture\n\nTested: cargo test -p akua-core\n\nTested: git diff --check",
          "is_bot": false,
          "headline": "fix(core): omit unsafe chart schema defaults",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-12T10:45:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "33048b54d4d7f63abb35fd05ff193b8fb07f457f",
          "body": "Rationale: Keep the public OSS SDK surface aligned with implemented package/render/export behavior before the Akua Cloud launch bridge work. The SDK docs now describe the current NAPI-backed package SDK instead of future cloud/client APIs, and regression coverage locks down large render summaries, e\n[…]\nrc/render.test.ts packages/sdk/src/ciGates.test.ts\n\nTested: bun test packages/sdk/src/ciGates.test.ts -t drift\n\nTested: bunx tsc --noEmit --project packages/sdk/tsconfig.json\n\nTested: git diff --check",
          "is_bot": false,
          "headline": "test: harden Akua SDK launch surface",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-12T10:45:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6101afa17e89b19ea1cdfe9d9db83830c8d51a3a",
          "body": null,
          "is_bot": false,
          "headline": "docs: point CLI docs at cli subdomain [skip ci]",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-10T07:54:46Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f83ddc608edad38181ba6660303919909f850784",
          "body": "Rationale: Publish the verified render timeout/stale-engine fix so downstream CNAP can depend on a durable @akua-dev SDK/native package instead of local overrides.\n\nRisk: This triggers the normal Akua release path once tagged. The code changes were already merged via PR #62 with Rust and SDK CI green; this commit only stamps version metadata and changelog.\n\nTested: git diff --check; cargo metadata --locked --format-version 1 --no-deps; cargo check -p source-hash.",
          "is_bot": false,
          "headline": "release: 0.8.20 — refresh render budget handling",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-09T06:27:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "df05f4e4d7468d635e405e352596ed87dfdb77cc",
          "body": "Rationale: CNAP platform renders exposed persistent nested engine sessions reusing expired Wasmtime epoch deadlines, and worker interrupt traps surfaced as generic KCL errors instead of timeout budget failures.\n\nThis refreshes per-call nested engine deadlines, routes interrupt traps to E_RENDER_BUDGET_DEADLINE with timeout exit code, and includes CI lint cleanups required by the current toolchain.\n\nTested: Akua CI Rust (fmt + clippy + test) and SDK (bun + node WASI) passed on PR #62.",
          "is_bot": false,
          "headline": "fix(render): refresh wasm engine deadlines",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-09T06:24:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b00ae6c7eafa58b46e9dc279a9d6c38bc0bf0629",
          "body": null,
          "is_bot": false,
          "headline": "Add higher quality logo (#61)",
          "author_name": "Marcus Klingler",
          "author_login": "marcus-klingler",
          "committed_at": "2026-06-08T22:56:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0f261d8d0c27228c7093a28362dc56026cf3da8b",
          "body": null,
          "is_bot": false,
          "headline": "release: 0.8.19 — helm-repo resolver tolerates v-prefixed chart versions",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-01T07:47:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "42aee1910ae09aea96d17675eb44a51c82208ffb",
          "body": "…skip only truly-malformed entries",
          "is_bot": false,
          "headline": "fix(helm-repo): tolerate leading-v chart versions (Helm-compatible), …",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-01T07:47:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0a21cc3958083991d535f7f5159418a7b6da2266",
          "body": null,
          "is_bot": false,
          "headline": "release: 0.8.18 — akua cache manages the helm chart cache",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T18:54:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d14c4f12b8499c9e95f850f8478231bcd0f2ec85",
          "body": "akua cache list, clear, and path now cover the helm chart cache\n($XDG_CACHE_HOME/akua/helm/) added with the helm-repo dep source.\nPreviously the cache grew unmanaged across deploys.\n\nChanges:\n- cache_inventory: add helm_root to CacheInventory, collect_helm\n  (layout: <helm_root>/<hex>/<chart-name>/ \n[…]\nua cache clear`; cache_scope ArgGroup\n  extended; ClearScope::All wired for the no-flag default.\n- docs/roadmap.md: update cache line to {oci,git,helm}.\n- CHANGELOG.md: fixed entry under [Unreleased].",
          "is_bot": false,
          "headline": "feat(cache): inventory + clear the helm chart cache",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T18:20:31Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "76ed8b7c9fdc171efca074ac9548b6fc1c90fccc",
          "body": "Match the accurate model (already in CLAUDE.md/security-model.md after\naudit #9): digest-pin is the universal verified-before-write gate;\ncosign/SLSA verification engages fail-closed when a key is configured.",
          "is_bot": false,
          "headline": "docs: reconcile 'verify by default' signing claim across README + docs",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T18:05:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "24881ff73ad0046fc7f06cf6d8022b4e12d1ef11",
          "body": "…ld/feature wiring, release batching",
          "is_bot": false,
          "headline": "docs(agents): capture session gotchas — napi 3-place sync, engine-bui…",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T18:01:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d9551caa8744bfafecc34f7bd8e2266175050d3c",
          "body": "AGENTS.md is the cross-tool standard; CLAUDE.md → AGENTS.md so Claude\nCode and other agents read one source.",
          "is_bot": false,
          "headline": "docs: make AGENTS.md canonical, CLAUDE.md a symlink to it",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T17:58:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "93d0d584cadb0910f2dcbac4aee73eac97134873",
          "body": null,
          "is_bot": false,
          "headline": "release: 0.8.17 — honor helm subchart condition/tags disabling",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T17:02:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "fd3732caaa94d0a6c6f4592cfc6fff9e92a117b3",
          "body": "…Dependencies\n\nrenderInternal went load -> ToRenderValues -> engine.Render and never\ncalled chartutil.ProcessDependencies, the Helm step that reads each\ndependency's condition/tags from the values and prunes disabled\nsubcharts. Upstream Helm runs it in pkg/action/install.go before\nToRenderValues. Be\n[…]\nional\nsubchart: sub.enabled=false omits sub-cm, sub.enabled=true includes it.\nFailed before the fix (sub-cm leaked), passes after.\n\nThe generated assets/helm-engine.wasm is gitignored; CI rebuilds it.",
          "is_bot": false,
          "headline": "fix(helm-engine): honor subchart condition/tags disabling via Process…",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T16:50:01Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ac9ce346a62c39adec8ea71209c43ed5dc088148",
          "body": null,
          "is_bot": false,
          "headline": "release: 0.8.16 — security audit hardening (all 17 findings remediated)",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T14:57:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "79aa75bd3bc0bf79bb404a599af212a861d18f6c",
          "body": "… fix stale preopen comment\n\nCloses the last 3 audit follow-ups (#9, #16, #17). --timeout now derives\nthe render worker's epoch deadline (was always the 6s default), with a\nunit test. CLAUDE.md's 'verify by default' wording now states the real\nmodel (digest-pin universal; cosign engages when a key is configured).\nWorker preopen doc comment corrected (preopens are read-only).",
          "is_bot": false,
          "headline": "fix(security): --timeout bounds worker epoch; reconcile signing docs;…",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T14:48:50Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ddb9087fd46833c2c2147d4cdf016f6a5c37ea1c",
          "body": null,
          "is_bot": false,
          "headline": "docs(security): mark audit findings remediated + changelog",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T14:36:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e92db226cea184d320769ccc1fdab9da14583e7c",
          "body": "…ifest\n\n`akua publish` previously appended the workspace `akua.toml` byte-for-byte\ninto the tarball that is digested, cosign-signed, and SLSA-attested. A\npublisher's `replace = { path = \"...\" }` (or replace on an oci/git dep) — a\nlocal fast-iteration override — therefore survived into the signed art\n[…]\nso dropping the local redirect removes\nnothing the consumer needs.\n\npublish.rs is unchanged — it already packs via\npack_workspace_with_vendored_deps, so the strip applies centrally before\ndigest/sign.",
          "is_bot": false,
          "headline": "fix(security): strip replace directives from the published+signed man…",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T14:28:56Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "df5de413bd0704a60795c19c125a103306e65bc1",
          "body": "…date helm chart name + OCI userinfo\n\n- Drop `Serialize` from `BasicAuth` (unused — `auth_parse` only deserializes\n  INTO `HostAuthMap`; nothing serializes it back out) and implement manual\n  `Debug` that replaces the password with `[REDACTED]`. Prevents any `{:?}`\n  on a containing struct (e.g. `Ve\n[…]\nuser:pass@host/...`) are\n  now rejected at parse time, completing the symmetry with the existing\n  git and helm-repo userinfo guards.\n\nAll four changes are covered by new TDD tests; 74 lib tests pass.",
          "is_bot": false,
          "headline": "fix(security): redact BasicAuth, canonicalize vendor source_ref, vali…",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T14:28:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "24e7a4ad797093ab2cc123e64d0dbdd3a2862f14",
          "body": "… reject scheme downgrade\n\nHarden the OCI/Helm/git fetch paths against malicious registries and\npoisoned environments:\n\n- oci_transport: char-boundary-safe error-body truncation (was a byte\n  slice that panicked when a multibyte char straddled byte 300); cap\n  response bodies via a streamed counting\n[…]\non tree-entry names before dest.join.\n\nFinding #5 was fixed in code (force_tls_verification), not merely\ndocumented — gix exposes per-connection transport options that win over\nthe env-derived config.",
          "is_bot": false,
          "headline": "fix(security): bound fetch buffering + decompression, fix utf8 panic,…",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T14:28:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6c4f5fc317daf23b63fa3503d4892afd4d108190",
          "body": "Engine Sessions (helm, kustomize) were created with no StoreLimits and\nset_epoch_deadline(i64::MAX as u64), making them effectively uncapped.\nA declared malicious chart with pathological templating could consume\nup to ~4 GiB of linear memory and run indefinitely on a shared host.\nNot a sandbox escap\n[…]\n_generous,\nengine_epoch_deadline_is_finite_and_generous), and a well-formed module\nwith the full allocator ABI still initializes under the new caps\n(init_with_resource_caps_succeeds_for_valid_module).",
          "is_bot": false,
          "headline": "fix(security): bound helm/kustomize engine memory + wall-clock",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T14:28:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "aad5b4f4bc9fbc1a094fe73cb347788898c52393",
          "body": "…KCL codegen\n\nA malicious values.schema.json could inject KCL via verbatim property\nnames or an unescaped triple-quote in descriptions. Validate names\nagainst the KCL identifier grammar and neutralize \"\"\" in descriptions.",
          "is_bot": false,
          "headline": "fix(security): escape untrusted chart schema names + descriptions in …",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T14:28:46Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7ebba58ccd9d9c238540fe43ddf3758ea1059691",
          "body": null,
          "is_bot": false,
          "headline": "docs(security): 2026-05-29 multi-reviewer security audit report",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T14:04:36Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e0d059a66729cdeed7a463339938c8a65c8b6944",
          "body": "Nested/inner-render scopes now build resolved_pkgs via enter_for_render\n(the path-removal work landed that); the 'nested deps resolution is a\nfollow-up' note was stale.",
          "is_bot": false,
          "headline": "docs(kcl_plugin): correct stale resolved_pkgs comment",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T13:46:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c74c3810b49aa56ca5e0d85f88459b0031a21a47",
          "body": null,
          "is_bot": false,
          "headline": "release: 0.8.15 — typed-only composition + Bun engine loader",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T13:43:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "23c396be4c166333d8ec68cfe30287d217cf2b78",
          "body": "The SDK's helm/kustomize rendering failed under Bun with\n'helm-engine.wasm not built': loader.js set process.env\nAKUA_NATIVE_ENGINES_DIR, but Bun doesn't propagate process.env writes\nto the OS environment that the addon's std::env::var_os reads (Node\ndoes). Add a programmatic engines-dir override (R\n[…]\nxposed as napi\nsetEnginesDir and called by loader.js with the resolved\n@akua-dev/native-engines dir. Verified: helm renders under Bun with no\nshell env var. Env var path retained for Node back-compat.",
          "is_bot": false,
          "headline": "fix(napi): load engines via programmatic setEnginesDir (Bun-safe)",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T13:39:25Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "bc118d4b035c6e673a129dda97b4bc53bedbf9c3",
          "body": "…form\n\nNested renders now resolve typed dep aliases against the frame's own\nakua.toml: render_opts enters each frame via RenderScope::enter_for_render,\nwhich derives both allowed_roots and the resolved_pkgs alias map from the\nframe's resolved charts (budget inheritance preserved). This lets a compos\n[…]\nher engines (kustomize.build, helm chart paths)\nare untouched.\n\nBREAKING CHANGE: pkg.render no longer accepts path; declare the sub-package\nunder [dependencies] and compose it via package = \"<alias>\".",
          "is_bot": false,
          "headline": "feat(pkg-render)!: typed-alias-only composition; remove untyped path …",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T13:01:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e9b019ccfaab0a822e2cccceb8fe22aee3b41055",
          "body": "… fixes",
          "is_bot": false,
          "headline": "docs(changelog): 0.8.14 — helm-repo deps, sub-package context, render…",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T12:36:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d21dbf7b1c3789ddb3c76c401e358f369927e84f",
          "body": "The SDK Akua.add() calls napi.add(), but NapiAddon (the hand-maintained\ntyped view of the addon in napi.ts) never declared it, so the release\nsdk-build's tsc --emitDeclarationOnly failed with TS2339. Add the\nsignature mirroring the napi NapiAddArgs shape.",
          "is_bot": false,
          "headline": "fix(sdk): declare add() on the NapiAddon interface",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T12:14:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d9605b58575dc094543c80e51123483ead51df95",
          "body": "…itory\n\nDemonstrates the `repo`/`chart`/`version` dependency source: podinfo 6.12.0\npulled from stefanprodan.github.io/podinfo, sha256-pinned in akua.lock.\nE2e test mirrors examples_kcl_ecosystem — #[ignore]-gated by default (live\nnetwork pull), wired into task release:validate alongside the other online\nexamples.",
          "is_bot": false,
          "headline": "docs(examples): add 14-helm-repo-dep — chart from an HTTPS Helm repos…",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T11:55:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "db92db846827b2d93b9aca4058f57e1d3d0dc354",
          "body": "… chart\n\nDemonstrates and regression-tests that `charts.*` context now propagates\ninto `pkgs.<alias>`-composed sub-packages: the root Package composes a\n`webserver` sub-package (via `import pkgs.webserver`) whose own `akua.toml`\ndeclares a local Helm chart dep (`nginx = { path = \"./vendor/nginx\" }`)\n[…]\nynthesized package stubs — those per-render synthetic modules only\nexist in the rendering package's context, never in the consumer's stub\ncompilation context. Adds a unit test that pins the behaviour.",
          "is_bot": false,
          "headline": "docs(examples): add 13-subpackage-helm — sub-package composing a Helm…",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T11:37:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "254e28fba1977da7df013a3956c46e53e005647c",
          "body": "Union JSON-Schema types now generate `T1 | T2` KCL annotations\n(nullable -> optional) instead of collapsing to the first member with a\npossibly-mismatched default, which aborted the evaluator. A field like\n{\"type\":[\"string\",\"integer\",\"null\"],\"default\":8080} previously\nemitted `port: str = 8080` — a contradictory annotation that packed the\nint default against a str type at schema instantiation and triggered a\nwasm abort even with values = {}.",
          "is_bot": false,
          "headline": "fix(values-schema): emit KCL unions for multi-type schema fields",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T11:15:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a71356592569e1d4999039b43b91d2f859a4d597",
          "body": "…ckages\n\n`pkg.render` (and the typed `import pkgs.x; x.render(...)` form that\ndispatches to it) now resolves the composed CHILD package's own\n`akua.toml` deps — Helm `charts.*` and KCL-ecosystem imports like\n`import k8s.api.apps.v1` — and registers them for the child eval.\nPreviously the handler cal\n[…]\nhe child's OWN `akua.lock`, not the parent's. Missing child\n`akua.toml` falls back to empty charts, preserving the pure-KCL\nsub-package path. Cycle/depth/wall-clock guards still run before\nresolution.",
          "is_bot": false,
          "headline": "feat(render): propagate external-package context into composed sub-pa…",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T11:05:47Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3a9df6b56ca1d2002ac03bafea9a52adc97f0850",
          "body": "…al identifier",
          "is_bot": false,
          "headline": "fix(render): prefix digit-leading dep names so kcl_ident yields a leg…",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T10:43:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9bcd8a35ab974a3e6c768c1513cead58bce48c60",
          "body": "The render worker wrote its entire JSON+YAML response to a host stdout pipe\ncapped at 1 MiB (MemoryOutputPipe::new(1 << 20)). Real charts overflow it —\nargo-cd 7.7.0 renders ~1.36 MB — so the guest's write_all failed with errno 29,\nsurfacing as an opaque `os error 29` (exit 3). traefik (~7 KB) and t\n[…]\nENDER_OUTPUT_TOO_LARGE code via the KclEval\nmarker table, with a split-the-Package suggestion — instead of os error 29.\n\nThe 64 KiB stderr cap is left as-is (deliberately small for structured errors).",
          "is_bot": false,
          "headline": "fix(worker): raise render-output cap above 1MiB + typed overflow error",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T10:34:49Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b7aa32140ca321b077aff99a631dab145bfe7c73",
          "body": "A dep keyed with a hyphen in akua.toml (e.g. [dependencies.cnpg-operator])\nmade akua write the synthetic chart/pkg module file under the literal name\n(cnpg-operator.k). KCL binds that module's symbols under cnpg-operator, but\n`-` is not a legal KCL identifier, so `import charts.cnpg_operator` resolv\n[…]\nerwriting one module.\n\nThe pkg-stub `package = \"...\"` lookup string keeps the original dep key\n(pkg.render keys its resolved-pkg map on the raw name); only the filename and\nimport alias are sanitized.",
          "is_bot": false,
          "headline": "fix(render): sanitize hyphenated dep names to KCL identifiers",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T10:34:36Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3aa7968e290a5107efda5d87cebd73e86d93962a",
          "body": null,
          "is_bot": false,
          "headline": "chore(gitignore): ignore .akua/cache resolver artifact",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T10:11:08Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e23bbef27524f895d495551f20ca0baca90cbb9c",
          "body": "Without this the shipped binary + napi addon compiled the\n`#[cfg(not(feature=\"helm-fetch\"))]` resolve_helm stub, so repo deps\nerrored at runtime despite passing feature-gated tests. Wired the same\nway git-fetch is (unconditional on the akua-core dep).",
          "is_bot": false,
          "headline": "build(cli,napi): enable helm-fetch feature on akua-core",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T09:53:46Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a3faead8e1fe612a55bb3b32c4fd694035b755c8",
          "body": "- docs/cli.md: rewrite `akua add` section to match the real CLI (flag-\n  based, not positional subcommand); add four-source table including\n  `--repo`/`--chart`; update `vendor add` note to mention helm deps.\n- docs/lockfile-format.md: add Helm-repo row to the dependency forms\n  table; update `sourc\n[…]\nsingle-line dep-shape sentence\n  with a four-source table and a `akua add --repo` usage example.\n- CHANGELOG.md: add `### Added` entry under `[Unreleased]` for the\n  HTTPS helm-repo dependency source.",
          "is_bot": false,
          "headline": "docs(helm-repo): document repo/chart dependency source",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T09:48:24Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c0d7f0e0a8c06d3258f9802c024d2d3e264ed8f7",
          "body": "Extend `akua add` with a fourth dependency source: HTTPS Helm repository.\n\n- clap: add `--repo` / `--chart` to `Commands::Add`; include `repo` in\n  the `source` ArgGroup so exactly-one-source validation holds.\n- `AddSource::Repo { repo, chart }` variant; `build_dependency`,\n  `source_label` (\"helm\")\n[…]\nclaration.\n- SDK: `AddOptions` / `AddOutput` types; `Akua.add(name, opts)` method.\n- Tests: `adds_helm_repo_dep_with_repo_chart_version` and\n  `helm_repo_source_label_is_helm` (all 10 add tests pass).",
          "is_bot": false,
          "headline": "feat(add): akua add --repo --chart helm-repo form + SDK",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T09:46:40Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "00e9753208456a2fbbf7cdfaf9a1eac327690a03",
          "body": null,
          "is_bot": false,
          "headline": "test(helm-repo): online fetch over local HTTP server + digest-pin guard",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T09:33:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "aa4ce83ea975daaff2f7e895a50d0ead92fafa3a",
          "body": "Verify a helm+<repo>#<chart> source string with a sha256 digest\nsurvives a TOML round-trip and passes digest validation — no\nLockedPackage schema change.",
          "is_bot": false,
          "headline": "test(lockfile): helm-repo source round-trip",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T09:28:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f7742859b95c781394156f11879c64f970ed3932",
          "body": "Take the chart dir name and locate the unpacked root at\n<dest>/<chart>/ (with an archive-root fallback) instead of scanning\nfor the single subdir holding Chart.yaml.",
          "is_bot": false,
          "headline": "fix(helm-repo): deterministic fetch_from_cache by chart dir name",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T09:28:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0670f83e0af109a53da69ea3fd4227a86f210c03",
          "body": "Route helm-repo deps through a new resolve_helm that mirrors resolve_oci:\nthe .tgz sha256 is the cache key, lockfile pin, and fetcher-verified\ndigest. Helm skips vendor-first (vendored-helm embedding is deferred).\nAdds the ChartResolveError::HelmFetch variant and an offline-from-cache\nresolver test.",
          "is_bot": false,
          "headline": "feat(helm-repo): ResolvedSource::Helm + resolver arm",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T09:28:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5a155899cba707962b2efa02ed2fbad973d4e710",
          "body": "…cache",
          "is_bot": false,
          "headline": "feat(helm-repo): http fetch + extract + content-digest pin + offline …",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T09:16:37Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "aa1e8ab9c5770e12965155c1dca287d15ba2b177",
          "body": null,
          "is_bot": false,
          "headline": "feat(helm-repo): resolve relative/absolute tarball URLs",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T09:15:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9099a9c8a442201be9dc6747db1b09fc3b920cb9",
          "body": null,
          "is_bot": false,
          "headline": "feat(helm-repo): semver version selection against index",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T09:14:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9ff4be93a5d0edabb0e41a082eff25dd0431b644",
          "body": null,
          "is_bot": false,
          "headline": "feat(helm-repo): index.yaml types + parser",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T09:13:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a26f20e36d07b6be23fb7bcc0b5091ed46f016ca",
          "body": "Adds `repo`/`chart` fields to `Dependency`, `DependencySource::Helm`,\n`DependencySpec::Helm { repo, chart, version }`, and three new\n`ManifestError` variants with stable error codes. Validation rejects\nmissing `chart`, missing `version`, and embedded userinfo in the repo\nURL. Exhaustiveness gaps in \n[…]\n-fetch returns\n`UnsupportedSource` until Tasks 4-9 wire the helm_repo_fetcher;\n`vendor_lock_source` panics (unreachable pre-fetcher); `resolve_source`\nreturns the new `VendorError::UnsupportedSource`.",
          "is_bot": false,
          "headline": "feat(manifest): repo/chart helm-repo dependency source + validation",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T09:11:26Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f1502949bc35182a38bf038ed42d9789a3338faf",
          "body": null,
          "is_bot": false,
          "headline": "feat(cli-contract): error codes for helm-repo dep validation",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T08:50:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9a1f1bdb89a43ebeeec77ce7a66d274c88263aaa",
          "body": null,
          "is_bot": false,
          "headline": "build(akua-core): add semver dep + helm-fetch feature",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T08:48:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9b4a5a750917b3f06f65f911c12a46b14f72656a",
          "body": null,
          "is_bot": false,
          "headline": "docs(plan): HTTPS helm-repo dependency implementation plan",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T08:44:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8854aa5fec3c01f7febcfc299a78c97670227193",
          "body": "Fourth akua.toml dependency source alongside oci/git/path: classic HTTPS\nHelm repositories (index.yaml + .tgz). Content-pinned like git deps\n(sha256 in akua.lock, verify-on-pull, no cosign), full scope including\nsemver-range resolution against index.yaml. Reuses the reqwest+rustls\ntransport, host_auth map, content-addressed cache, and vendor machinery.",
          "is_bot": false,
          "headline": "docs(spec): HTTPS helm-repo dependency source design",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T08:34:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "064c6f184877185521d91b910d3346f8121064d4",
          "body": "The embedded helm engine returns NOTES.txt (top-level and per-subchart)\namong its rendered files, but those are free-form usage prose, not\nmanifests — helm template keeps them out of the YAML stream. akua parsed\nevery returned file as YAML, so any chart whose notes contain lines like\n'kubectl logs .\n[…]\n.\n\nAdds parse_manifests + is_notes_file with a regression test, plus\nmulti-doc parser guards (block-scalar-with-empty-line, real 59-doc helm\nfixture) and propagates the 0.8.14 version into Cargo.lock.",
          "is_bot": false,
          "headline": "fix(helm): skip NOTES.txt instead of parsing it as YAML",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T08:17:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2972b28ae70cf17355e23a572966cae4ffc32f49",
          "body": "The release pipeline bumped package.json from the tag but never the Rust\nworkspace Cargo.toml, so binaries compiled with the committed version\n(0.8.8) regardless of tag. That string feeds akua -V, SLSA provenance,\nOCI annotations, and the HTTP user-agent — all stale on 0.8.9..0.8.13.\n\n- scripts/set-\n[…]\n with the detect-version tag.\n- cli-build smoke-test asserts akua -V == tag, failing the release on\n  any future injection regression.\n- bump committed Cargo.toml placeholder to 0.8.14 (next release).",
          "is_bot": false,
          "headline": "ci(release): derive Cargo version from git tag",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T07:28:42Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2641857b3528ae343533a79ed679d5613dfeaf41",
          "body": "Keep gix on curl transport for Git TLS config support, but enable vendored OpenSSL for git-fetch so release cross-builds do not depend on target system OpenSSL packages.",
          "is_bot": false,
          "headline": "fix(core): vendor curl OpenSSL for git transport",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-20T17:05:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f696d2477c6465fa6832f53bfa08f654b28b90d3",
          "body": "Switch gix Git fetches to the curl transport so Git-compatible TLS config is applied, and keep pre-push lightweight by default.",
          "is_bot": false,
          "headline": "Fix Git TLS trust for vendored sources",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-20T14:39:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4882d33509fd83c7cf6bf032f449ac1caecfa2c8",
          "body": "* fix(core): refresh stale git dependency caches\n\n* fix(core): allow gix credential callback lint",
          "is_bot": false,
          "headline": "fix(core): refresh stale git dependency caches (#58)",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-19T17:02:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "458398458ab77c58b954e6a14748d6fa73b33eec",
          "body": "* fix(core): render helm values schemas as valid kcl\n\n* fix(core): make helm values schema test render a resource",
          "is_bot": false,
          "headline": "fix(core): render Helm values schemas as valid KCL (#56)",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-19T17:02:37Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ecc1fe3e98b0e5d7d790d9ce21af658976825574",
          "body": "Install release deps before mutating package manifests to tag-pinned versions, and add release workflow ordering checks.",
          "is_bot": false,
          "headline": "fix(release): install deps before tag manifest pins",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-16T14:33:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9d603df28c778c7444481eacab5469847c7744b5",
          "body": "Allow Akua-published OCI package layers to resolve through vendor dependency fetches.",
          "is_bot": false,
          "headline": "fix(oci): let vendor fetch akua packages",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-16T13:32:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4ade6ec3a041eebe88b7fe9c80a592af4006beaa",
          "body": "* docs(readme): replace hero gif with motion piece + scrubbable terminal embed\n\nSix-scene composition at docs/assets/hero.mp4 (3.2 MB, 52 s, 1920×1080)\nwith a docs/assets/hero.gif fallback (1.9 MB, 960×540) for renderers\nthat don't support <video>. Scenes:\n\n  1. Wordmark + Typed/Signed/Sandboxed tag\n[…]\ne structural fact.\n- design/handoff/README.md: flag as historical artifact pointing at\n  the current production README; the inline \"replace with hero.gif\"\n  hint pre-dates the embedded-video approach.",
          "is_bot": false,
          "headline": "docs(readme): hero motion piece — Typed. Signed. Sandboxed. (#53)",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-13T13:28:42Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2de793c8cdf9bdedb0a935253acead4da7e01e04",
          "body": "The 0.8.8 release run failed sdk-build because crates/akua-napi/index.d.ts\nwas committed before NapiVendorAddArgs gained its `auth` field. tsc\ncaught it on the SDK call site at packages/sdk/src/mod.ts:433.\n\n- Regenerated index.d.ts via `task native:build` — picks up\n  NapiBasicAuth + auth?: Record<s\n[…]\n.8.8 (was 0.8.7-rc4 — stale from\n  a prior local napi build).\n- packages/sdk/src/napi.ts hand-mirrors the napi shape (deliberately,\n  per the file's own comment); added `auth` to vendorAdd's arg type.",
          "is_bot": false,
          "headline": "fix(napi): regenerate index.d.ts + sync sdk napi shim for vendor auth",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T19:51:38Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1733f36a45a1ea80920e81f01d59077109354e7a",
          "body": "- gix HTTPS transport: closure-based credential helper installed in\n  clone_bare runs host_auth::lookup on 401 retries; longest-prefix\n  match selects the credential, gix serializes it as Authorization:\n  Basic <b64> on the retry. Arc-shared map for cheap reuse across\n  configure_connection / set_cr\n[…]\n wrong-auth 401, longest-prefix\n  selection. No real network — fully hermetic.\n- New error page docs/errors/E_AUTH_PARSE.md covering all four CLI\n  --auth / --auth-file shape errors with remediations.",
          "is_bot": false,
          "headline": "release: 0.8.8 — host-keyed HTTPS basic auth for vendor add",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T19:07:12Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8d3e5b5773f182f2cade03212effb7491d0b2813",
          "body": "…dedicated E_AUTH_PARSE, drop stale TODO\n\n- Move url_has_userinfo from mod_file (private) to host_auth (pub)\n  and have mod_file::Dependency::validate call it. One implementation\n  of 'does this URL embed user:pass@'.\n- New error code E_AUTH_PARSE for --auth / --auth-file shape errors.\n  Was previou\n[…]\nrs it.\n\nFindings deferred to follow-ups: BasicAuth ↔ oci_auth::Credentials\nconsolidation (cross-feature-gate refactor), generic load_toml<T>\nhelper to absorb 4 open-coded loaders, HostAuthMap newtype.",
          "is_bot": false,
          "headline": "refactor(host-auth): simplify findings — dedupe url-userinfo helper, …",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T17:45:50Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7d3983bb12917ab6b289a3bcc8ecb05b3f546fd7",
          "body": "- docs/cli.md gains an \"Auth flags\" subsection under `akua vendor`\n  with --auth / --auth-file syntax, --auth-file TOML shape, and the\n  lockfile-canonicalization guarantee.\n- docs/sdk.md gains a \"Credentials — auth\" universal-option section\n  with longest-prefix examples (single-host + per-org scop\n[…]\nents the new auth surface,\n  lockfile canonicalization, and manifest hardening.\n\nSite regenerated via task site:gen — link checker green\n(101 pages, 0 broken links). Includes minor cargo fmt cleanups.",
          "is_bot": false,
          "headline": "docs(host-auth): cli.md, sdk.md, error page, CHANGELOG",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T17:34:31Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7b21f3d2ab9a7e8189262974e307b802f893103f",
          "body": "- New crates/akua-cli/src/auth_parse.rs: parses repeatable\n  `--auth <prefix>=<user>:<password>` strings + optional\n  `--auth-file <path>` (TOML, `[auth]` keyed by URL prefix).\n  Flag values override file entries on conflict (helm/docker\n  convention).\n- `akua vendor add` gains --auth (repeatable) +\n[…]\ng longest-prefix-match resolution.\n- 10 auth_parse unit tests cover pair parsing (incl. passwords\n  with `:` / `=`), empty-prefix / empty-username rejection,\n  TOML file loading, and merge precedence.",
          "is_bot": false,
          "headline": "feat(cli/napi): --auth flag, --auth-file, SDK auth parameter",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T17:27:37Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "70de755e820fc973e2ba3eb2e4ac9d9abcf9f5f7",
          "body": "Threads `auth: Option<&HostAuthMap>` through the public verb surface\ndown into git_fetcher::fetch and the gix transport. When the URL\nmatches an entry in the map (longest-prefix), the credential is sent\nas `Authorization: Basic <b64>` via gix's in-memory config override\n(`http.extraHeader`). Anonymo\n[…]\n7 lib tests + integration tests pass.\n\nbase64 + host_auth moved from feature-gated to always-built (~12 KB\non linker output) — host_auth::BasicAuth needs to be reachable from\nnon-git-fetch builds too.",
          "is_bot": false,
          "headline": "feat(git_fetcher): host-keyed HTTPS basic auth",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T17:19:53Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e3e776d4f0b0f2aef176da3823cff677523341c7",
          "body": "akua.toml is version-controlled; embedding 'user:pass@host' in a git\ndep URL would persist the credential into the lockfile + git\nhistory. Reject at parse time with a typed error.\n\n- New error code E_MANIFEST_GIT_USERINFO with rich message pointing\n  callers to the SDK auth parameter / CLI --auth fl\n[…]\nstructured_code() lets to_structured() route this\n  variant to the dedicated code instead of the generic\n  E_MANIFEST_PARSE bucket\n\nTwo new tests: rejects user:pass@ in authority; accepts '@' in path.",
          "is_bot": false,
          "headline": "feat(mod_file): reject git URLs with embedded credentials",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T17:01:45Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "bd959c70db246a35d3c69c80da403be12d4e7355",
          "body": "New module crates/akua-core/src/host_auth.rs:\n- BasicAuth { username, password } + to_authorization_header()\n- HostAuthMap = HashMap<String, BasicAuth>\n- lookup() — longest-URL-prefix match (path-segment-aware), matches\n  git's credential-helper / .npmrc resolution rule\n- canonicalize_url() — strips\n[…]\nso credentials never leak into akua.lock\n\nGated on the git-fetch feature; base64 dep activated alongside.\n13 unit tests covering prefix selection, path-segment boundaries,\ncanonicalization edge cases.",
          "is_bot": false,
          "headline": "feat(host_auth): URL-prefix-keyed credential map + canonicalization",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T17:01:36Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5c6f2e0bc13a2aa7e3ba8420515194361d513396",
          "body": "The sdk-staged tarball already contains dist/ pre-built by sdk-build in\nrelease.yml. Without --ignore-scripts, npm fires the package's\nprepublishOnly hook which re-runs `bun run build`, requiring bun on\nPATH and a fully-installed node_modules tree (transitive deps like\nfast-uri, fast-deep-equal). All wasted work, since the tarball is\nalready what we want to publish.",
          "is_bot": false,
          "headline": "fix(release-publish): npm publish --ignore-scripts for the SDK",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T15:14:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d647027a0c2b02e87078475e51b7fb947f30a447",
          "body": "…eds it)",
          "is_bot": false,
          "headline": "fix(release-publish): add bun setup to sdk-publish (prepublishOnly ne…",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T15:11:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7f215db3b66e72182914bcb64ccab885b1a5e5c2",
          "body": "`gh release download` was failing with 'not a git repository' because\nthe sdk-publish job has no actions/checkout step (intentional — the\nsdk staging tree is fully reconstructed from the asset tarball).\nExplicit --repo flag bypasses the git-config inference path.",
          "is_bot": false,
          "headline": "fix(release-publish): pass --repo so sdk-publish doesn't need a checkout",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T15:09:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a7096bb1b477810130c7b1617ae360642cbfe29a",
          "body": "…lease-publish.yml\n\nThe job's 'gh workflow run release-publish.yml' got HTTP 403:\n'Resource not accessible by integration' because the job-level\nGITHUB_TOKEN inherits the workflow permissions block, which only\nlisted contents/packages/id-token. Per Actions docs, dispatching a\nworkflow_dispatch event\n[…]\n step was right that the\nworkflow_dispatch event itself is exempt from the no-recursion\nrule — but the API call to register the dispatch still needs\nactions:write on the token. Fix in run 25497355509.",
          "is_bot": false,
          "headline": "fix(release): grant actions: write so trigger-publish can dispatch re…",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T13:35:21Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a850be6166c393cebe6b13dbcfb0fb33d6184344",
          "body": "…ploads\n\nRefactor commit ff5f076 used 'cli-*' as a defensive download-artifact\nfilter, but the cli-build job uploads with name 'akua-${{ matrix.target }}'.\nPattern matched zero artifacts → github-release + docker + homebrew-tap\nall failed with no matches found / file not found.\n\nConfirmed by run 25495656081 logs: 'Found 13 artifact(s); Filtering by\npattern cli-*; Total of 0 artifact(s) downloaded'.",
          "is_bot": false,
          "headline": "fix(release): pattern 'akua-*' (not 'cli-*') matches what cli-build u…",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T13:00:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c898e17bcb9c7cc6c7d3f5e3e4422154cec665b2",
          "body": null,
          "is_bot": false,
          "headline": "ci: skip CI on changes to scripts/check-site-links.ts (site-only)",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T12:53:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7dff06f8a0ed447a7c3a178e9b820fc07587821e",
          "body": "The `cli-contract.md §1.5` link (and similar) 404'd because the markdown\nrewriter only matched `.md$`, missing URLs with `#fragment`. While\nfixing that, audited every internal link in the generated site and found\n24 more broken — examples-gallery cross-links, agent-usage skill paths,\ncli.md `#akua-r\n[…]\nth filter so dead links fail the deploy.\n- `docs/sdk.md` — transport table rewritten. The SDK is NAPI-only;\n  the WASM + shell-out tiers were aspirational. Lists the 14 verbs\n  actually exposed today.",
          "is_bot": false,
          "headline": "fix(site): kill dead links + add a checker that fails CI on regression",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T12:47:48Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "397e9ce182e478ada2cd50ada6854b32606c1280",
          "body": null,
          "is_bot": false,
          "headline": "fix(docs/sdk): npm link missing @akua scope (was /package/-dev/sdk)",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T12:36:33Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "09530b3921fa1d04f2c65022b00910dbf544965a",
          "body": "…links\n\nThree design fixes:\n\n1. Landing is back to a tight, vertical-centered single column. The\n   prior \"logo hero + giant tagline\" pushed the install command well\n   below the fold; now `akua` headline + tagline sit ~6px apart and\n   the install pre block is the second visible element. Footer + D\n[…]\ne click target is consistent and the\n   text sits dead-center. Brand img dropped from 28→26 to better match\n   the text x-height.\n\nSidebar `top: 76px → 24px` since the topnav no longer reserves space.",
          "is_bot": false,
          "headline": "fix(site): tighter centered landing, scroll-fade topnav, aligned nav …",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T12:35:09Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ff5f076874f2fa78dd5b2e275e0af5622aee7aaa",
          "body": "`npm publish` is the most failure-prone step in the release pipeline\n(OIDC config drift, registry hiccups, version-pin mismatch, …). When\nit fails today, the only recovery path is to push a workflow fix and\nre-tag, which re-runs the full build matrix — hours of CI time for a\n3-line YAML fix.\n\nThis s\n[…]\nublish failure — without a pattern,\ndownload-artifact also pulls the docker job's auto-attached\n`cnap-tech~akua~<id>.dockerbuild` provenance artifact, whose\n`~`-containing name fails path validation).",
          "is_bot": false,
          "headline": "refactor(release): split publish into separately-dispatchable workflow",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T12:25:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        }
      ],
      "releases_count": 26,
      "commits_last_year": 523,
      "latest_release_at": "2026-07-11T23:50:28Z",
      "latest_release_tag": "v0.8.25",
      "releases_from_tags": false,
      "days_since_last_push": 4,
      "active_weeks_last_year": 13,
      "days_since_latest_release": 17,
      "mean_days_between_releases": 4.8
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": true,
      "health_percentage": 87,
      "has_issue_template": false,
      "has_code_of_conduct": true,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "@akua-dev/sdk",
          "exists": true,
          "license": "Apache-2.0",
          "keywords": [],
          "ecosystem": "npm",
          "matches_repo": true,
          "registry_url": "https://www.npmjs.com/package/@akua-dev/sdk",
          "is_deprecated": false,
          "latest_version": "0.8.25",
          "repository_url": "https://github.com/akua-dev/akua",
          "versions_count": 26,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": 1,
          "monthly_downloads": 2005,
          "first_published_at": "2026-04-27T12:42:24.932000Z",
          "latest_published_at": "2026-07-21T08:15:17.042000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 7
        },
        {
          "name": "@akua-dev/native",
          "exists": true,
          "license": "Apache-2.0",
          "keywords": [
            "akua",
            "napi-rs",
            "NAPI",
            "node-addon",
            "helm",
            "kustomize",
            "kcl"
          ],
          "ecosystem": "npm",
          "matches_repo": true,
          "registry_url": "https://www.npmjs.com/package/@akua-dev/native",
          "is_deprecated": false,
          "latest_version": "0.8.25",
          "repository_url": "https://github.com/akua-dev/akua",
          "versions_count": 26,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": 1,
          "monthly_downloads": 2109,
          "first_published_at": "2026-04-27T12:42:19.969000Z",
          "latest_published_at": "2026-07-21T08:15:02.097000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 7
        }
      ]
    },
    "popularity": {
      "forks": 0,
      "stars": 5,
      "watchers": 0,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 0
      },
      "star_history": null,
      "open_issues_and_prs": 25
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [
        "examples"
      ],
      "has_llms_txt": false,
      "has_dockerfile": true,
      "has_mcp_signal": false,
      "bootstrap_files": [
        ".mise.toml",
        "Taskfile.yml",
        "docs/hero-source/Taskfile.yml"
      ],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [
        "packages/sdk/tsconfig.json"
      ],
      "toolchain_manifests": [
        "Cargo.toml",
        "crates/akua-cli/Cargo.toml",
        "crates/akua-core/Cargo.toml",
        "crates/akua-napi/Cargo.toml",
        "crates/akua-render-worker/Cargo.toml",
        "crates/engine-host-wasm/Cargo.toml",
        "crates/helm-engine-wasm/Cargo.toml",
        "crates/helm-engine-wasm/go-src/go.mod",
        "crates/kustomize-engine-wasm/Cargo.toml",
        "crates/kustomize-engine-wasm/go-src/go.mod",
        "crates/source-hash/Cargo.toml"
      ],
      "largest_source_bytes": 84955,
      "source_files_sampled": 194,
      "oversized_source_files": 4,
      "agent_instruction_files": [
        "AGENTS.md",
        "CLAUDE.md"
      ],
      "agent_instruction_max_bytes": 18329
    },
    "dependencies": {
      "manifests": [
        "Cargo.toml",
        "package.json"
      ],
      "advisories": {
        "error": null,
        "scope": "published_package",
        "source": "osv",
        "findings": [],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {},
        "advisory_count": 0,
        "affected_count": 0,
        "assessed_count": 16,
        "malicious_count": 0,
        "assessed_package": "npm:@akua-dev/sdk@0.8.25",
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "crates",
        "npm"
      ],
      "dependencies": [
        {
          "name": "akua-core",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "clap",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde_json",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde_yaml",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "thiserror",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "toml",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "reqwest",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "ctrlc",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "3"
        },
        {
          "name": "ts-rs",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "12"
        },
        {
          "name": "schemars",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "1"
        },
        {
          "name": "wasmtime",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "43"
        },
        {
          "name": "wasmtime-wasi",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "43"
        },
        {
          "name": "engine-host-wasm",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "tracing",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "tracing-subscriber",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "tracing-opentelemetry",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "opentelemetry",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "opentelemetry_sdk",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "opentelemetry-otlp",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "tokio",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "1"
        },
        {
          "name": "serde",
          "manifest": "crates/akua-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde_json",
          "manifest": "crates/akua-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde_yaml",
          "manifest": "crates/akua-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "toml",
          "manifest": "crates/akua-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "thiserror",
          "manifest": "crates/akua-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "base64",
          "manifest": "crates/akua-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.22"
        },
        {
          "name": "kcl-lang",
          "manifest": "crates/akua-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "sha2",
          "manifest": "crates/akua-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.10"
        },
        {
          "name": "tempfile",
          "manifest": "crates/akua-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "3"
        },
        {
          "name": "ts-rs",
          "manifest": "crates/akua-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "12"
        },
        {
          "name": "schemars",
          "manifest": "crates/akua-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "1"
        },
        {
          "name": "semver",
          "manifest": "crates/akua-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "1"
        },
        {
          "name": "akua-cli",
          "manifest": "crates/akua-napi/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "akua-core",
          "manifest": "crates/akua-napi/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "napi",
          "manifest": "crates/akua-napi/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "3"
        },
        {
          "name": "napi-derive",
          "manifest": "crates/akua-napi/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "3"
        },
        {
          "name": "serde",
          "manifest": "crates/akua-napi/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde_json",
          "manifest": "crates/akua-napi/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde_yaml",
          "manifest": "crates/akua-napi/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "@akua-dev/native-engines",
          "manifest": "crates/akua-napi/package.json",
          "ecosystem": "npm",
          "version_constraint": "0.8.8"
        },
        {
          "name": "akua-core",
          "manifest": "crates/akua-render-worker/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde",
          "manifest": "crates/akua-render-worker/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde_json",
          "manifest": "crates/akua-render-worker/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde_yaml",
          "manifest": "crates/akua-render-worker/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "tracing",
          "manifest": "crates/akua-render-worker/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "tracing-subscriber",
          "manifest": "crates/akua-render-worker/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.3"
        },
        {
          "name": "wasmtime",
          "manifest": "crates/engine-host-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "43"
        },
        {
          "name": "wasmtime-wasi",
          "manifest": "crates/engine-host-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "43"
        },
        {
          "name": "thiserror",
          "manifest": "crates/engine-host-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "engine-host-wasm",
          "manifest": "crates/helm-engine-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde",
          "manifest": "crates/helm-engine-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde_json",
          "manifest": "crates/helm-engine-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "base64",
          "manifest": "crates/helm-engine-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.22"
        },
        {
          "name": "thiserror",
          "manifest": "crates/helm-engine-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "flate2",
          "manifest": "crates/helm-engine-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "1"
        },
        {
          "name": "tar",
          "manifest": "crates/helm-engine-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.4"
        },
        {
          "name": "engine-host-wasm",
          "manifest": "crates/kustomize-engine-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde",
          "manifest": "crates/kustomize-engine-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde_json",
          "manifest": "crates/kustomize-engine-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "base64",
          "manifest": "crates/kustomize-engine-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.22"
        },
        {
          "name": "thiserror",
          "manifest": "crates/kustomize-engine-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "flate2",
          "manifest": "crates/kustomize-engine-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "1"
        },
        {
          "name": "tar",
          "manifest": "crates/kustomize-engine-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.4"
        },
        {
          "name": "sha2",
          "manifest": "crates/source-hash/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.10"
        },
        {
          "name": "@akua-dev/native",
          "manifest": "packages/sdk/package.json",
          "ecosystem": "npm",
          "version_constraint": "0.8.8"
        },
        {
          "name": "@standard-schema/spec",
          "manifest": "packages/sdk/package.json",
          "ecosystem": "npm",
          "version_constraint": "^1.1.0"
        },
        {
          "name": "ajv",
          "manifest": "packages/sdk/package.json",
          "ecosystem": "npm",
          "version_constraint": "^8.18.0"
        },
        {
          "name": "yaml",
          "manifest": "packages/sdk/package.json",
          "ecosystem": "npm",
          "version_constraint": "^2.8.3"
        }
      ],
      "all_dependencies": {
        "error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
        "source": null,
        "packages": [],
        "collected": false,
        "truncated": false,
        "total_count": null,
        "direct_count": null,
        "indirect_count": null
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 14,
        "merged_prs": 46,
        "open_issues": 11,
        "closed_ratio": 0.214,
        "closed_issues": 3,
        "closed_unmerged_prs": 15
      },
      "bus_factor": 1,
      "bot_contributors": 1,
      "top_contributors": [
        {
          "type": "User",
          "login": "robinbraemer",
          "commits": 517,
          "avatar_url": "https://avatars.githubusercontent.com/u/22003767?v=4"
        },
        {
          "type": "User",
          "login": "marcus-klingler",
          "commits": 1,
          "avatar_url": "https://avatars.githubusercontent.com/u/181632184?v=4"
        }
      ],
      "contributors_sampled": 2,
      "top_contributor_share": 0.998
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "ci.yml",
        "pages.yml",
        "release-publish.yml",
        "release.yml"
      ],
      "has_docs_dir": true,
      "linter_configs": [],
      "has_editorconfig": false,
      "has_linter_config": false,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "Cargo.lock"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 9,
            "reason": "9 out of 10 merged PRs checked by a CI test -- score normalized to 9",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 1/29 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 10,
            "reason": "project has 4 contributing companies or organizations",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 10,
            "reason": "update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 10,
            "reason": "30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": 10,
            "reason": "packaging workflow detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 0,
            "reason": "dependency not pinned by hash detected -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "SAST tool is not run on all commits -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 10,
            "reason": "security policy file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": 0,
            "reason": "Project has not signed or included provenance with any releases.",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 0,
            "reason": "89 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "1b87537aaa2f3b1aa8f6bf5d8d41313511aee6ef",
        "ran_at": "2026-07-29T07:41:12Z",
        "aggregate_score": 4.7,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": true,
      "has_dependabot_config": false
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-21T10:30:47Z",
      "oldest_open_prs": [
        {
          "number": 5,
          "created_at": "2026-04-18T05:52:46Z",
          "last_comment_at": "2026-07-24T05:17:43Z",
          "last_comment_author": "akua-renovate"
        },
        {
          "number": 8,
          "created_at": "2026-04-18T13:26:21Z",
          "last_comment_at": "2026-07-24T05:17:42Z",
          "last_comment_author": "akua-renovate"
        },
        {
          "number": 25,
          "created_at": "2026-04-26T03:46:15Z",
          "last_comment_at": "2026-05-07T21:12:53Z",
          "last_comment_author": "akua-renovate"
        },
        {
          "number": 28,
          "created_at": "2026-04-26T06:24:19Z",
          "last_comment_at": "2026-07-24T05:17:44Z",
          "last_comment_author": "akua-renovate"
        },
        {
          "number": 29,
          "created_at": "2026-04-26T06:24:27Z",
          "last_comment_at": "2026-07-24T05:17:45Z",
          "last_comment_author": "akua-renovate"
        },
        {
          "number": 30,
          "created_at": "2026-04-27T14:19:36Z",
          "last_comment_at": "2026-07-24T05:17:41Z",
          "last_comment_author": "akua-renovate"
        },
        {
          "number": 31,
          "created_at": "2026-04-27T14:19:57Z",
          "last_comment_at": "2026-05-07T21:12:51Z",
          "last_comment_author": "akua-renovate"
        },
        {
          "number": 52,
          "created_at": "2026-05-07T21:14:46Z",
          "last_comment_at": "2026-05-08T03:40:55Z",
          "last_comment_author": "akua-renovate"
        },
        {
          "number": 84,
          "created_at": "2026-07-24T05:17:34Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 85,
          "created_at": "2026-07-24T05:17:39Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 86,
          "created_at": "2026-07-24T09:08:19Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 87,
          "created_at": "2026-07-24T09:08:25Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 88,
          "created_at": "2026-07-24T12:47:38Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 89,
          "created_at": "2026-07-24T12:49:29Z",
          "last_comment_at": null,
          "last_comment_author": null
        }
      ],
      "last_merged_pr_at": "2026-07-21T10:30:05Z",
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": [
        {
          "number": 67,
          "created_at": "2026-07-07T22:28:32Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 73,
          "created_at": "2026-07-13T16:40:34Z",
          "last_comment_at": "2026-07-14T07:01:46Z",
          "last_comment_author": "robinbraemer"
        },
        {
          "number": 74,
          "created_at": "2026-07-13T16:41:36Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 75,
          "created_at": "2026-07-13T16:44:22Z",
          "last_comment_at": "2026-07-14T07:01:58Z",
          "last_comment_author": "robinbraemer"
        },
        {
          "number": 76,
          "created_at": "2026-07-13T16:56:08Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 77,
          "created_at": "2026-07-13T16:58:28Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 78,
          "created_at": "2026-07-13T16:58:39Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 79,
          "created_at": "2026-07-13T16:58:51Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 80,
          "created_at": "2026-07-13T17:03:38Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 81,
          "created_at": "2026-07-13T17:03:55Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 82,
          "created_at": "2026-07-13T17:04:24Z",
          "last_comment_at": null,
          "last_comment_author": null
        }
      ]
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/akua-dev/akua",
    "host": "github.com",
    "name": "akua",
    "owner": "akua-dev"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "moderate",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 63,
      "inputs": {
        "security": 58,
        "vitality": 80,
        "community": 49,
        "governance": 49,
        "engineering": 80
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "good",
        "name": "Vitality",
        "value": 80,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "good",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 73,
            "inputs": {
              "commits_last_year": 523,
              "human_commit_share": 1,
              "days_since_last_push": 4,
              "active_weeks_last_year": 13
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 4 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 4
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "13/52 weeks with commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 13
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "523 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 523
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": null,
            "notes": [],
            "value": 90,
            "inputs": {
              "releases_count": 26,
              "latest_release_tag": "v0.8.25",
              "releases_from_tags": false,
              "days_since_latest_release": 17,
              "mean_days_between_releases": 4.8
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "26 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 26
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 17 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 17
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~4.8 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 4.8
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "at_risk",
        "name": "Community & Adoption",
        "value": 49,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 10,
            "inputs": {
              "forks": 0,
              "stars": 5,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "5 stars",
                "points": 9.8,
                "status": "partial",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 5
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "0 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "excellent",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": true,
              "has_issue_template": false,
              "has_code_of_conduct": true,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (Apache-2.0)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "Apache-2.0"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 18,
                "status": "met",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 13.5,
                "status": "met",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          },
          {
            "key": "ecosystem_adoption",
            "band": "moderate",
            "name": "Ecosystem adoption (downloads)",
            "note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "registry_dependents"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 60,
            "inputs": {
              "packages": [
                "@akua-dev/sdk",
                "@akua-dev/native"
              ],
              "dependents": null,
              "ecosystems": "npm",
              "total_downloads": null,
              "monthly_downloads": 4114
            },
            "components": [
              {
                "key": "monthly_downloads",
                "name": "Monthly downloads",
                "detail": "4,114 downloads/month across npm",
                "points": 48.2,
                "status": "partial",
                "details": [
                  {
                    "code": "downloads_monthly",
                    "params": {
                      "count": 4114,
                      "ecosystems": "npm"
                    }
                  }
                ],
                "max_points": 80
              },
              {
                "key": "registry_dependents",
                "name": "Registry dependents",
                "detail": "not reported by this ecosystem",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_reported_by_this_ecosystem",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "at_risk",
        "name": "Sustainability & Governance",
        "value": 49,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 22,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 2,
              "top_contributor_share": 0.998
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 100% of commits",
                "points": 0,
                "status": "partial",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 100
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "2 contributors",
                "points": 2.7,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 4 contributing companies or organizations",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "at_risk",
            "name": "Issue & PR responsiveness",
            "note": null,
            "notes": [],
            "value": 39,
            "inputs": {
              "merged_prs": 46,
              "open_issues": 11,
              "closed_issues": 3,
              "issue_closed_ratio": 0.214,
              "closed_unmerged_prs": 15
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "21% of issues closed",
                "points": 10,
                "status": "partial",
                "details": [
                  {
                    "code": "issues_closed_share",
                    "params": {
                      "share": 21
                    }
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "46/61 decided PRs merged",
                "points": 28.8,
                "status": "partial",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 46,
                      "decided": 61
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 1/29 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "moderate",
            "name": "Ownership & stewardship",
            "note": null,
            "notes": [],
            "value": 51,
            "inputs": {
              "followers": 11,
              "owner_type": "Organization",
              "is_verified": null,
              "owner_login": "akua-dev",
              "public_repos": 15,
              "account_age_days": 769
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "organization-owned",
                "points": 30,
                "status": "met",
                "details": [
                  {
                    "code": "owner_organization",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "11 followers of akua-dev",
                "points": 7.8,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 11,
                      "login": "akua-dev"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "15 public repos, account ~2 yr old",
                "points": 13,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 15
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 2
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "@akua-dev/sdk",
                "@akua-dev/native"
              ],
              "ecosystems": "npm",
              "any_deprecated": false,
              "min_days_since_publish": 7
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "2 package(s) on npm",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 2,
                      "ecosystems": "npm"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 7 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 7
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "26 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 26
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "good",
        "name": "Engineering Quality",
        "value": 80,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "moderate",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 66,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": false,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "4 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 4
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "9 out of 10 merged PRs checked by a CI test -- score normalized to 9",
                "points": 18,
                "status": "partial",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "excellent",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "topics": [
                "devops",
                "helm",
                "infrastructure-as-code",
                "kcl",
                "kubernetes",
                "kustomize",
                "rust",
                "security",
                "webassembly",
                "agentic-infra",
                "aumakua"
              ],
              "has_wiki": true,
              "homepage": "https://cli.akua.dev",
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": "https://cli.akua.dev",
                "points": 15,
                "status": "met",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": "11 topics",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "topics_count",
                    "params": {
                      "count": 11
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "moderate",
        "name": "Security",
        "value": 58,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "at_risk",
            "name": "Security posture",
            "note": null,
            "notes": [],
            "value": 47,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 18,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 0,
              "scorecard_aggregate": 4.7
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "9 out of 10 merged PRs checked by a CI test -- score normalized to 9",
                "points": 2.2,
                "status": "partial",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 1/29 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 4 contributing companies or organizations",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "update tool detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool is not run on all commits -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "89 existing vulnerabilities detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "excellent",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): No advisories left outstanding. Remaining weights renormalized. Matched the npm:@akua-dev/sdk@0.8.25 runtime dependency closure — what installing the published package pulls in — 16 packages. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "no_advisories_left_outstanding"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_published",
                "params": {
                  "package": "npm:@akua-dev/sdk@0.8.25",
                  "assessed": 16
                }
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "source": "osv",
              "advisories": 0,
              "affected_packages": 0,
              "assessed_packages": 16,
              "unassessed_packages": 0,
              "affected_by_severity": "none",
              "direct_affected_packages": 0
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "no direct dependency carries a known advisory",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "no_direct_advisories",
                    "params": {}
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "no indirect dependency carries a known advisory",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "no_indirect_advisories",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory carries a publication date",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_no_publication_date",
                    "params": {}
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 16,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 5
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "good",
        "name": "AI Readiness",
        "value": 71,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "excellent",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 1,
              "agent_instruction_files": [
                "AGENTS.md",
                "CLAUDE.md"
              ],
              "agent_instruction_max_bytes": 18329
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "AGENTS.md, CLAUDE.md",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "AGENTS.md, CLAUDE.md"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "100 of 100 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 100,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "moderate",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 61,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "Cargo.lock"
              ],
              "has_dockerfile": true,
              "typed_language": true,
              "bootstrap_files": [
                ".mise.toml",
                "Taskfile.yml",
                "docs/hero-source/Taskfile.yml"
              ],
              "has_devcontainer": false,
              "has_linter_config": false,
              "typecheck_configs": [
                "packages/sdk/tsconfig.json"
              ],
              "agent_commit_share": 0,
              "toolchain_manifests": [
                "Cargo.toml",
                "crates/akua-cli/Cargo.toml",
                "crates/akua-core/Cargo.toml",
                "crates/akua-napi/Cargo.toml",
                "crates/akua-render-worker/Cargo.toml",
                "crates/engine-host-wasm/Cargo.toml",
                "crates/helm-engine-wasm/Cargo.toml",
                "crates/helm-engine-wasm/go-src/go.mod",
                "crates/kustomize-engine-wasm/Cargo.toml",
                "crates/kustomize-engine-wasm/go-src/go.mod",
                "crates/source-hash/Cargo.toml"
              ],
              "dependency_bot_commit_share": 0
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": ".mise.toml, Taskfile.yml, docs/hero-source/Taskfile.yml",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".mise.toml, Taskfile.yml, docs/hero-source/Taskfile.yml"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "packages/sdk/tsconfig.json",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "packages/sdk/tsconfig.json"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "Dockerfile, lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Dockerfile, lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "no agent-authored commits among the last 100",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_authored_commits",
                    "params": {
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "no automated dependency updates observed",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_dependency_automation",
                    "params": {}
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 99,
            "inputs": {
              "primary_language": "Rust",
              "largest_source_bytes": 84955,
              "source_files_sampled": 194,
              "oversized_source_files": 4
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Rust (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Rust"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "4/194 source files over 60KB",
                "points": 53.9,
                "status": "partial",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 194,
                      "oversized": 4
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "at_risk",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "example_dirs": [
                "examples"
              ],
              "has_mcp_signal": false,
              "api_schema_files": []
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": "examples",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "examples"
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
    "Could not fetch crates package 'akua-cli' from its registry",
    "Could not fetch crates package 'akua-core' from its registry",
    "Could not fetch crates package 'akua-napi' from its registry",
    "Could not fetch crates package 'source-hash' from its registry",
    "Could not fetch crates package 'engine-host-wasm' from its registry",
    "Could not fetch crates package 'helm-engine-wasm' from its registry",
    "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-29T07:41:23.917526Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/a/akua-dev/akua.svg",
  "full_name": "akua-dev/akua",
  "license_state": "standard",
  "license_spdx": "Apache-2.0"
}