ar-io / ar-io-solana-contracts

The resolved dependency set could not be collected for this report: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository

Installing npm:@ar.io/solana-contracts@1.0.1 pulls in 3 packages, direct and transitive: 0 carry known advisories, of which 0 are direct dependencies.

No known advisories affect the assessed dependencies.

An advisory means the version recorded in the dependency graph falls inside an advisory’s affected range. Reachability is not analysed, and the graph includes development and test pins — a finding may concern tooling rather than shipped software.

{
  "data": {
    "icon": {
      "bytes": 6251,
      "width": 256,
      "height": 256,
      "rejected": [],
      "collected": true,
      "media_type": "image/png",
      "source_url": "https://avatars.githubusercontent.com/u/95701273?v=4&s=256",
      "source_type": "avatar",
      "content_hash": "1ebe30988a096d6b77ba20a88bbf276e50ae063995fc9a8bf83792be9adae0f8",
      "candidates_considered": 1
    },
    "repo": {
      "topics": [],
      "is_fork": false,
      "size_kb": 3750,
      "has_wiki": true,
      "homepage": null,
      "languages": {
        "Rust": 4167932,
        "Shell": 106587,
        "Dockerfile": 2878,
        "JavaScript": 40009,
        "TypeScript": 15695
      },
      "pushed_at": "2026-07-17T20:21:36Z",
      "created_at": "2026-05-08T18:00:37Z",
      "owner_type": "Organization",
      "updated_at": "2026-07-24T13:20:20Z",
      "description": "The Ar.io network contracts for the Solana blockchain",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "AGPL-3.0",
      "default_branch": "develop",
      "license_spdx_raw": "AGPL-3.0",
      "primary_language": "Rust",
      "significant_languages": [
        "Rust"
      ]
    },
    "owner": {
      "blog": "https://ar.io",
      "name": "ar.io",
      "type": "Organization",
      "login": "ar-io",
      "company": null,
      "location": null,
      "followers": 158,
      "avatar_url": "https://avatars.githubusercontent.com/u/95701273?v=4",
      "created_at": "2021-12-07T15:05:02Z",
      "is_verified": null,
      "public_repos": 69,
      "account_age_days": 1701
    },
    "license": {
      "state": "standard",
      "spdx_id": "AGPL-3.0",
      "raw_spdx": "AGPL-3.0",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "devnet-20260510-205247-7b7280d",
          "kind": "other",
          "published_at": "2026-05-10T20:52:50Z"
        },
        {
          "tag": "devnet-20260510-194336-0437580",
          "kind": "other",
          "published_at": "2026-05-10T19:43:40Z"
        },
        {
          "tag": "devnet-20260510-011245-0437580",
          "kind": "other",
          "published_at": "2026-05-10T01:12:49Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "a8ef07ef50cbb109ed5f8ec66406607718391298",
          "body": "…(#111)\n\nSync in-repo docs and ANT doc-comments with the actual on-chain\nconstants — the same drift just fixed in the ArNS specs (ar-io/specs#12).\nDocs/comments only; no code, ABI, or behavior changes.\n\n- ANT doc-comments said \"max 256 / max 8 / max 10\"; the enforced\n  constants are 128 / 3 / 4 (des\n[…]\n77.\n- Event #[event] ABI policy is ADR-018, not ADR-017 (ADR-017 is the\n  off-chain attestor). Fixed CLAUDE.md and docs/EVENTS.md.\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: correct stale ANT limits, NameRegistry size, and event-ABI ADR …",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-07-17T20:21:36Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "0cf87c3f45aef194ef439bfeea4322f9f9aa3234",
          "body": "…erver (#116)\n\n* feat(gar): admin_set_reward_ratios — governable epoch reward split\n\nAdd an authority-gated instruction to update the epoch reward split\n(EpochSettings.gateway_reward_ratio / observer_reward_ratio) on the live\naccount. Previously these were written only at genesis (initialize_epochs)\n[…]\nup)\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01XUHtN4Q5scbkPyEE7eRv13\n\n---------\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(gar): governable reward split + observation rent refunds the obs…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-07-17T20:21:19Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "67ccb182a531de15cd8fcc69a0ba2d17a73d719a",
          "body": "* feat(ant): program PDA holds ANT UpdateAuthority (ADR-028)\n\nNew ANTs mint with UpdateAuthority + Attributes-plugin authority set to a\nper-asset `ant_authority` PDA, so Metaplex Core updates route through the\nario-ant program (PDA-signed) instead of the holder's wallet. Owner stays\nwith the user (c\n[…]\nd-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Atticus <atticus@Atticuss-MacBook-Pro.local>\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(ant): program PDA holds ANT UpdateAuthority (ADR-028) (#118)",
          "author_name": "Atticus",
          "author_login": "atticusofsparta",
          "committed_at": "2026-07-17T20:10:43Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "5ba7d34bb2b12ecf0e03499c6b1d06a56242c727",
          "body": "chore: reconcile main into develop (adopt arns-constants; keep develop's escrow)",
          "is_bot": false,
          "headline": "Merge pull request #119 from ar-io/chore/reconcile-main-into-develop",
          "author_name": "Atticus",
          "author_login": "atticusofsparta",
          "committed_at": "2026-07-17T15:46:25Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "87406ffaf6da785d29894cad139db5ba81e991b3",
          "body": "Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(codegen): export arns Rust constants as a generated module",
          "author_name": "atticusofsparta",
          "author_login": "atticusofsparta",
          "committed_at": "2026-07-17T14:35:16Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "0ed122fdbe7b81198e2a313a4ba09c2ff54a8aa8",
          "body": "main is behind develop on escrow (ADR-022 vs develop's ADR-027). Merge with\n-s ours so develop's tree wins every conflict — no escrow regression. The one\nthing main has that develop wants (arns-constants codegen, 8bd6094) is brought\nin via the following cherry-pick. Resolves the main->develop conflict (PR #117).",
          "is_bot": false,
          "headline": "chore: reconcile main into develop (keep develop; escrow stays ADR-027)",
          "author_name": "Atticus",
          "author_login": null,
          "committed_at": "2026-07-17T14:35:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4011bdb6036f30c289250b61d4ca7a2855dcf5e1",
          "body": "…relock\n\nfeat(escrow): restore active-vault re-lock via direct CPI into ario-core (ADR-027)",
          "is_bot": false,
          "headline": "Merge pull request #115 from ar-io/feat/adr-027-restore-active-vault-…",
          "author_name": "Atticus",
          "author_login": "atticusofsparta",
          "committed_at": "2026-07-02T17:51:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6b02f38da395bbf64dde0fece432a7f81f986f87",
          "body": "…,467)\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs(escrow): refresh relock CU numbers post dust-sweep (97,601 / 123…",
          "author_name": "atticusofsparta",
          "author_login": "atticusofsparta",
          "committed_at": "2026-07-02T17:03:24Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "c0da2bfd83c293b8866c5da6b2fa55bdfbcee9e5",
          "body": "- C1 dust-DoS defense in settle_vault_claim (CodeRabbit major): the\n  escrow token account is publicly transferable and close_account\n  requires a zero balance, so donated dust could brick claims forever.\n  Liquid claims now sweep the FULL live balance to the claimant;\n  re-lock claims sweep the dus\n[…]\nn - unreachable at the\n200-year default, self-healing as the remainder decays; a liquid\nfallback there would be an unbounded early-unlock hole).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(escrow): address CodeRabbit review on #115",
          "author_name": "atticusofsparta",
          "author_login": "atticusofsparta",
          "committed_at": "2026-07-02T17:01:58Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "248f06f3c71bd921405b28e7c689f220725f6af4",
          "body": "…ore (ADR-027)\n\nRestores the \"claim a still-locked vault early, stay locked\" capability\nthat ADR-022 disabled, without modifying ario-core. Vault claim\nsettlement now branches on the remaining lock:\n\n- remaining >= ArioConfig.min_vault_duration (read live at claim time):\n  atomic payer pass-through \n[…]\nh: portable file-size check (BSD stat).\n\nCross-repo lockstep (SDK claim builders, escrow-app UX, claim runner)\ntracked in ADR-0027 consequences.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(escrow): restore active-vault re-lock via direct CPI into ario-c…",
          "author_name": "atticusofsparta",
          "author_login": "atticusofsparta",
          "committed_at": "2026-07-02T16:14:09Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "acb9fff018f22ee80e35561e48e0cd3f52760be2",
          "body": "…cret\n\nfix(bridge-monitor): read BASE_RPC_URL from secrets (PE-9116 follow-up)",
          "is_bot": false,
          "headline": "Merge pull request #114 from ar-io/PE-9116-bridge-monitor-base-rpc-se…",
          "author_name": "arielmelendez",
          "author_login": "arielmelendez",
          "committed_at": "2026-06-11T18:42:25Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f1a7c51b210670219b10f0c5927e651ecce854cc",
          "body": "…ret split\n\nThe first scheduled run failed: EXPECTED_DELTA_MARIO and BASE_RPC_URL were\nconfigured as environment *secrets*, but the workflow read them from the\n*vars* context -- separate namespaces, so both resolved empty. The expected\ndelta fell back to 0, turning the known +100 ARIO offset into a \n[…]\nnnet variable = 100000000.)\n- Header comment updated to spell out the secret-vs-variable split and the\n  expected-delta invariant.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(bridge-monitor): read BASE_RPC_URL from secrets; document var/sec…",
          "author_name": "Ariel Melendez",
          "author_login": null,
          "committed_at": "2026-06-11T18:37:01Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "9f991e68674bc7d4ac0a2f66b6d56e68990fb670",
          "body": "feat: Solana <-> Base bridge balance monitor (PE-9116)",
          "is_bot": false,
          "headline": "Merge pull request #113 from ar-io/PE-9116-solana-base-bridge-monitor",
          "author_name": "arielmelendez",
          "author_login": "arielmelendez",
          "committed_at": "2026-06-11T18:24:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "09a13901dababf5cd319ed7f08234b20716d705b",
          "body": "- Separate RPC/fetch failures from balance mismatches. check_balance's\n  exit code is now captured per attempt; a final RPC failure (code 2)\n  flags status=rpc_failure and posts a distinct \"Bridge Monitor Error\"\n  Slack alert instead of a false \"mismatch\" with stale/empty values. The\n  mismatch aler\n[…]\nags\nmatch the sibling AO monitor; pinning one new workflow would diverge\nfrom repo convention without a repo-wide policy decision.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(bridge-monitor): address CodeRabbit review (PE-9116)",
          "author_name": "Ariel Melendez",
          "author_login": null,
          "committed_at": "2026-06-11T18:22:18Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "79e3ac8414fcba9ac9e9c157b8216ca4eda78bad",
          "body": "Port the AO<>Base bridge custody monitor to Solana. Now that ARIO was\nforked from AO to Solana, Solana is the canonical custody side and Base\nholds the bridged ERC-20 representation. The monitor confirms the Solana\nbridge wallet custodies the ARIO backing the circulating Base supply.\n\n- scripts/brid\n[…]\nenvironment, 30s retry to ride out in-flight bridging, Slack\n  failure + recovery notifications (Delta / Expected / Drift fields).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: add Solana <-> Base bridge balance monitor (PE-9116)",
          "author_name": "Ariel Melendez",
          "author_login": null,
          "committed_at": "2026-06-11T18:05:39Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "a67ce90c38704e017d0629254dabfc2d5becd958",
          "body": "feat(codegen): export arns program constants from Rust source-of-truth",
          "is_bot": false,
          "headline": "Merge pull request #110 from ar-io/export-arns-constants-main",
          "author_name": "Atticus",
          "author_login": "atticusofsparta",
          "committed_at": "2026-06-09T19:03:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8bd60945436f96a40995d2674d2ce3165bde3f14",
          "body": "Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(codegen): export arns Rust constants as a generated module",
          "author_name": "atticusofsparta",
          "author_login": "atticusofsparta",
          "committed_at": "2026-06-08T15:48:41Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "6d03473785cbc991bf89db6655f175b9f2866877",
          "body": "* feat(gar): admin_set_withdrawal_period + BD-102 excess-lock bug fix (#42)\n\n# New instruction: `admin_set_withdrawal_period`\n\nMirrors `admin_set_epoch_duration` for `GatewaySettings.withdrawal_period`.\nAuthority-gated, min 60-second bound, emits `WithdrawalPeriodUpdatedEvent`.\nExisting withdrawal v\n[…]\nlength (entries: Vec) with no fixed SIZE, so\n  it uses try-then-grow: attempt deserialize; on EOF (pre-version, missing\n  the trailing version field), grow by exactly SCHEMA_VERSION_SIZE and\n  retry.…",
          "is_bot": false,
          "headline": "solana (#108)",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-06-05T20:21:57Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "098f5eff912ce5a950a19861eb80314383a72892",
          "body": "- bump @ar.io/solana-contracts 0.5.0 -> 1.0.0 (first stable @latest;\n  continues the validated 0.8.0 staging line, encoders identical per\n  ADR-024)\n- drop AO/migration framing from README 'What is this?' (no longer\n  accurate; also 'AO (Arweave Object)' was wrong)\n- point homepage at main (the release line)",
          "is_bot": false,
          "headline": "chore(clients/ts): prep 1.0.0 npm release (#109)",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-06-05T20:16:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "edc98230886bfeb0003c4edb350d2d56562d3377",
          "body": "Add docs/SQUADS_OPS.md — a grounded admin runbook for governing the programs\nvia the Squads V3 multisig. Covers the two authority planes (upgrade vs\nin-program admin), how to verify the vault (System-owned, authority index 1)\nvs the SMPL-owned multisig config, and the two ceremonies:\n  - Program upg\n[…]\nand a safety checklist. Grounded in our scripts + the Squads V3 (legacy) docs\nand the staging dress rehearsal. Linked from README release flow.\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: add Squads V3 operations runbook for admins (#107)",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-06-05T03:42:12Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "05948ba399b8b72dd4e79593519206081e039a68",
          "body": "…104)\n\n* docs(adr): ADR-026 single-step transfer_authority across programs\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\n\n* feat(authority): single-step transfer_authority across programs (ADR-026)\n\nAdd a dedicated transfer_authority(new_authority) admin instruction to\ngar/arns/ant and a \n[…]\ntive processor,\n  independent of the mpl_core.so fixture. Verified passing.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: single-step transfer_authority for admin authority (ADR-026) (#…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-06-05T01:51:25Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "5d7bc0392bb4449570319008440a837642a11c9c",
          "body": "…#106)\n\nMainnet uses Squads V3 (SMPL), not V4. Fix the mainnet upgrade tooling to\nmatch, mirroring the staging script:\n\n- mainnet-prepare-upgrade.sh: set buffer authority to the V3 VAULT\n  (authority index 1), not the multisig config. New SQUADS_V3_VAULT env\n  (falls back to legacy SQUADS_MULTISIG_P\n[…]\nlt.\n- README + upgrade-mainnet.yml: describe the V3 vault target + legacy app\n  ceremony; clarify SQUADS_MULTISIG_PUBKEY must be the vault PDA.\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(mainnet): make the mainnet upgrade ceremony Squads V3-correct (…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-06-05T01:36:42Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "92ce5c86d44ff094f29efcbd6f1e86b620e82394",
          "body": "* chore(staging): Squads V3-correct deploy/handoff tooling\n\nRework scripts/staging-v2-deploy-and-squads.sh for Squads V3 (SMPL,\nSMPLecH534NA9acpos4G6x7uf3LWbCAwZQE9e8ZekMu) — mainnet uses V3, not V4:\n\n- Target the V3 vault = authority INDEX 1 PDA (default vault, also the\n  program-upgrade authority \n[…]\n multisig's Execute can't fail on size. Learned from the staging rehearsal.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: Squads V3-correct staging deploy/handoff tooling (#105)",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-06-05T01:34:52Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "67b54ffac12b810e39b6cc9229595e51d4cc9e1b",
          "body": "…#103)\n\ndistribute_epoch paid the per_gateway reward to every non-leaving, fresh-weights\ngateway in the registry, with no composite-eligibility gate. But prescribe_epoch\ndivides the gateway reward pool by `joined_count` = registry slots with\ncomposite_weight > 0. A gateway that joins after `epoch.st\n[…]\njoiner receives 0, its stats stay 0, and the eligible gateway still\nearns. Full ario-gar suite green (187 integration + 110 unit).\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(gar): exclude composite-0 late-joiners from epoch reward payout (…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-06-04T23:29:54Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "45a0944523c6e1086fbff8712b889184a5f8dca8",
          "body": "…al cutoff to pre-mainnet) (#101)\n\n* chore(migration): set MIGRATION_DEADLINE to far-future placeholder (defer real cutoff to pre-mainnet)\n\nContext: Codex flagged that MIGRATION_DEADLINE = 1781884800 was 2026-06-19\n16:00 UTC — 40h later than the documented 2026-06-18. Rather than commit to a\nconcret\n[…]\nails mainnet builds with a far-future deadline would be wrong.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(migration): far-future MIGRATION_DEADLINE placeholder (defer re…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-06-04T01:44:13Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "3a0cb6d44778e4a4fd61351e92c5c76ca51fbde5",
          "body": "…hdrawal decay, returned-name, lease/grace) (#102)\n\n* test(gar): re-enable the 11 ignored distribute_epoch lifecycle tests\n\nThe distribute_epoch lifecycle tests were #[ignore]'d because\ndistribute_epoch CPIs into ario_core::release_treasury_to_recipient and\nthe test harness never loaded ario-core. R\n[…]\ncom>\n\n* style: cargo fmt ario-gar/tests/integration.rs (fix CI fmt --check)\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "test: time-dependent coverage (epoch distribute, DF min-stepping, wit…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-06-04T01:43:48Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "c8984c3d9edb32e3497062ba14aab8a134fa4d2b",
          "body": "… (#99)\n\nFills program-ids/mainnet.json with the pre-generated mainnet program IDs and the dedicated mainnet attestor pubkey (7XtUnotZ…). This is the manifest half of the mainnet attestor pin; check-attestor-pubkey.sh --cluster mainnet --strict compares the compiled ATTESTOR_PUBKEY against this. NOT\n[…]\n and keeps the devnet key, so this is a deploy-time swap, not a develop change). deployer/upgrade_authority stay null until the hot-key deploy.\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(mainnet): pin mainnet program IDs + attestor pubkey in manifest…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-06-04T00:58:14Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "8506871192ccca4f457bc0352e419e3f43f32f4b",
          "body": "Fresh -v2 program IDs deployed to Solana devnet; deployer/upgrade authority = authority-v2 (FHgQn4W9oFUR9GNzq4yprpvkPdNipVbFnmxEFfknxFMy). mint reset to null (created at devnet-setup genesis). Full mainnet build (BUILD_NETWORK=mainnet). Supersedes v1 IDs (ario_core 5iU1xZ4...).\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(staging): staging v2 program IDs (2026-06-03 redeploy) (#98)",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-06-04T00:57:52Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "7e3a57fbd1e263a0139dc76dfa35fc065e0e49f2",
          "body": "fix(ant): require AntConfig PDA on ACL owner-record path",
          "is_bot": false,
          "headline": "Merge pull request #100 from ar-io/fix/acl-owner-record-ant-validation",
          "author_name": "Atticus",
          "author_login": "atticusofsparta",
          "committed_at": "2026-06-03T19:43:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f684d93b65b8c9beb68de6eb255cb8b1bd046074",
          "body": "Address CodeRabbit: the prior assertion passed on any transaction error,\nincluding an unrelated abort in the ACL setup instructions. Split the\nmust-succeed ACL setup into its own transaction and send `record_acl_owner`\nalone, then assert the exact failure — `AccountNotInitialized` (Anchor 3012)\non i\n[…]\nng `ant_config` PDA\nduring Accounts deserialization. Also assert the ACL page stays empty so the\ntest proves no entry was written.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "test(ant): pin ACL spoof regression to AccountNotInitialized guard",
          "author_name": "atticusofsparta",
          "author_login": "atticusofsparta",
          "committed_at": "2026-06-03T18:26:45Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "ce98d39198f77b135668668cbdec545c93e53312",
          "body": "The permissionless `record_acl_owner` path only checked that the supplied\naccount was owned by the Metaplex Core program and that its embedded owner\nfield equalled the ACL user. It never proved the asset was initialized by\nario-ant, so anyone could record arbitrary non-ANT Core assets owned by a\nvic\n[…]\nssion test (`test_record_acl_owner_rejects_non_ant_asset`) and\nthreads `ant_config` through the existing owner-record event tests.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(ant): require AntConfig PDA on ACL owner-record path",
          "author_name": "atticusofsparta",
          "author_login": "atticusofsparta",
          "committed_at": "2026-06-03T18:08:48Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "e52af21e82149dabda806856a931de4d83b3444e",
          "body": "…ed decay (#97)\n\n* fix(arns): demand rollover cap fast-forwards in closed form, no skipped decay\n\nCodex finding (Medium): for a >100-period gap, maybe_roll_demand_period set\ndemand.current_period directly to current-100, cleared the counters, and\nprocessed only the final 100 periods. The decay and p\n[…]\ncap.\n\nario-arns lib 115 pass; fmt + clippy clean.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(arns): demand rollover cap fast-forwards in closed form, no skipp…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-06-03T12:31:40Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "898f8d54565afaa4c145562bce487b2fee8d6ba2",
          "body": "fix(codama): update codama generation",
          "is_bot": false,
          "headline": "Merge pull request #96 from ar-io/update-idl-codama-generation",
          "author_name": "Atticus",
          "author_login": "atticusofsparta",
          "committed_at": "2026-06-02T22:08:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "629d0305a421afc37d127e71cb0d456e4f3ec2b3",
          "body": null,
          "is_bot": false,
          "headline": "fix(codama): update codama generation",
          "author_name": "atticusofsparta",
          "author_login": "atticusofsparta",
          "committed_at": "2026-06-02T21:59:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f94242b595004efb702be804715a84b3cd2d8ffd",
          "body": "Forward-version bump for the next staging/mainnet client release off develop.\nSince 0.4.0 the client surface changed materially:\n- ADR-024: retired devnet-shrunk; removed admin_shrink_* instructions (ABI removal).\n- ADR-025 / BD-111: GatewaySlot gained `delegated_at_tally`; delegate reward\n  split k\n[…]\n the staging prerelease (0.4.0-staging.N) sort\n*below* the already-published 0.4.0 that downstreams pin; 0.5.0 keeps the\nstaging channel ahead.\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(clients/ts): bump @ar.io/solana-contracts 0.4.0 → 0.5.0 (#95)",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-06-02T13:30:49Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "7330b59e55eee935f5f6c1ac3ffda0b3f91d1bc1",
          "body": "…4) (#93)\n\nRemove the compile-time `devnet-shrunk` feature so every cluster —\nlocalnet, staging, mainnet — compiles the same production-sized\nzero-copy registries. A single `.so` and a single published TS client\nnow match every deploy, eliminating the artifact/account-size skew and\nthe failed stagin\n[…]\ne 56,\narns 101); integration suites green at full-size (gar 171, core 111,\narns 121, escrow 70, ant 111); BPF build of all 5 programs succeeds.\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: retire devnet-shrunk, standardize full-size registries (ADR-02…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-06-02T13:14:24Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "b9bd20e14dfbbd7d6ae71a79ab63595c241071fd",
          "body": "…e (ADR-025/BD-111) (#94)\n\nHIGH-severity reward-theft fix. An operator could disable delegation on a\nstill-Joined gateway and fire the permissionless\n`claim_delegate_from_disabled_gateway` crank between `tally_weights` and\n`distribute_epoch`, driving live `total_delegated_stake` to 0. Distribution\ng\n[…]\nppy (-D warnings, all-targets) clean; ario-gar lib\n105 + integration 172 pass / 0 fail; BPF build of ario-gar succeeds.\n\nDocs: ADR-025, BD-111.\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(gar): key delegate reward share off tally snapshot, not live stak…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-06-02T13:04:45Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "8e022789f6c6615970431b57ba3c4a55b0c7148c",
          "body": "…air request_and_set fee tests vs #91 (#92)\n\n* fix(core): fail closed on unknown primary-name purchase_type + reconcile docs (CodeRabbit #88)\n\nAddresses CodeRabbit review findings on PR #88:\n\n- primary_name.rs (Major): `primary_name_base_fee` treated every non-1\n  purchase_type byte as Lease, silent\n[…]\ntests. ario-core:\n56 lib + 111 integration green.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(core): fail-closed purchase_type (CodeRabbit #88 follow-up) + rep…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-06-02T03:47:10Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "2d2afe266724b7fc2223885454aa7a0412c842e0",
          "body": "…tale-owner fix) (#91)\n\n* fix(ario-core): primary-name auth reads AntConfig.last_known_owner (stale-owner fix)\n\nCodex finding (Medium): read_ant_record_owner fell back to the per-record\nAntRecord.last_reconciled_owner when owner=None. The wrapped\nario_ant::transfer updates AntConfig.last_known_owner\n[…]\n release sequencing for the AntConfig ABI change.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(ario-core): primary-name auth reads AntConfig.last_known_owner (s…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-06-02T03:27:34Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "26defc364053a6929caed15f4cba3296ea22bea6",
          "body": "…elegation disable+cooldown & deferred ratio (#6/#7) (#88)\n\n* fix(arns): RNP formula 50→1 (WP parity) + whitepaper comparison & fix plans\n\nReturned Name Premium: change the linear decay from `50×(dur−elapsed)/dur`\n(which decayed 50x→0x with a boundary dead zone) to the whitepaper's\n`(50×dur − 49×ela\n[…]\ntfmt's width and wasn't wrapped. No logic change.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: whitepaper §6/§9/§12 parity — RNP (#2), primary-name fee (#3), d…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-06-02T03:26:00Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "6eca6958f22d8444ec37fd5e149e9f4c18077b2c",
          "body": "…rkflow\n\nci: pin release-plz workflow actions to immutable commit SHAs",
          "is_bot": false,
          "headline": "Merge pull request #90 from ar-io/codex/pin-third-party-actions-in-wo…",
          "author_name": "Atticus",
          "author_login": "atticusofsparta",
          "committed_at": "2026-06-02T00:50:36Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "bb41ff8f2fa4db879c8e505cd17fad5f3ac2126e",
          "body": null,
          "is_bot": false,
          "headline": "ci: pin release-plz workflow actions",
          "author_name": "Atticus",
          "author_login": "atticusofsparta",
          "committed_at": "2026-06-02T00:18:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "efdae93fa5ef7a3c1d788d9eb07448e3c92d8432",
          "body": "* fix(program ids): update devnet program ids\n\n* fix(program ids): update program ids usage",
          "is_bot": false,
          "headline": "fix(program ids): update devnet program ids (#66)",
          "author_name": "Atticus",
          "author_login": "atticusofsparta",
          "committed_at": "2026-06-01T20:28:03Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "16d6cf5d87d6ce5dcbc1ae07da64e171b949065b",
          "body": "…-search selection) (#87)\n\n* perf(gar): make prescribe_epoch fit the 1.4M CU ceiling at large gateway counts\n\nEmpirically, prescribe_epoch exceeded Solana's MAXIMUM per-tx compute budget\n(1,400,000 CU) on staging-devnet at 667 active gateways — it ran out mid-\nexecution and the tx failed. Off-chain \n[…]\n/9 (capped weights\nnever overflow); clippy clean.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "perf(gar): prescribe_epoch fits 1.4M CU at scale (prefix-sum + binary…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-06-01T14:51:34Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "a3335a0f31f1dca71081877279fb0390639dfe8a",
          "body": "…-chain selection reference (#85)\n\n* docs(gar): document prescribe_epoch remaining_accounts contract + add off-chain selection reference\n\nprescribe_epoch selects observers internally from the GatewayRegistry and uses\nremaining_accounts only as a lookup table for the ~50 SELECTED observers (+ the\nNam\n[…]\n-size limit + ALT (now accurate). Docstring-only.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs(gar): document prescribe_epoch remaining_accounts contract + off…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-06-01T14:51:00Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "d881096c0c890b72904aae1e94f928e7fe708c08",
          "body": "…(#86)\n\nknown_discriminator() permitted Balance/Vault/VaultCounter/PrimaryName/\nPrimaryNameRequest but omitted PrimaryNameReverse — so import_account rejected\nevery reverse (name->owner) primary-name record with InvalidAccountData (6041).\nReverse records ARE migrated via import_account (migration ph\n[…]\nnnet-local dry run (191 reverse records,\nall failing); old snapshots predated primary_names_reverse.json so it never\nfired before.\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(ario-core): allow PrimaryNameReverse in import_account allowlist …",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-06-01T02:52:37Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "e4b448e2b24b20274755c131d2ea859f5f3b6ab4",
          "body": "…n coverage gaps (#84)\n\n* test(audit-followup): end-to-end M-3 + M-4 tests close the integration coverage gaps\n\nHonest re-audit of the audit work surfaced two integration-test gaps not\ncovered by the per-PR unit tests:\n\n## M-4: integration test for the EpochSettings exclusion\n\nPR #81 added 3 unit te\n[…]\n-proofs against\nany GatewaySettings layout shift.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "test(audit-followup): end-to-end M-3 + M-4 tests close the integratio…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-05-31T14:58:22Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "ef0dd3be9acac30a00d6cedba402d0113d56d261",
          "body": "…ways) (#83)\n\nSurfaced during pre-mainnet localnet smoke run for the audit fix PRs.\nThe README pinned Surfpool at `1.1+` but in practice 1.1.x doesn't\nwork and neither does 1.3.x:\n\n- **1.1.x** — lacks `--skip-blockhash-check` (added in 1.2.0,\n  Surfpool PR #632). `scripts/start-localnet.sh` uses thi\n[…]\n-blockhash-check` rejected → 1.2.1 worked everywhere. Pin\nthe README so the next operator hits the right version on the\nfirst try.\n\nCo-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs(readme): pin Surfpool to 1.2.x (was '1.1+' which was wrong both …",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-05-31T14:56:55Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "2fe336d21b19d48ec82bb0ca78bc677d84ce3307",
          "body": "…ns remain reachable (audit M-6) (#82)\n\nPre-mainnet audit (2026-05-29) — Medium. Latent bug; mandatory to fix\nbefore the next ANT controllers-only schema change.\n\n## What was wrong\n\n`migrate_ant` validated `require!(config.version < ANT_CONFIG_VERSION,\nAlreadyLatestVersion)` BEFORE checking the cont\n[…]\nPL Core CPI environment per CLAUDE.md;\n  unchanged by this PR.\n\nAudit report: `/tmp/audit-findings/00-EXECUTIVE-SUMMARY.md` (M-6).\n\nCo-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(ant): split migrate_ant version gate so controllers-only migratio…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-05-30T15:58:35Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "0e3cc7a7fa5009ebabe3d77c176bbc2a2746a0cd",
          "body": "…t-guard ARIO_CORE_PROGRAM_ID const (audit M-4 + M-5) (#81)\n\nPre-mainnet audit (2026-05-29) — two cross-cutting Medium findings,\nshipped together as defensive hardening on the migration-import +\nbuild-time drift surfaces.\n\n## M-4: EpochSettings was in ario-gar's import_account allowlist\n\n`ario_gar::\n[…]\nholder: exits 1, reports both drifts (new + pre-existing)\n\nAudit report: `/tmp/audit-findings/00-EXECUTIVE-SUMMARY.md` (M-4, M-5).\n\nCo-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(cross-cutting): exclude EpochSettings from import allowlist; drif…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-05-30T15:57:51Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "74fabba51ed135e99fb50df7c83e771375ced8a2",
          "body": "…-3) (#80)\n\nPre-mainnet audit (2026-05-29) — Medium. Two of the five extend-lease\nentry points used a stricter cap than the other three, under-permitting\nlegitimate extensions for leases that started long ago.\n\n## What the inconsistency was\n\nThe 3 majority paths (`extend_lease`, `extend_lease_from_d\n[…]\n in-range cases and confirm no regression on legitimate\nflows.\n\nAudit report: `/tmp/audit-findings/00-EXECUTIVE-SUMMARY.md` (M-3).\n\nCo-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(arns): align extend_lease cap across all 5 funding paths (audit M…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-05-30T15:51:15Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "27f769c9b73115942a4c4a5bbc30079e3310edda",
          "body": "…sionless compound_delegation_rewards (audit M-1+M-2) (#79)\n\n* fix(gar): tolerate cleared registry slots in distribute_epoch; permissionless compound_delegation_rewards (audit M-1+M-2)\n\nPre-mainnet audit (2026-05-29) — two Medium GAR findings, packaged\ntogether because they share a worktree + test-m\n[…]\nPR follow-up: #79. CodeRabbit comment referenced.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(gar): tolerate cleared registry slots in distribute_epoch; permis…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-05-30T15:41:30Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "24393d93d87932174f5d133c9c25f2eaa565746e",
          "body": "…-32 (C-1) (#78)\n\nPre-mainnet audit (2026-05-29) — Critical / pre-mainnet blocker.\n\nPR #53 (commit 286b965, \"fix(pdas): implement pda versioning\") appended a\n3-byte `version: SchemaVersion` field to the byte-end of `ArioConfig`,\nbumping `ArioConfig::SIZE` from 258 → 261. The pre-existing\n`admin_set_\n[…]\noss the workspace\n\nAudit report: `/tmp/audit-findings/00-EXECUTIVE-SUMMARY.md` (C-1).\nFix plan: `/tmp/audit-findings/FIX-PLAN.md`.\n\nCo-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(core): admin_set_gar_program writes at canonical offset, not size…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-05-30T14:28:22Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "3ce44e08af2060f6c5c0445ed38468614d2a9c86",
          "body": "…tests (#77)\n\nFollow-up to #74 (ADR-022) — cleanup pass surfaced by a thorough review:\nstale docstrings still described the removed active re-lock path and would\nmislead downstream SDK consumers via the IDL `docs` field. Tests grew two\nsmall-but-load-bearing additions.\n\nDocs:\n- lib.rs program docs f\n[…]\nimestamp` operator — a refactor\n  to `>` would fail this test loudly.\n\nSuite: 69 → 70 BPF tests; all pass. cargo fmt/clippy clean.\n\nCo-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs(escrow): refresh stale active-vault docs; add boundary + parity …",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-05-29T01:56:20Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "6aee7a5d3148fb0a1c326ccb8daf1d0709167364",
          "body": "…ally total (Codex) (#76)\n\nCodex 2026-05-28 security review: prescribe_epoch sampled\n`random_value % epoch.total_composite_weight`, but leave_network and\nprune_gateway zero the leaver's slot composite_weight in place without\nupdating that total (registry indices stay stable mid-epoch — BD-102).\nA hi\n[…]\ntion tests pass\n\nADR-023 documents the design (incl. rejected alternatives).\nBD-108 documents the indexer-visible semantics shift.\n\nCo-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(gar): sample prescribe roulette on live registry sum, not stale t…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-05-28T14:57:48Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "8bab5135453d6bfa0405d321ae3369a69b8f6927",
          "body": "…s (#75)\n\n* docs(escrow): add RESTORE_ACTIVE_VAULT_RELOCK playbook + code pointers\n\nBreadcrumbs for reviving the active-vault re-lock path if \"claim early, stay\nlocked\" ever becomes a deliberate product requirement. Disabling (ADR-022 /\n#74) was the right call now (pre-mainnet, narrow exploit, nothi\n[…]\n green the moment\nthe publish lands and they bump+install.\n\nRollout-doc checklist updated to reflect the current state.\n\n---------\n\nCo-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs(escrow): add RESTORE_ACTIVE_VAULT_RELOCK playbook + code pointer…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-05-28T14:57:32Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "a9cda5c07492bf0288b3c9eecc5288347c7e9acd",
          "body": "…on) (#74)\n\n* fix(escrow): disable active-vault re-lock path (close reuse/redirection)\n\nThe active (still-locked) vault-claim path released escrow tokens to a wallet\nand only *introspected* the tx for a matching `ario_core::vaulted_transfer`\nre-lock. That check had no 1:1 binding between a claim and\n[…]\npus 4.7 (1M context) <noreply@anthropic.com>\n\n* docs(rollout): mark contracts steps done; downstream blocked on release\n\n---------\n\nCo-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(escrow): disable active-vault re-lock path (close reuse/redirecti…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-05-28T13:17:43Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "23ec50d822319ed44f9977ceb2bf3b6452e777b1",
          "body": "…ex) (#73)\n\n* fix(arns): authorize reassign/release against current ANT holder (Codex)\n\n`reassign_name` and `release_name` authorized with\n`caller == arns_record.owner`, but `ArnsRecord.owner` is written once at\n`buy_name` and never updated. After a holder sold/transferred the ANT, the\nprior buyer k\n[…]\notAntHolder). For reassign_name and release_name.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(arns): authorize reassign/release against current ANT holder (Cod…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-05-27T20:49:09Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "e53d74eaf387d9d4047c10c7f223dc606a32cd64",
          "body": "…e-vault theft) (#72)\n\nCodex finding: an active **revocable** vault claim re-locks via a sibling\n`ario_core::vaulted_transfer`, which sets `vault.controller = sender`. The\nsender is the attacker-choosable claim-tx payer, and `revoke_vault` lets the\ncontroller take the balance before expiry — while t\n[…]\no revocable=false; build revocable=false re-locks in the escrow web\napp (on-chain already enforces; sender=payer is now harmless).\n\nCo-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(escrow): make vault re-locks non-revocable (close active-revocabl…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-05-27T17:45:05Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "1125673d7f5436bd5510e46bfe83db388f9a54d3",
          "body": "…ents (#71)\n\nCodex review flagged the escrow attestor trust root. Findings:\n\n- NOT a backdoor: `CKgG3xMKEzd2gWEZTvyrukdZHYb4hwyeTsBMeh8w9mkW` is the\n  legitimate production *devnet* attestor pubkey (set deliberately;\n  secret held by the ar-io/ar-io-solana-attestor service). The report's\n  critical \n[…]\norts (null pin); mismatch → aborts; bare --strict → unchanged\nbackward-compatible behavior. escrow compiles; manifests valid JSON.\n\nCo-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(escrow): pin attestor pubkey per cluster + correct stale key comm…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-05-27T14:01:36Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "dc1c3abda54d535741ce217fbee80c37fb62b1fb",
          "body": "…omb) (#70)\n\n* fix(core): grow-then-deserialize schema migration (close migration bomb)\n\nThe migrate_* instructions loaded the target as a typed `Account<T>`, so\nAnchor borsh-deserialized the NEW (larger) layout BEFORE the `realloc`\nconstraint could grow the account. A pre-versioning account (create\n[…]\nvers all crates via `--workspace --all-targets`.)\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: schema-migration grow-then-deserialize (close in-place upgrade b…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-05-27T11:19:53Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "691e7ea35f66719f2823e59f060c82169e68ef5d",
          "body": "Defense-in-depth follow-up to the admin_close_orphaned_ant_state audit\nfixes (PR #60). The remaining_accounts loop closes AntRecord /\nAntRecordMetadata accounts by discriminator and refunds their rent to\nthe authority. PR #60 added the authority gate + asset/PDA binding for\nconfig/controllers, but t\n[…]\nfor the loop).\n- Existing rejects_non_authority / rejects_when_asset_alive still pass.\n- Full ario-ant integration suite: 109/109.\n\nCo-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(ant): bind orphan-cleanup records to the asset being cleaned (#68)",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-05-26T21:16:49Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "247d7d3952f531e9b8931475ad7bcabf0b58f3e5",
          "body": "…odex #1+#2) (#69)\n\n* fix(escrow): drop unsafe-allow-test-attestor-pubkey from default features\n\nPR #59 (a26a5e3) made the `unsafe-allow-test-attestor-pubkey` feature\nswap ATTESTOR_PUBKEY to the deterministic test key (public seed\n[1u8; 32]) AND keep that feature in escrow's `default`. Because the\nd\n[…]\now programs load\n  fine from the new BPF_OUT_DIR.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(escrow): keep public test attestor key out of deploy artifacts (C…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-05-26T21:15:38Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "cc6a622cddf16f00040303520cb7f743faf8f81e",
          "body": "…ver (#67)\n\n`initialize` hardcoded `current_demand_factor = DEMAND_FACTOR_SCALE`\n(1.0). The AO → Solana migration needs ArNS pricing to match the source\nnetwork at cutover, where the live demand factor is ~9.8 — resetting to\n1.0 would mis-price every name at genesis.\n\nAdd `initial_demand_factor: u64\n[…]\nnvalidParameter` below the protocol minimum). Both test constructors\nupdated.\n\nVerified: `cargo check -p ario-arns --tests` clean.\n\nCo-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(arns): make genesis demand factor a parameter for migration cuto…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-05-26T21:15:35Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "3ef43dd823143e972c255047b620070b1331cd15",
          "body": "Second drift point unblocking `cluster=staging` publishes. PR #63\nfixed the codegen-side rejection; the workflow run that followed\n(#26313654757) progressed all the way through codegen + npm pack +\nprovenance + OIDC auth, then died at the final `Publish to npm` step:\n\n  Invalid dist-tag: 'staging'\n\n\n[…]\nlands, `gh workflow run release-clients-ts.yml\n-f cluster=staging` should publish @ar.io/solana-contracts@0.3.0-staging.0\ncleanly.\n\nCo-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(workflow): accept 'staging' in dist-tag belt-and-braces check (#64)",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-05-22T22:19:46Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "bf4a7d44624b61c45019fe14460c59b217debc31",
          "body": "…ion size (#63)\n\nThe `release-clients-ts.yml` workflow's `cluster` input is a 3-value\ndropdown (`devnet | staging | mainnet`) and the workflow header\ndocuments 'staging' as \"production sizes (mainnet dress-rehearsal on\nSolana devnet)\" — but the codegen script only accepts\n`devnet | mainnet`. The wor\n[…]\nncoder(getGatewaySlotEncoder(), { size: 3000 })` (production)\nnot `{ size: 30 }` (devnet-shrunk), confirming the size-pick change.\n\nCo-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(clients/ts): accept CLUSTER=staging in codegen + treat as product…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-05-22T21:49:15Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "1178cb43646792587e405a0341984fce2bd20223",
          "body": "…ccounts (#62)\n\n* fix(schema-migration): add 0.0.0 → 1.0.0 bootstrap arms for pre-#53 accounts\n\nPR #53 introduced `version: SchemaVersion` on every record PDA in\nario-core / ario-arns / ario-ant / ario-ant-escrow (mirroring what\nPR #51 already did for ario-ant). The `migrate_xxx_version` functions\ni\n[…]\nbbit on PR #62. Pure formatting; no logic change.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(schema-migration): add 0.0.0 → 1.0.0 bootstrap arms for pre-#53 a…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-05-22T20:36:02Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "ed3529f7f4defdc10058f8b40f381586024d4177",
          "body": "fix(pdas): implement pda versioning",
          "is_bot": false,
          "headline": "Merge pull request #53 from ar-io/version-all-record-pdas",
          "author_name": "Atticus",
          "author_login": "atticusofsparta",
          "committed_at": "2026-05-22T16:12:23Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "972bb4a5d5a27f6c396c40258896c0c0d95ba0ec",
          "body": null,
          "is_bot": false,
          "headline": "fix(format): fix formating",
          "author_name": "atticusofsparta",
          "author_login": "atticusofsparta",
          "committed_at": "2026-05-22T14:39:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "135d7ee2fe61afb426d61cef9d062eaa53e99b3e",
          "body": "…-pdas\n\n# Conflicts:\n#\tprograms/ario-ant-escrow/src/error.rs",
          "is_bot": false,
          "headline": "Merge remote-tracking branch 'origin/develop' into version-all-record…",
          "author_name": "atticusofsparta",
          "author_login": "atticusofsparta",
          "committed_at": "2026-05-22T14:06:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "12b3eb7f99631d575edb43f8c67b821a18851bd2",
          "body": null,
          "is_bot": false,
          "headline": "fix(epoch settings): update epoch settings and observation sizes",
          "author_name": "atticusofsparta",
          "author_login": "atticusofsparta",
          "committed_at": "2026-05-22T14:04:03Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3c1480dc5486a85d5e7b1ec63f879a9c28208803",
          "body": "… drift (#61)\n\nTwo changes that close the post-#60 retrospective gap: integration\ntests were silently breaking whenever build-sbf.sh --sync left\ntarget/deploy/*.so files synced while the source got restored to\nplaceholder declare_id. CI never caught it because the workflow\nintentionally skipped the \n[…]\n\n  Total: 541 integration tests pass via the wrapper.\n\n  Combined with the 418 lib tests, that's 959 tests covered by the\n  wrapper end-to-end.\n\nCo-authored-by: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(tests): integration-test wrapper + CI job to prevent declare_id…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-05-22T13:13:13Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "c1f01fa8d7f00ede4484729178cc6d0fa12847cf",
          "body": "…ing audit (#60)\n\nA security review of the 6-PR rent-savings stack (#54-#59) found two\nCRITICAL issues in `admin_close_orphaned_ant_state` (#56) that this\npatch closes, plus three high-priority follow-ups.\n\n## CRITICAL #1: admin_close_orphaned_ant_state had no auth gate\n\nThe Accounts struct's `autho\n[…]\nemaining lower-priority observation\n(authority can grief by repeatedly expanding) is acceptable per\nthe trust model; documented in the runbook.\n\nCo-authored-by: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(security): close 2 critical findings + 3 follow-ups from pre-stag…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-05-22T12:29:35Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "a26a5e3b787bb7da85f18fc2d423c7642836164d",
          "body": "…t-attestor-pubkey is enabled (#59)\n\nThe 7 claim_*_attested integration tests have been red on develop\nsince commit a1f16ec (\"set ATTESTOR_PUBKEY to the production devnet\nvalue\") because the const was hardcoded to the prod pubkey, while\ntest_attestor_keypair() in the test suite signs with the\ndeterm\n[…]\nantic change in production behavior. The fix is a build-mode\nswap that gets the test suite back to green without softening the\nprod safety net.\n\nCo-authored-by: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(escrow): swap ATTESTOR_PUBKEY to test value when unsafe-allow-tes…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-05-22T02:42:46Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "1139b1698ea4d1f0e46a270993bd276efe5cdd83",
          "body": "…hase 9) (#58)\n\nPairs with #57 (merged 2026-05-22). ADR-020 captures the design\ndecisions: byte-identical header layout (no migration ix needed),\ndata.len() as capacity source-of-truth (no capacity field in header),\nadmin-gated expansion via admin_expand_name_registry, hardcoded\ninitial 50K capacity\n[…]\new 2_000_040-byte initial shape and the zero-copy pre-allocation\nnote now correctly reads \"168,040 / dynamic\" instead of \"120,040 /\n8,000,040\".\n\nCo-authored-by: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: ADR-020 + COMPUTE_AND_LIMITS update for dynamic NameRegistry (P…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-05-22T01:42:45Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "e59088197b8321d0e3537954185ed456270df8df",
          "body": "…y (ADR-020) (#57)\n\nRefactors NameRegistry from a fixed-200K bytemuck array to a header +\nbyte-offset slot pattern, with live expansion via a new admin ix. This\nis the standard Solana pattern used by OpenBook v2, MarginFi, Phoenix,\nand mpl-core for variable-capacity zero-copy accounts.\n\n## Day-1 mai\n[…]\ngistries continue\nworking with the new code. Going forward, fresh deploys allocate\n50K shape; growing past that uses the new `admin_expand` ix.\n\nCo-authored-by: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(arns): dynamic-capacity NameRegistry + admin_expand_name_registr…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-05-22T01:33:54Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "33149f58ce5dc08e058d299b928dc7f59f0144e8",
          "body": "…DR-019) (#56)\n\n* feat(ant): user-callable close ixs + admin orphan cleanup (Phase 2)\n\nLets ANT owners destroy their own state and recover rent, plus an\nadmin-only path for cleaning up state after an escrow purge has\nalready burned the asset.\n\nNew user-callable ixs (caller must be current MPL Core a\n[…]\nnd_set_record helper calls. No semantic changes — pure\nwhitespace + reflow.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: rent reclamation — user-callable closes + admin escrow purge (A…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-05-22T00:23:50Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "51986029a22df02645b9497c1b054716de10c6dd",
          "body": "…LERS for mainnet rent savings (#55)\n\nRight-sized three caps based on snapshot audit of actual AO ANT usage:\n\n- MAX_DESCRIPTION_LENGTH: 256 → 128\n  Snapshot p99=107 chars across 1,040 source descriptions; 128 covers\n  99% without truncation. -128 bytes per AntConfig (and -128 per\n  AntRecordMetadata\n[…]\npass across all 5 programs.\n\nPairs with monorepo `staging-full-redeploy.sh` and the upcoming\n`validate-shrink-fit.ts` pre-flight (separate PR).\n\nCo-authored-by: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(ant): shrink MAX_DESCRIPTION_LENGTH / MAX_KEYWORDS / MAX_CONTROL…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-05-22T00:08:13Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "2a5d6a4ac1269622d48d9cb09cd37e1495291e95",
          "body": "Supersedes #52. Previous Staging programs were closed on 2026-05-21\nafter the first deploy attempt ran out of SOL mid-Phase-2; closed\nprogram IDs are spent (BPFLoaderUpgradeable can't redeploy at the same\npubkey), so the monorepo regenerated 5 fresh keypairs. This mirrors\nthose pubkeys into the cont\n[…]\n Borsh-incompatible with the published\n@ar.io/solana-contracts@0.2.0-devnet.9 client; staging tests the same\nshape Surfpool run #12 validated).\n\nCo-authored-by: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(staging): rotate program IDs (2026-05-21 redeploy prep) (#54)",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-05-22T00:08:09Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "5e1b18e6f27e23cae6e809aac69a30ca333457d8",
          "body": null,
          "is_bot": false,
          "headline": "fix(fixed sized): update config size test",
          "author_name": "atticusofsparta",
          "author_login": "atticusofsparta",
          "committed_at": "2026-05-21T14:53:29Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "286b96559c783f2da9fd0259b11f72fe040dbdd5",
          "body": null,
          "is_bot": false,
          "headline": "fix(pdas): implement pda versioning",
          "author_name": "atticusofsparta",
          "author_login": "atticusofsparta",
          "committed_at": "2026-05-20T20:10:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c6a2569b93d7e5b062a2eb159f732354a1f8d236",
          "body": "Ant version upgrade paths",
          "is_bot": false,
          "headline": "Merge pull request #51 from ar-io/ant-version-upgrade-paths",
          "author_name": "Atticus",
          "author_login": "atticusofsparta",
          "committed_at": "2026-05-19T21:42:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "edac6fc3da358bbeaef7a523bb0b0530244807ec",
          "body": null,
          "is_bot": false,
          "headline": "fix(ant migration): update struct name",
          "author_name": "atticusofsparta",
          "author_login": "atticusofsparta",
          "committed_at": "2026-05-19T21:28:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "97ac0fc9c64ba1ac8d9cc9d1e46f21dd4754ea38",
          "body": null,
          "is_bot": false,
          "headline": "fix(migration): update skip schema version helper",
          "author_name": "atticusofsparta",
          "author_login": "atticusofsparta",
          "committed_at": "2026-05-19T20:55:18Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "42b1b51522b95c09ac3cd50ec88a09c9e2e2914d",
          "body": "…nit tests\n\nAddresses CodeRabbit review: when `migration-test` feature is active,\ndirect AntConfig constructors in `make_config` and `test_config_stores_name`\nneed the conditional sentinel fields to compile.",
          "is_bot": false,
          "headline": "fix(ant): add migration-test fields to AntConfig struct literals in u…",
          "author_name": "atticusofsparta",
          "author_login": "atticusofsparta",
          "committed_at": "2026-05-19T19:19:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0a5e28c65cc1a82125a8443d0b829dbc4f6d488e",
          "body": "…e-paths\n\n# Conflicts:\n#\tprograms/ario-ant/Cargo.toml",
          "is_bot": false,
          "headline": "Merge remote-tracking branch 'origin/develop' into ant-version-upgrad…",
          "author_name": "atticusofsparta",
          "author_login": "atticusofsparta",
          "committed_at": "2026-05-19T18:39:03Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e8cf00a3b34f6442bb7db346206c9545990af12c",
          "body": null,
          "is_bot": false,
          "headline": "fix(ant version): version ANT pdas",
          "author_name": "atticusofsparta",
          "author_login": "atticusofsparta",
          "committed_at": "2026-05-19T18:34:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a9c60428ea480aa8c9911915572c122e19ff4af9",
          "body": "…t Solana cutover (#50)\n\n* feat(gar): admin_set_current_epoch_index — preserve AO epoch number at Solana cutover\n\n# Why\n\n`initialize_epochs` always sets `current_epoch_index = 0` and\n`genesis_timestamp = now` (initialize.rs:223-224), so AO's epoch\ncounter doesn't carry over at Solana genesis. Fresh-\n[…]\n] attribute line\n\ncargo fmt -- --check failure in CI; long #[msg] string on\nEpochCounterAlreadyAdvanced needs the multi-line layout.\n\n---------\n\nCo-authored-by: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(gar): admin_set_current_epoch_index — preserve AO epoch number a…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-05-19T18:31:08Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "2cbad2ee849abfb267533000cac9746b82cf492c",
          "body": "…1620 (#49)\n\nupgrade-devnet run 26068921620 successfully redeployed all 5 programs to\ndevnet (tx signatures in the run log) but its final \"Commit & push\" step\nfailed because develop's branch-protection rule blocks direct pushes from\nthe workflow's default GITHUB_TOKEN:\n\n    remote: error: GH013: Rep\n[…]\nUPNoBTnpxvuHJL2qWqJ9ok6Ntrw8sMZXU`\n- ario_ant_escrow `2cG2fKofZ9BFt3A2re4bPPNYPgUdTD39UyAMLDde5Q8HKtihTJxQyHoMjcjxZPKcL7oGWH3ktw13RjTvAk8kNHUG`\n\nCo-authored-by: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(devnet): refresh program-ids manifest after upgrade run 2606892…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-05-19T12:59:42Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "823a4a8317298fcba4db1c0d84c5a0c8bff4717a",
          "body": "…re produced (#48)\n\nFollow-up to PR #46 + #47. The previous fixes got the actual deploy\nworking again (upgrade-devnet run 26060866950 deployed all 5 programs\nsuccessfully). But the workflow's subsequent `package-release.sh` step\nfailed:\n\n    ERROR: missing target/idl/ario_core.json\n    Run `anchor b\n[…]\nefault-features\n--features network-devnet,devnet-shrunk` started cleanly (only the\npre-existing benign `solana-program separate dep` warnings).\n\nCo-authored-by: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(build): use `anchor build` instead of `cargo build-sbf` so IDLs a…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-05-19T00:15:47Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "61a60b3f927bcc4b7032ee34fea55d2d7e770b95",
          "body": "…ograms (follow-up to #46) (#47)\n\n* fix(build): build escrow in the workspace with --features network-<cluster>; revert PR #43+#45 hacks\n\n# Problem\n\nupgrade-devnet has been broken for ~6 attempted runs in a row. Three\nPRs tried to fix it (#39 recorded the escrow program ID, #43 added a\nseparate escr\n[…]\nk` — clean across all 5 crates. The exact\nflag combo build-sbf.sh now uses.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(build): declare network-mainnet/network-devnet as no-op on all pr…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-05-18T21:14:35Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "671ad09e7cd1c2df9b4be7590182a0cbc226a1c6",
          "body": "…uster>; revert PR #43+#45 hacks (#46)\n\n# Problem\n\nupgrade-devnet has been broken for ~6 attempted runs in a row. Three\nPRs tried to fix it (#39 recorded the escrow program ID, #43 added a\nseparate escrow build pass, #45 added workspace.exclude to support\n#43) but the combined behavior fails at:\n\n  \n[…]\n-features\n  network-devnet,devnet-shrunk` — clean compile, all 5 crates.\n* BPF build E2E verified by re-dispatching upgrade-devnet after merge.\n\nCo-authored-by: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(build): build escrow in the workspace with --features network-<cl…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-05-18T21:02:50Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "436d4fce80fb895dbe81792909fe93f0eee4c36c",
          "body": "…(#44)\n\nStaging is a second deployment on Solana devnet at separate program IDs,\nintended as the mainnet dress-rehearsal env: it uses full mainnet\nregistry sizes (3000/200000/3000), the `devnet-shrunk` Cargo feature\nauto-disables since BUILD_NETWORK=staging doesn't match the devnet\nguard in build-sb\n[…]\nand work as-is.\nThe release.yml downstream publish-typed-client job passes cluster\nthrough verbatim, so no plumbing change needed there either.\n\nCo-authored-by: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: add staging cluster (mainnet dress-rehearsal on Solana devnet) …",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-05-18T20:15:33Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "9c75c773662686db15dc09810465b6c763b835ed",
          "body": "…om members (#45)\n\n# Problem\n\nupgrade-devnet run 26054973519 (after PR #43 landed) advanced past the\n\"Missing .so\" check but then failed at the separate escrow build step:\n\n    current package believes it's in a workspace when it's not:\n    current:   /home/runner/.../programs/ario-ant-escrow/Cargo.\n[…]\n.toml from the backup\ntaken before any of these modifications, so the source tree is never\nleft in this patched state outside the build window.\n\nCo-authored-by: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(build): add ario-ant-escrow to workspace.exclude when removing fr…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-05-18T19:46:41Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "e9ba09d761adeac32604c3b3dc0181565c79b7e4",
          "body": "…program ID (#43)\n\n# Problem\n\nThe upgrade-devnet workflow (run 26053533447, 2026-05-18) now fails at:\n\n    x  Missing target/deploy/ario_ant_escrow.so\n\nThe deploy script's pre-deploy `.so`-existence check rejects any\nprogram listed in `program-ids/<cluster>.json` whose `.so` is absent\nfrom `target/d\n[…]\nescrow/Cargo.toml\n  --no-default-features --features network-devnet` — clean.\n\nCI's `upgrade-devnet.yml` will exercise the BPF path end-to-end.\n\nCo-authored-by: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(build): build ario-ant-escrow separately when manifest assigns a …",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-05-18T19:16:08Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "8f7022288bdf1bb6265a37b506b3d3605b747ff8",
          "body": "…#42)\n\n# New instruction: `admin_set_withdrawal_period`\n\nMirrors `admin_set_epoch_duration` for `GatewaySettings.withdrawal_period`.\nAuthority-gated, min 60-second bound, emits `WithdrawalPeriodUpdatedEvent`.\nExisting withdrawal vaults are unaffected (their `available_at` was\nstamped at create time)\n[…]\n`\nassertion `withdrawal.available_at == created_at + 2_592_000` still passes\nbecause `settings.withdrawal_period` defaults to the same 30 days.\n\nCo-authored-by: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(gar): admin_set_withdrawal_period + BD-102 excess-lock bug fix (…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-05-18T18:38:19Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "af37bdfff11c44890be50907e58c75116c25949c",
          "body": null,
          "is_bot": false,
          "headline": "Merge develop into main",
          "author_name": "vilenarios",
          "author_login": "vilenarios",
          "committed_at": "2026-05-18T13:22:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a92ee2aaba8298d591afb2db82238546d26a5e35",
          "body": "…-squash conflict) (#41)\n\n* fix(ci): bump release-clients-ts.yml to Node 24 for npm 11.5+ Trusted Publishing (#38)\n\nThe publish step in release-clients-ts.yml was failing with:\n\n    npm notice publish Signed provenance statement with source ...\n    npm error code E404\n    npm error 404 Not Found - P\n[…]\ncovered from `solana program show` slot\nhistory if precision matters later.\n\nCo-authored-by: Claude Opus 4.7 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: sync main with develop (4 commits, cherry-picked to avoid post…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-05-18T12:40:43Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "9fe2ed57979b2401db182c9818708a067679a5f2",
          "body": "… (#39)\n\nThe fifth workspace program (`ario_ant_escrow`) was deployed to devnet\nmanually by the maintainer earlier this month. The program-IDs manifest\nstill recorded `null` for it, which means:\n\n- Future `release-devnet.yml` runs skip it (the deploy loop in\n  `scripts/devnet-deploy.sh` reads `progr\n[…]\nactual on-chain first-deploy timestamp\npredates this and could be recovered from `solana program show` slot\nhistory if precision matters later.\n\nCo-authored-by: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: record ario_ant_escrow first-deploy in program-ids/devnet.json…",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-05-17T23:46:54Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "f46eb8583e8159d23b7238e0ec4ba3ac832b535c",
          "body": "…repo (#37)\n\nThe off-chain attestor service was extracted from\n`ar-io/solana-ar-io:migration/attestor/` into its own repo:\nhttps://github.com/ar-io/ar-io-solana-attestor\n\nThis PR sweeps the contracts repo to point at the new location. Pure\ndocs/comments — no behavior, no event surface, no IDL, no AP\n[…]\nline as-is.\n- docs/archive/ANT_ESCROW_IMPLEMENTATION_PLAN.md: archived doc; per the\n  archive convention these are frozen historical snapshots.\n\nCo-authored-by: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: update attestor refs to ar-io/ar-io-solana-attestor across the …",
          "author_name": "Phil",
          "author_login": "vilenarios",
          "committed_at": "2026-05-17T23:35:14Z",
          "body_truncated": true,
          "is_coding_agent": true
        }
      ],
      "releases_count": 3,
      "commits_last_year": 198,
      "latest_release_at": "2026-05-10T20:52:50Z",
      "latest_release_tag": "devnet-20260510-205247-7b7280d",
      "releases_from_tags": false,
      "days_since_last_push": 18,
      "active_weeks_last_year": 8,
      "days_since_latest_release": 86,
      "mean_days_between_releases": 0.4
    },
    "artifacts": {
      "collected": true,
      "structure": [
        "tree.cargo_lib",
        "tree.dockerfile"
      ],
      "declarations": [
        {
          "name": null,
          "path": "Cargo.toml",
          "tokens": [
            "cargo.workspace"
          ],
          "ecosystem": "crates"
        },
        {
          "name": "@ar.io/solana-contracts",
          "path": "clients/ts/package.json",
          "tokens": [
            "npm.entry",
            "npm.peer_dependencies"
          ],
          "ecosystem": "npm"
        },
        {
          "name": "ario-ant-escrow",
          "path": "programs/ario-ant-escrow/Cargo.toml",
          "tokens": [
            "cargo.lib",
            "cargo.cdylib"
          ],
          "ecosystem": "crates"
        },
        {
          "name": "ario-ant",
          "path": "programs/ario-ant/Cargo.toml",
          "tokens": [
            "cargo.lib",
            "cargo.cdylib"
          ],
          "ecosystem": "crates"
        },
        {
          "name": "ario-arns",
          "path": "programs/ario-arns/Cargo.toml",
          "tokens": [
            "cargo.lib",
            "cargo.cdylib"
          ],
          "ecosystem": "crates"
        },
        {
          "name": "ario-core",
          "path": "programs/ario-core/Cargo.toml",
          "tokens": [
            "cargo.lib",
            "cargo.cdylib"
          ],
          "ecosystem": "crates"
        },
        {
          "name": "ario-gar",
          "path": "programs/ario-gar/Cargo.toml",
          "tokens": [
            "cargo.lib",
            "cargo.cdylib"
          ],
          "ecosystem": "crates"
        },
        {
          "name": "ario-test-utils",
          "path": "test-utils/Cargo.toml",
          "tokens": [
            "cargo.lib",
            "cargo.publish_false"
          ],
          "ecosystem": "crates"
        }
      ]
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "readme_badges": {
        "hosts": [],
        "total": 0,
        "header": 0,
        "collected": true,
        "has_inspect_badge": false
      },
      "has_description": true,
      "has_contributing": false,
      "health_percentage": 50,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": true
    },
    "ecosystem": {
      "packages": [
        {
          "name": "@ar.io/solana-contracts",
          "exists": true,
          "license": "AGPL-3.0-or-later",
          "keywords": [],
          "ecosystem": "npm",
          "categories": [],
          "matches_repo": true,
          "registry_url": "https://www.npmjs.com/package/@ar.io/solana-contracts",
          "declared_type": null,
          "is_deprecated": false,
          "latest_version": "1.0.1",
          "repository_url": "https://github.com/ar-io/ar-io-solana-contracts",
          "versions_count": 12,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": 1,
          "monthly_downloads": 2641,
          "first_published_at": "2026-05-12T03:58:36.931000Z",
          "latest_published_at": "2026-06-09T19:23:24.528000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 56
        }
      ]
    },
    "popularity": {
      "forks": 0,
      "stars": 1,
      "watchers": 0,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 0
      },
      "star_history": null,
      "open_issues_and_prs": 1
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [
        "examples"
      ],
      "has_llms_txt": false,
      "has_dockerfile": true,
      "has_mcp_signal": false,
      "bootstrap_files": [],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [
        "clients/ts/tsconfig.json"
      ],
      "toolchain_manifests": [
        "Cargo.toml",
        "programs/ario-ant-escrow/Cargo.toml",
        "programs/ario-ant-escrow/fuzz/Cargo.toml",
        "programs/ario-ant/Cargo.toml",
        "programs/ario-arns/Cargo.toml",
        "programs/ario-core/Cargo.toml",
        "programs/ario-gar/Cargo.toml",
        "test-utils/Cargo.toml"
      ],
      "largest_source_bytes": 950175,
      "source_files_sampled": 111,
      "oversized_source_files": 12,
      "agent_instruction_files": [
        "CLAUDE.md"
      ],
      "agent_instruction_max_bytes": 32706
    },
    "dependencies": {
      "manifests": [
        "Cargo.toml",
        "test-utils/Cargo.toml"
      ],
      "advisories": {
        "error": null,
        "scope": "published_package",
        "source": "osv",
        "findings": [],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {},
        "advisory_count": 0,
        "affected_count": 0,
        "assessed_count": 3,
        "malicious_count": 0,
        "assessed_package": "npm:@ar.io/solana-contracts@1.0.1",
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "crates"
      ],
      "dependencies": [
        {
          "name": "anchor-lang",
          "manifest": "test-utils/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "base64",
          "manifest": "test-utils/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.22"
        },
        {
          "name": "@noble/hashes",
          "manifest": "clients/ts/package.json",
          "ecosystem": "npm",
          "version_constraint": "^1.5.0"
        },
        {
          "name": "bs58",
          "manifest": "clients/ts/package.json",
          "ecosystem": "npm",
          "version_constraint": "^6.0.0"
        },
        {
          "name": "anchor-lang",
          "manifest": "programs/ario-ant-escrow/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "anchor-spl",
          "manifest": "programs/ario-ant-escrow/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "blake3",
          "manifest": "programs/ario-ant-escrow/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "proc-macro-crate",
          "manifest": "programs/ario-ant-escrow/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "indexmap",
          "manifest": "programs/ario-ant-escrow/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "unicode-segmentation",
          "manifest": "programs/ario-ant-escrow/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "solana-program",
          "manifest": "programs/ario-ant-escrow/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "ario-core",
          "manifest": "programs/ario-ant-escrow/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "anchor-lang",
          "manifest": "programs/ario-ant/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "blake3",
          "manifest": "programs/ario-ant/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "proc-macro-crate",
          "manifest": "programs/ario-ant/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "indexmap",
          "manifest": "programs/ario-ant/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "unicode-segmentation",
          "manifest": "programs/ario-ant/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "solana-program",
          "manifest": "programs/ario-ant/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "ario-arns",
          "manifest": "programs/ario-ant/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "anchor-lang",
          "manifest": "programs/ario-arns/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "anchor-spl",
          "manifest": "programs/ario-arns/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "blake3",
          "manifest": "programs/ario-arns/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "proc-macro-crate",
          "manifest": "programs/ario-arns/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "indexmap",
          "manifest": "programs/ario-arns/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "unicode-segmentation",
          "manifest": "programs/ario-arns/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "bytemuck",
          "manifest": "programs/ario-arns/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "solana-program",
          "manifest": "programs/ario-arns/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "ario-gar",
          "manifest": "programs/ario-arns/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "anchor-lang",
          "manifest": "programs/ario-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "anchor-spl",
          "manifest": "programs/ario-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "blake3",
          "manifest": "programs/ario-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "proc-macro-crate",
          "manifest": "programs/ario-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "indexmap",
          "manifest": "programs/ario-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "unicode-segmentation",
          "manifest": "programs/ario-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "solana-program",
          "manifest": "programs/ario-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "ario-ant",
          "manifest": "programs/ario-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "ario-gar",
          "manifest": "programs/ario-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "anchor-lang",
          "manifest": "programs/ario-gar/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "anchor-spl",
          "manifest": "programs/ario-gar/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "blake3",
          "manifest": "programs/ario-gar/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "proc-macro-crate",
          "manifest": "programs/ario-gar/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "indexmap",
          "manifest": "programs/ario-gar/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "unicode-segmentation",
          "manifest": "programs/ario-gar/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "bytemuck",
          "manifest": "programs/ario-gar/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        }
      ],
      "all_dependencies": {
        "error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
        "source": null,
        "packages": [],
        "collected": false,
        "truncated": false,
        "total_count": null,
        "direct_count": null,
        "indirect_count": null
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 113,
        "open_issues": 1,
        "closed_ratio": 0,
        "closed_issues": 0,
        "closed_unmerged_prs": 5
      },
      "bus_factor": 1,
      "bot_contributors": 0,
      "top_contributors": [
        {
          "type": "User",
          "login": "vilenarios",
          "commits": 111,
          "avatar_url": "https://avatars.githubusercontent.com/u/6451820?v=4"
        },
        {
          "type": "User",
          "login": "atticusofsparta",
          "commits": 81,
          "avatar_url": "https://avatars.githubusercontent.com/u/85306700?v=4"
        },
        {
          "type": "User",
          "login": "arielmelendez",
          "commits": 2,
          "avatar_url": "https://avatars.githubusercontent.com/u/7692385?v=4"
        }
      ],
      "contributors_sampled": 3,
      "top_contributor_share": 0.572
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "bpf-integration.yml",
        "bridge_monitor.yaml",
        "build-test.yml",
        "codeql.yml",
        "docker-builder.yml",
        "release-clients-ts.yml",
        "release-plz.yml",
        "release.yml",
        "upgrade-devnet.yml",
        "upgrade-mainnet.yml"
      ],
      "has_docs_dir": true,
      "linter_configs": [],
      "has_editorconfig": false,
      "has_linter_config": false,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "Cargo.lock",
        "yarn.lock"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 8,
            "reason": "binaries present in source code",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 3,
            "reason": "branch protection is not maximal on development and all release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 10,
            "reason": "20 out of 20 merged PRs checked by a CI test -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 1/20 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 3,
            "reason": "project has 1 contributing companies or organizations -- score normalized to 3",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 0,
            "reason": "no update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 10,
            "reason": "project is fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 0,
            "reason": "project was created within the last 90 days. Please review its contents carefully",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": 10,
            "reason": "packaging workflow detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 0,
            "reason": "dependency not pinned by hash detected -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 7,
            "reason": "SAST tool detected but not run on all commits",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 0,
            "reason": "security policy file not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": 0,
            "reason": "Project has not signed or included provenance with any releases.",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 0,
            "reason": "28 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "a8ef07ef50cbb109ed5f8ec66406607718391298",
        "ran_at": "2026-08-05T08:58:16Z",
        "aggregate_score": 3.6,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": true,
      "has_security_policy": false,
      "has_dependabot_config": false
    },
    "contribution_flow": {
      "collected": true,
      "recent_prs": {
        "merged_7d": 0,
        "decided_7d": 0,
        "merged_30d": 4,
        "authors_30d": 2,
        "decided_30d": 5,
        "sample_size": 60,
        "window_days": 30,
        "sample_exhausted": false,
        "authors_probed_30d": 2,
        "newcomer_merged_30d": 0,
        "bot_prs_excluded_30d": 0,
        "newcomer_authors_30d": 0,
        "newcomer_decided_30d": 0
      },
      "ci_last_run_at": "2026-08-05T08:54:34Z",
      "oldest_open_prs": [],
      "last_merged_pr_at": "2026-07-17T20:21:36Z",
      "ci_last_conclusion": "FAILURE",
      "oldest_open_issues": [
        {
          "number": 112,
          "created_at": "2026-06-10T04:23:02Z",
          "last_comment_at": null,
          "last_comment_author": null
        }
      ]
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/ar-io/ar-io-solana-contracts",
    "host": "github.com",
    "name": "ar-io-solana-contracts",
    "owner": "ar-io"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "moderate",
      "name": "Overall health",
      "note": "The weighted overall 56 is calibrated to 59 on the published index scale (record calibration 2026-08-02).",
      "notes": [
        {
          "code": "overall_calibration",
          "params": {
            "raw": 56,
            "calibrated": 59,
            "calibration": "2026-08-02"
          }
        }
      ],
      "value": 59,
      "inputs": {
        "security": 49,
        "vitality": 67,
        "community": 35,
        "governance": 53,
        "calibration": "2026-08-02",
        "engineering": 71,
        "ai_readiness": 72,
        "weighted_overall_raw": 56
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "good",
        "name": "Vitality",
        "value": 67,
        "weight": 0.21,
        "metrics": [
          {
            "key": "development_activity",
            "band": "moderate",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 52,
            "inputs": {
              "commits_last_year": 198,
              "human_commit_share": 1,
              "days_since_last_push": 18,
              "active_weeks_last_year": 8
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 18 days ago",
                "points": 28.8,
                "status": "partial",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 18
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "8/52 weeks with commits",
                "points": 5.5,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 8
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "198 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 198
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": null,
            "notes": [],
            "value": 90,
            "inputs": {
              "releases_count": 3,
              "latest_release_tag": "devnet-20260510-205247-7b7280d",
              "releases_from_tags": false,
              "days_since_latest_release": 86,
              "mean_days_between_releases": 0.4
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "3 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 3
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 86 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 86
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~0.4 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 0.4
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "exceptional",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "weak",
        "name": "Community & Adoption",
        "value": 35,
        "weight": 0.17,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 1,
            "inputs": {
              "forks": 0,
              "stars": 1,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "1 stars",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "0 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "moderate",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 57,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "readme_badges": 0,
              "has_contributing": false,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "readme_badge_services": [],
              "has_pull_request_template": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (AGPL-3.0)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "AGPL-3.0"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 6.3,
                "status": "met",
                "details": [],
                "max_points": 6.3
              }
            ]
          },
          {
            "key": "ecosystem_adoption",
            "band": "moderate",
            "name": "Ecosystem adoption (downloads)",
            "note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "registry_dependents"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 57,
            "inputs": {
              "packages": [
                "@ar.io/solana-contracts"
              ],
              "dependents": null,
              "ecosystems": "npm",
              "total_downloads": null,
              "monthly_downloads": 2641
            },
            "components": [
              {
                "key": "monthly_downloads",
                "name": "Monthly downloads",
                "detail": "2,641 downloads/month across npm",
                "points": 45.6,
                "status": "partial",
                "details": [
                  {
                    "code": "downloads_monthly",
                    "params": {
                      "count": 2641,
                      "ecosystems": "npm"
                    }
                  }
                ],
                "max_points": 80
              },
              {
                "key": "registry_dependents",
                "name": "Registry dependents",
                "detail": "not reported by this ecosystem",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_reported_by_this_ecosystem",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "moderate",
        "name": "Sustainability & Governance",
        "value": 53,
        "weight": 0.23,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "at_risk",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 26,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 3,
              "top_contributor_share": 0.572
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 57% of commits",
                "points": 9.6,
                "status": "partial",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 57
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "3 contributors",
                "points": 4.1,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 3
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 1 contributing companies or organizations -- score normalized to 3",
                "points": 3,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "at_risk",
            "name": "Issue & PR responsiveness",
            "note": "Excluded from scoring (no data or not applicable): Newcomer PR acceptance. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "newcomer_pr_acceptance"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 33,
            "inputs": {
              "merged_prs": 113,
              "open_issues": 1,
              "closed_issues": 0,
              "prs_merged_7d": 0,
              "prs_decided_7d": 0,
              "prs_merged_30d": 4,
              "prs_decided_30d": 5,
              "issue_closed_ratio": 0,
              "closed_unmerged_prs": 5,
              "first_time_authors_30d": 0,
              "first_time_prs_merged_30d": 0,
              "first_time_prs_decided_30d": 0
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "0% of issues closed",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "issues_closed_share",
                    "params": {
                      "share": 0
                    }
                  }
                ],
                "max_points": 42
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "113/118 decided PRs merged",
                "points": 28.7,
                "status": "partial",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 113,
                      "decided": 118
                    }
                  }
                ],
                "max_points": 30
              },
              {
                "key": "newcomer_pr_acceptance",
                "name": "Newcomer PR acceptance",
                "detail": "no first-time contributor's PR decided in 30d",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_newcomer_prs",
                    "params": {
                      "days": 30
                    }
                  }
                ],
                "max_points": 13
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 1/20 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "good",
            "name": "Ownership & stewardship",
            "note": null,
            "notes": [],
            "value": 68,
            "inputs": {
              "followers": 158,
              "owner_type": "Organization",
              "is_verified": null,
              "owner_login": "ar-io",
              "public_repos": 69,
              "account_age_days": 1701
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "organization-owned",
                "points": 30,
                "status": "met",
                "details": [
                  {
                    "code": "owner_organization",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "158 followers of ar-io",
                "points": 15.8,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 158,
                      "login": "ar-io"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "69 public repos, account ~4 yr old",
                "points": 22.3,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 69
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 4
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "exceptional",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "@ar.io/solana-contracts"
              ],
              "ecosystems": "npm",
              "any_deprecated": false,
              "min_days_since_publish": 56
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on npm",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "npm"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 56 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 56
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "12 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 12
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "good",
        "name": "Engineering Quality",
        "value": 71,
        "weight": 0.19,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "good",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 68,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": false,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "10 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 10
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "20 out of 20 merged PRs checked by a CI test -- score normalized to 10",
                "points": 20,
                "status": "met",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "good",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 75,
            "inputs": {
              "topics": [],
              "has_wiki": true,
              "homepage": null,
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "weak",
        "name": "Security",
        "value": 49,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "weak",
            "name": "Security posture",
            "note": null,
            "notes": [],
            "value": 36,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 18,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 0,
              "scorecard_aggregate": 3.6
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "binaries present in source code",
                "points": 6,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection is not maximal on development and all release branches",
                "points": 2.2,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "20 out of 20 merged PRs checked by a CI test -- score normalized to 10",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 1/20 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 1 contributing companies or organizations -- score normalized to 3",
                "points": 0.8,
                "status": "partial",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "no update tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is fuzzed",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool detected but not run on all commits",
                "points": 3.5,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file not detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "28 existing vulnerabilities detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "exceptional",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): No advisories left outstanding. Remaining weights renormalized. Matched the npm:@ar.io/solana-contracts@1.0.1 runtime dependency closure — what installing the published package pulls in — 3 packages. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "no_advisories_left_outstanding"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_published",
                "params": {
                  "package": "npm:@ar.io/solana-contracts@1.0.1",
                  "assessed": 3
                }
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "source": "osv",
              "advisories": 0,
              "affected_packages": 0,
              "assessed_packages": 3,
              "unassessed_packages": 0,
              "affected_by_severity": "none",
              "direct_affected_packages": 0
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "no direct dependency carries a known advisory",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "no_direct_advisories",
                    "params": {}
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "no indirect dependency carries a known advisory",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "no_indirect_advisories",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory carries a publication date",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_no_publication_date",
                    "params": {}
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "exceptional",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 3,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "good",
        "name": "AI Readiness",
        "value": 72,
        "weight": 0.04,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "excellent",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 0.97,
              "agent_instruction_files": [
                "CLAUDE.md"
              ],
              "agent_instruction_max_bytes": 32706
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "CLAUDE.md",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "CLAUDE.md"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "97 of 100 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 97,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "good",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 66,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "Cargo.lock",
                "yarn.lock"
              ],
              "has_dockerfile": true,
              "typed_language": true,
              "bootstrap_files": [],
              "has_devcontainer": false,
              "has_linter_config": false,
              "typecheck_configs": [
                "clients/ts/tsconfig.json"
              ],
              "agent_commit_share": 0.74,
              "toolchain_manifests": [
                "Cargo.toml",
                "programs/ario-ant-escrow/Cargo.toml",
                "programs/ario-ant-escrow/fuzz/Cargo.toml",
                "programs/ario-ant/Cargo.toml",
                "programs/ario-arns/Cargo.toml",
                "programs/ario-core/Cargo.toml",
                "programs/ario-gar/Cargo.toml",
                "test-utils/Cargo.toml"
              ],
              "dependency_bot_commit_share": 0
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "Cargo.toml, programs/ario-ant-escrow/Cargo.toml, programs/ario-ant-escrow/fuzz/Cargo.toml (toolchain convention, no task runner)",
                "points": 12.6,
                "status": "partial",
                "details": [
                  {
                    "code": "toolchain_convention",
                    "params": {
                      "files": "Cargo.toml, programs/ario-ant-escrow/Cargo.toml, programs/ario-ant-escrow/fuzz/Cargo.toml"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "clients/ts/tsconfig.json",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "clients/ts/tsconfig.json"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "Dockerfile, lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Dockerfile, lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "74 of the last 100 commits agent-authored or agent-credited",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "agent_authored_commits",
                    "params": {
                      "count": 74,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "no automated dependency updates observed",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_dependency_automation",
                    "params": {}
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "exceptional",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 94,
            "inputs": {
              "primary_language": "Rust",
              "largest_source_bytes": 950175,
              "source_files_sampled": 111,
              "oversized_source_files": 12
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Rust (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Rust"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "12/111 source files over 60KB",
                "points": 49.1,
                "status": "partial",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 111,
                      "oversized": 12
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "weak",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "example_dirs": [
                "examples"
              ],
              "has_mcp_signal": false,
              "api_schema_files": []
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": "examples",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "examples"
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? Carries a deliberately small weight: agent tooling is a real maintenance signal, but its absence must never gate the top of the scale (calibration saturates at raw 91, so 100/100 remains reachable with AI Readiness at zero)."
      }
    ],
    "classification": {
      "top": [
        "library"
      ],
      "labels": [
        "library"
      ],
      "scores": {
        "library": 21.6
      },
      "primary": "library",
      "evidence": [
        {
          "tier": "declared",
          "label": "library",
          "source": "cargo.lib",
          "weight": 6
        },
        {
          "tier": "distribution",
          "label": "library",
          "source": "registry:npm",
          "weight": 6
        },
        {
          "tier": "declared",
          "label": "library",
          "source": "npm.entry",
          "weight": 4.8
        },
        {
          "tier": "declared",
          "label": "library",
          "source": "cargo.cdylib",
          "weight": 3.6
        },
        {
          "tier": "declared",
          "label": "library",
          "source": "cargo.publish_false",
          "weight": -3.6
        },
        {
          "tier": "structure",
          "label": "library",
          "source": "tree.cargo_lib",
          "weight": 3
        },
        {
          "tier": "declared",
          "label": "library",
          "source": "npm.peer_dependencies",
          "weight": 1.8
        }
      ],
      "artifacts": [
        {
          "path": "Cargo.toml",
          "labels": [],
          "ecosystem": "crates"
        },
        {
          "path": "clients/ts/package.json",
          "labels": [
            "library"
          ],
          "ecosystem": "npm"
        },
        {
          "path": "programs/ario-ant-escrow/Cargo.toml",
          "labels": [
            "library"
          ],
          "ecosystem": "crates"
        },
        {
          "path": "programs/ario-ant/Cargo.toml",
          "labels": [
            "library"
          ],
          "ecosystem": "crates"
        },
        {
          "path": "programs/ario-arns/Cargo.toml",
          "labels": [
            "library"
          ],
          "ecosystem": "crates"
        },
        {
          "path": "programs/ario-core/Cargo.toml",
          "labels": [
            "library"
          ],
          "ecosystem": "crates"
        },
        {
          "path": "programs/ario-gar/Cargo.toml",
          "labels": [
            "library"
          ],
          "ecosystem": "crates"
        },
        {
          "path": "test-utils/Cargo.toml",
          "labels": [
            "library"
          ],
          "ecosystem": "crates"
        }
      ],
      "confidence": "high",
      "host_extension": false,
      "runs_as_process": false,
      "consumed_by_code": true
    },
    "metrics_version": "2.5.0"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
    "Could not fetch crates package 'ario-test-utils' from its registry",
    "Could not fetch crates package 'ario-ant' from its registry",
    "Could not fetch crates package 'ario-gar' from its registry",
    "Could not fetch crates package 'ario-arns' from its registry",
    "Could not fetch crates package 'ario-core' from its registry",
    "Could not fetch crates package 'ario-ant-escrow' from its registry",
    "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
  ],
  "report_type": "repository",
  "generated_at": "2026-08-05T08:58:33.043215Z",
  "schema_version": "0.31.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/a/ar-io/ar-io-solana-contracts.svg",
  "full_name": "ar-io/ar-io-solana-contracts",
  "license_state": "standard",
  "license_spdx": "AGPL-3.0"
}