Software health reportschema 0.27.0 · metrics 1.13.0 · 2026-07-27 17:08 UTC

bancsdan / go-stripenav

Package stripenav bridges Stripe webhook events to the Hungarian NAV Online Számla v3.0 invoice reporting API.

GoMIT★ 1 star⑂ 0 forkssince May 2026View on GitHub ↗

bancsdan/go-stripenav holds a health index of 49 out of 100, placing it in the At risk band. It scores highest on AI Readiness (70/100) and lowest on Security (24/100). It was last updated 12 days ago. A single contributor accounts for most of its recent work.

overall / 100

At risk

Software health index

Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At risk ceiling of 49. AI Readiness sits outside the overall score.

Excellent85-100Exemplary; meets essentially all checked criteria

Good70-84Healthy; minor gaps

Moderate50-69Acceptable with notable gaps; review recommended

At risk30-49Significant weaknesses; adoption warrants caution

Critical1-29Severe problems (abandoned, single-maintainer, no hygiene)

Score profile

Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.

Ownership

Daniel BancsiPersonal account

1 follower8 public repossince May 2014

This repository is owned by a personal account. A single-owner project carries more continuity risk than an organization-backed one.

Package ecosystems

Registry	Package	Version	Downloads / mo	Versions	Last publish
Go	github.com/bancsdan/go-stripenav	v0.4.1	-	5	12 days ago

Metrics by category

Vitality

Is the project alive — is code being written and are releases shipping?

68Moderate · 22% of overall

Development activity

47At risk

How it's scored

28.8/36	Push recency — last push 12 days ago
2.8/36	Commit cadence — 4/52 weeks with commits
15/18	Commit volume — 46 commits in the last year
0/10	OpenSSF Scorecard: Maintained — project was created within the last 90 days. Please review its contents carefully

Inputs used

commits_last_year	46
human_commit_share	0.957
days_since_last_push	12
active_weeks_last_year	4

Release discipline

100Excellent

How it's scored

27/27	Ships releases — 2 releases published
36/36	Release recency — latest release 12 days ago
27/27	Release cadence — a release every ~33.6 days
0/10	OpenSSF Scorecard: Signed-Releases — no data

Inputs used

releases_count	2
latest_release_tag	v0.4.1
releases_from_tags	no
days_since_latest_release	12
mean_days_between_releases	33.6

Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.

Community & Adoption

Does the project have users, downloads, attention, and a welcoming setup for contributors?

24Critical · 18% of overall

Popularity & adoption

1Critical

How it's scored

0/60	Stars — 1 stars
0/25	Forks — 0 forks
0/15	Watchers — 0 watchers

Inputs used

forks	0
stars	1
watchers	0
growth_state	unverified
growth_factor_pct	100
growth_unverified_reason	no_history

Community health

50Moderate

How it's scored

22.5/22.5	README
22.5/22.5	License — recognized license (MIT)
0/18	CONTRIBUTING guide
0/13.5	Code of conduct
0/7.2	Issue template
0/6.3	PR template

Inputs used

has_readme	yes
has_license	yes
has_contributing	no
has_issue_template	no
has_code_of_conduct	no
has_pull_request_template	no

Sustainability & Governance

Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?

51Moderate · 24% of overall

Maintainer resilience (bus factor)

10Critical

How it's scored

9/54	Bus factor — 1 contributor(s) cover half of all commits
0/22.5	Commit distribution — top contributor authored 100% of commits
1.4/13.5	Contributor breadth — 1 contributors
0/10	OpenSSF Scorecard: Contributors — project has 0 contributing companies or organizations -- score normalized to 0

Inputs used

bus_factor	1
contributors_sampled	1
top_contributor_share	1

Issue & PR responsiveness

72Good

How it's scored

0/46.8	Issue resolution — no issues or no data
38.2/38.3	PR acceptance — 2/2 decided PRs merged
0/15	OpenSSF Scorecard: Code-Review — Found 0/26 approved changesets -- score normalized to 0

Inputs used

merged_prs	2
open_issues	0
closed_issues	0
issue_closed_ratio	—
closed_unmerged_prs	0

Excluded from scoring (no data or not applicable): Issue resolution. Remaining weights renormalized.

Ownership & stewardship

39At risk

How it's scored

10/30	Ownership backing — personal (user) account
0/20	Verified domain — not applicable to user accounts
2.2/25	Owner reach — 1 followers of bancsdan
18.9/25	Track record — 8 public repos, account ~12 yr old

Inputs used

followers	1
owner_type	User
is_verified	—
owner_login	bancsdan
public_repos	8
account_age_days	4,460

Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.

Package maintenance

100Excellent

How it's scored

25/25	Published & resolvable — 1 package(s) on go
35/35	Publish recency — latest publish 12 days ago
20/20	Version history — 5 published versions
20/20	Not deprecated — active, not deprecated or yanked

Inputs used

packages	github.com/bancsdan/go-stripenav
ecosystems	go
any_deprecated	no
min_days_since_publish	12

Engineering Quality

Are baseline engineering and documentation practices in place?

68Moderate · 20% of overall

Engineering practices

64Moderate

How it's scored

24/24	CI workflows — 2 workflow(s)
24/24	Tests present
16/16	Linter config — .golangci.yml
0/9.6	Pre-commit hooks
0/6.4	.editorconfig
0/20	OpenSSF Scorecard: CI-Tests — 0 out of 2 merged PRs checked by a CI test -- score normalized to 0

Inputs used

has_ci	yes
has_tests	yes
has_editorconfig	no
has_linter_config	yes
has_precommit_config	no

Documentation

75Good

How it's scored

30/30	README
25/25	Documentation directory
0/15	Documentation / homepage site
10/10	Repository description
0/10	Topics
10/10	Wiki

Inputs used

topics	—
has_wiki	yes
homepage	—
has_readme	yes
has_docs_dir	yes
has_description	yes

Security

Are visible security and supply-chain practices strong, without unresolved high-risk jurisdiction exposure?

24Critical · 16% of overall

Security posture

24Critical

How it's scored

7.5/7.5	Binary-Artifacts — no binaries found in the repo
0/7.5	Branch-Protection — branch protection not enabled on development/release branches
0/2.5	CI-Tests — 0 out of 2 merged PRs checked by a CI test -- score normalized to 0
0/2.5	CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected
0/7.5	Code-Review — Found 0/26 approved changesets -- score normalized to 0
0/2.5	Contributors — project has 0 contributing companies or organizations -- score normalized to 0
10/10	Dangerous-Workflow — no dangerous workflow patterns detected
0/7.5	Dependency-Update-Tool — no update tool detected
0/5	Fuzzing — project is not fuzzed
2.5/2.5	License — license file detected
0/7.5	Maintained — project was created within the last 90 days. Please review its contents carefully
0/5	Packaging — no data
0/5	Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0
0/5	SAST — SAST tool is not run on all commits -- score normalized to 0
0/5	Security-Policy — security policy file not detected
0/7.5	Signed-Releases — no data
0/7.5	Token-Permissions — detected GitHub workflow tokens with excessive permissions
2.2/7.5	Vulnerabilities — 7 existing vulnerabilities detected

Inputs used

source	openssf_scorecard
checks_evaluated	16
scorecard_version	v5.5.0
checks_inconclusive	2
scorecard_aggregate	2.4

Excluded from scoring (no data or not applicable): packaging, signed_releases. Remaining weights renormalized.

AI Readiness

How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score.

70Good · 0% of overall

Agent context & guidance

40At risk

How it's scored

0/45	Agent instructions — no CLAUDE.md / AGENTS.md / editor rules
0/15	Machine-readable docs (llms.txt)
40/40	Legible commit history — 43 of 44 human commits state their intent (structured subject or explanatory body)

Inputs used

has_llms_txt	no
legible_history_share	0.977
agent_instruction_files	—
agent_instruction_max_bytes	—

Verify loop (build / test / typecheck)

82Good

How it's scored

18/18	One-command bootstrap — Taskfile.yml
22/22	Automated tests
11/11	Lint / format config — .golangci.yml
11/11	Static type checking — Go (statically typed)
10/10	Reproducible environment — lockfile
10/10	Demonstrated agent practice — 23 of the last 46 commits agent-authored or agent-credited
0/8	Automated maintenance — no automated dependency updates observed
0/10	OpenSSF Scorecard: Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0

Inputs used

has_nix	no
has_tests	yes
lockfiles	go.sum
has_dockerfile	no
typed_language	yes
bootstrap_files	Taskfile.yml
has_devcontainer	no
has_linter_config	yes
typecheck_configs	—
agent_commit_share	0.5
toolchain_manifests	go.mod
dependency_bot_commit_share	0

Code legibility for models

100Excellent

How it's scored

45/45	Type-checkable code — Go (statically typed)
55/55	Manageable file sizes — 0/52 source files over 60KB

Inputs used

primary_language	Go
largest_source_bytes	29,845
source_files_sampled	52
oversized_source_files	0

Key facts

1GitHub stars

1contributors

46commits, last 12 months

12days since last push

2releases

1bus factor

0open issues

Gopackage ecosystems

Data collection warnings

Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository

More detail

OpenSSF Scorecard 2.4 / 10

2.4aggregate

Independent, tool-agnostic security assessment from the open-source OpenSSF Scorecard. Each check rewards a security practice, not a specific vendor's tool. Checks Scorecard could not determine are marked n/a and excluded from the security score (never counted as zero).Scorecard v5.5.0 · 2026-07-27 17:08 UTC

10	Binary-Artifacts	no binaries found in the repo
0	Branch-Protection	branch protection not enabled on development/release branches
0	CI-Tests	0 out of 2 merged PRs checked by a CI test -- score normalized to 0
0	CII-Best-Practices	no effort to earn an OpenSSF best practices badge detected
0	Code-Review	Found 0/26 approved changesets -- score normalized to 0
0	Contributors	project has 0 contributing companies or organizations -- score normalized to 0
10	Dangerous-Workflow	no dangerous workflow patterns detected
0	Dependency-Update-Tool	no update tool detected
0	Fuzzing	project is not fuzzed
10	License	license file detected
0	Maintained	project was created within the last 90 days. Please review its contents carefully
n/a	Packaging	packaging workflow not detected
0	Pinned-Dependencies	dependency not pinned by hash detected -- score normalized to 0
0	SAST	SAST tool is not run on all commits -- score normalized to 0
0	Security-Policy	security policy file not detected
n/a	Signed-Releases	no releases found
0	Token-Permissions	detected GitHub workflow tokens with excessive permissions
3	Vulnerabilities	7 existing vulnerabilities detected

Direct dependencies 2

Registry	Package	Version constraint	Manifest
Go	github.com/stripe/stripe-go/v82	`v82.5.1`	go.mod
Go	golang.org/x/time	`v0.15.0`	go.mod

All dependencies not collected

The resolved dependency set could not be collected for this report: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository

Raw JSON report machine-readable

{
  "data": {
    "repo": {
      "topics": [],
      "is_fork": false,
      "size_kb": 571,
      "has_wiki": true,
      "homepage": null,
      "languages": {
        "Go": 273755
      },
      "pushed_at": "2026-07-14T22:39:50Z",
      "created_at": "2026-05-31T08:24:38Z",
      "owner_type": "User",
      "updated_at": "2026-07-14T22:39:45Z",
      "description": "Package stripenav bridges Stripe webhook events to the Hungarian NAV Online Számla v3.0 invoice reporting API.",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "MIT",
      "default_branch": "main",
      "license_spdx_raw": "MIT",
      "primary_language": "Go",
      "significant_languages": [
        "Go"
      ]
    },
    "owner": {
      "blog": null,
      "name": "Daniel Bancsi",
      "type": "User",
      "login": "bancsdan",
      "company": null,
      "location": null,
      "followers": 1,
      "avatar_url": "https://avatars.githubusercontent.com/u/7544608?v=4",
      "created_at": "2014-05-10T19:18:16Z",
      "is_verified": null,
      "public_repos": 8,
      "account_age_days": 4460
    },
    "license": {
      "state": "standard",
      "spdx_id": "MIT",
      "raw_spdx": "MIT",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.4.1",
          "kind": "patch",
          "published_at": "2026-07-14T22:39:50Z"
        },
        {
          "tag": "v0.4.0",
          "kind": "minor",
          "published_at": "2026-06-11T08:19:41Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "82573f13419d5db5c92b1ce7bce5bb643a839fad",
          "body": "chore(main): release 0.4.1",
          "is_bot": false,
          "headline": "Merge pull request #2 from bancsdan/release-please--branches--main",
          "author_name": "Daniel Bancsi",
          "author_login": "bancsdan",
          "committed_at": "2026-07-14T22:39:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e29e1070707c36a8655caad9bcac342405d9c1f5",
          "body": "…ment\"\n\nThis reverts commit 3c703d4a6d9024c4eb9b4c8ea50c96410076fc7c.",
          "is_bot": false,
          "headline": "Revert \"docs(readme): disclose AI-generated, human-controlled develop…",
          "author_name": "Daniel Bancsi",
          "author_login": "bancsdan",
          "committed_at": "2026-06-11T08:46:52Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2d44b68319b414cefa16ed2be02ade5451e9d007",
          "body": null,
          "is_bot": true,
          "headline": "chore(main): release 0.4.1",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-06-11T08:44:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3c703d4a6d9024c4eb9b4c8ea50c96410076fc7c",
          "body": "State up front that the code is written with AI under human direction,\nreview, and release control, and that behaviour is verified by unit\ntests plus e2e runs against NAV's real test environment.",
          "is_bot": false,
          "headline": "docs(readme): disclose AI-generated, human-controlled development",
          "author_name": "Daniel Bancsi",
          "author_login": "bancsdan",
          "committed_at": "2026-06-11T08:44:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2fc5b06df06f87c9220452d4e7267e13af0c4e8a",
          "body": "…se badge cache\n\nThe Release Please merge left the hand-written \"Unreleased\" section\n(plus the old file intro) stranded below the generated 0.4.0 entry.\nRestructured: intro back on top with a note that released sections are\nmachine-generated from here on; the curated behavioural highlights\n(deadline\n[…]\nDME release badge gains ?sort=semver — semver ordering is the\ncorrect comparison for tags, and the changed URL forces GitHub's camo\nproxy to drop its cached \"invalid\" image from before v0.4.0 existed.",
          "is_bot": false,
          "headline": "docs: fold curated release notes into the 0.4.0 changelog; bust relea…",
          "author_name": "Daniel Bancsi",
          "author_login": "bancsdan",
          "committed_at": "2026-06-11T08:33:49Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a1050294f16c1260016ae4b16954663a9c91783b",
          "body": "chore(main): release 0.4.0",
          "is_bot": false,
          "headline": "Merge pull request #1 from bancsdan/release-please--branches--main",
          "author_name": "Daniel Bancsi",
          "author_login": "bancsdan",
          "committed_at": "2026-06-11T08:19:30Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6050798a16d383ee4b689cf1c0cf802ed8eaf884",
          "body": null,
          "is_bot": true,
          "headline": "chore(main): release 0.4.0",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-06-11T08:00:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "519e05fcefcd5d67a76b99d4a6bc12d325e5950b",
          "body": "Manifest-mode setup seeded with the existing v0.3.0 as the last\nrelease. Every push to main maintains a rolling release PR; merging it\nbumps the version from the Conventional Commit history (fix → patch,\nfeat → minor, breaking → minor while pre-1.0 via bump-minor-pre-major),\nrewrites CHANGELOG.md, a\n[…]\n hidden.\n\nThe README's Contributing section documents the flow. One-time\nfollow-up when the first release PR opens: fold the hand-written\n\"Unreleased\" CHANGELOG section into the generated 0.4.0 notes.",
          "is_bot": false,
          "headline": "ci: wire up Release Please for tag and changelog automation",
          "author_name": "Daniel Bancsi",
          "author_login": "bancsdan",
          "committed_at": "2026-06-11T07:53:32Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "410b5bce29a8c596519975ce840cbc59bd04929a",
          "body": "…cloud-neutral\n\n- Quickstart Supplier example now includes Address.AdditionalDetail,\n  which the mapper requires (NAV's simpleAddress demands a non-blank\n  additionalAddressDetail).\n- The multi-replica / rate-limit section described only the AWS pattern\n  (ECS/EKS, NAT Gateway, Elastic IPs); the per\n[…]\ne implementation of it).\n- Package layout: submission.go described as the re-export shim it is,\n  tree indentation fixed (invoicemap/storeinmem/submission siblings),\n  docs/EMBED.md added to the tree.",
          "is_bot": false,
          "headline": "docs(readme): fix inconsistencies and make the multi-replica section …",
          "author_name": "Daniel Bancsi",
          "author_login": "bancsdan",
          "committed_at": "2026-06-11T07:26:42Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9a9e114686946dac3df9cd42bee70c8f6d415e55",
          "body": "EMBED.md predated the claim/lease store design and was actively\nmisleading:\n- the SubmissionStore example showed a ListPending method that never\n  shipped and omitted ClaimBatch/RenewClaim/ReleaseClaim — a store\n  implemented from this page would not compile;\n- the worker-lifecycle section advised s\n[…]\nrts.\n\nAlso raises Taskfile's test:e2e -timeout from 180s to 1800s to match\nCI — a single submission may legitimately wait ~150s on NAV's test\nenv, so the old value timed out the suite by construction.",
          "is_bot": false,
          "headline": "docs: bring EMBED.md and CHANGELOG in line with the current API",
          "author_name": "Daniel Bancsi",
          "author_login": "bancsdan",
          "committed_at": "2026-06-11T07:16:40Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "29a5f417bda549451eca862309401d90268bce7f",
          "body": "…ing left open\n\n- invoiceAsStorno and creditNoteAsInvoice now carry ListMeta through\n  their line-list clones, so the mapper's INVOICE_LINES_TRUNCATED guard\n  fires for stornos and credit notes exactly as it does for CREATEs.\n  Previously the rebuilt list dropped HasMore and a voided >10-line\n  invo\n[…]\nsion's\n  mapped payload (<exchangeRate>), so the reversal cancels the\n  original's HUF amounts exactly in NAV's invoice chain. A fresh\n  provider quote applies only when no parent submission is known.",
          "is_bot": false,
          "headline": "fix: close storno/credit-note gaps the truncation guard and FX anchor…",
          "author_name": "Daniel Bancsi",
          "author_login": "bancsdan",
          "committed_at": "2026-06-10T22:08:58Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "409cc04a04494c0877735b86b9a42ddfbabd6078",
          "body": "… aborting\n\nNAV's 24-hour window is a compliance deadline, not a validity cutoff:\nlate data reporting is still legally required, and reporting late (with\npossible default-penalty exposure) is strictly better than never\nreporting — which is what an aborted row amounted to. Worse, the abort\nalso fired\n[…]\nm Warn log and a \"deadline_exceeded\" metric event and\nkeep retrying. StatusAborted remains reachable only through the\nparent-failed path (a storno whose original was never accepted can\nnever succeed).",
          "is_bot": false,
          "headline": "fix(worker): keep retrying past the 24h reporting deadline instead of…",
          "author_name": "Daniel Bancsi",
          "author_login": "bancsdan",
          "committed_at": "2026-06-10T22:06:18Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1850aa8cce631bca7bfb478dc82204ad552d165b",
          "body": "…/sha3\n\ngolang.org/x/crypto/sha3 is now a thin forwarder to the standard\nlibrary's crypto/sha3 (Go ≥1.24), and govet's inline analyzer in CI's\ngolangci-lint 2.12 flags every call site. Switching to the stdlib\npackage fixes the lint failure and drops the x/crypto dependency\nentirely. The NAV spec's worked signature example in sign_test.go pins\nthat the output is byte-identical.",
          "is_bot": false,
          "headline": "fix(navclient): use stdlib crypto/sha3 instead of golang.org/x/crypto…",
          "author_name": "Daniel Bancsi",
          "author_login": "bancsdan",
          "committed_at": "2026-06-10T21:56:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1851a0fc788f5492f4af03aa1b2f88270d7e0730",
          "body": "… mapping edge cases\n\nCorrectness fixes:\n- worker: retriable queryTransactionStatus failures back off in place\n  via new markPollFailure, keeping the NAV transactionId. Previously\n  the requeue attempted a disallowed submitted→pending transition whose\n  error was silently discarded, leaving NextAtte\n[…]\nt merge, classification priority, PRIVATE_PERSON\nomission, supplier/customer address rules, 503-then-redeliver and\npermanent-200 ACK semantics.\n\nREADME and CHANGELOG updated for the behaviour changes.",
          "is_bot": false,
          "headline": "fix: resolve full code-review findings — poll requeue, ACK semantics,…",
          "author_name": "Daniel Bancsi",
          "author_login": "bancsdan",
          "committed_at": "2026-06-10T21:18:10Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "bc97ca0d27a5978287ae137335d3983f89424a42",
          "body": "…paths\n\n- worker: transport errors (network, DNS, TLS, http timeout) now default\n  to retriable so a transient failure doesn't terminally reject a row.\n  Previously attemptSubmit defaulted retriable=false for any non-*NAVError,\n  while pollStatus defaulted to true; this aligns both.\n- worker: replac\n[…]\nuire (was indirect\n  despite being used directly by internal/navclient).\n- gofmt envelope.go column alignment.\n- test: add TestWorker_TransportErrorRetries covering the retriable-\n  default fix above.",
          "is_bot": false,
          "headline": "fix: address review findings across worker, mapping, and credit-note …",
          "author_name": "Daniel Bancsi",
          "author_login": "bancsdan",
          "committed_at": "2026-06-10T19:06:16Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f593dbede24baf43726f1014e6a4080361b5afc8",
          "body": "…einmem\n\nWhen Config.Store is nil, the bridge now falls back to an internal\nin-memory store and emits a loud Warn log at handler init\n(\"submissions will be LOST on restart, do not use in production\").\nLocal-dev callers can construct a working bridge with zero store\nconfig; production callers still M\n[…]\nSubmissionStore\nimplementations against stripenav.SubmissionStore see no change.\n\nVerified: vet, race-enabled unit tests, all 8 e2e tests pass.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "refactor: default Config.Store to internal in-memory store; hide stor…",
          "author_name": "Daniel Bancsi",
          "author_login": "bancsdan",
          "committed_at": "2026-06-05T23:15:34Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "c89ad34f4f503d44bfe01b8919e7a26e4cca9c5d",
          "body": "Slims the public API surface to what consumers actually need: the\nbridge handler + configs. The concrete NAV transport client and the\nStripe → NAV translation logic now live under internal/, invisible on\npkg.go.dev.\n\nPublic packages after this change:\n\n- nav/: Config, Software, InvoiceOperation, Ann\n[…]\ngram updated to reflect the new tree.\n\nVerified: all unit tests pass with -race, all 8 e2e tests pass\nagainst api-test.onlineszamla.nav.gov.hu.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "refactor: hide NAV client and mapping internals behind internal/",
          "author_name": "Daniel Bancsi",
          "author_login": "bancsdan",
          "committed_at": "2026-06-05T22:59:06Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "b0b011597aa0c84a7a3a5edfc85c122220b05b64",
          "body": "NAV's rate limit is per source IP, not per technical user or per\nprocess. In a standard ECS Fargate / EKS deployment with private\nsubnets and a NAT Gateway, every replica appears to NAV as the same\nIP (the NAT Gateway's Elastic IP), so N replicas at the library's\ndefault 1 req/s collectively hit NAV\n[…]\n ignore all of this.\n\nAlso tightens the existing bullet to say \"per-source-IP\" rather than\nthe previous \"per-technical-user\" (which was wrong).\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs(readme): explain NAV's per-IP rate limit for multi-replica setups",
          "author_name": "Daniel Bancsi",
          "author_login": "bancsdan",
          "committed_at": "2026-06-05T22:11:45Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "88c2be68a5146fb250a4428aabb95ec2bd4b3da4",
          "body": "Even with the storeinmem duplicate-claim fix, the deferred ReleaseClaim\non lifecycle exit could still race with the renewLease goroutine: the\nold defer order ran cancelLease() first then ReleaseClaim, but didn't\nwait for renewLease to actually exit. If renew was mid-RenewClaim when\ncancel signalled,\n[…]\ner: cancel →\nwait → release. Eliminates the cleanup race independently of the\nstoreinmem fix; both together close the spurious-warning surface.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(worker): wait for lease-renew goroutine before releasing claim",
          "author_name": "Daniel Bancsi",
          "author_login": "bancsdan",
          "committed_at": "2026-06-05T22:06:56Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "e44266227a1fcbb4aba542e7470028903bdae409",
          "body": "ClaimBatch's skip predicate was \"skip if held by SOMEONE ELSE with a\nvalid lease\" — but a row already held by us with a valid lease was\nNOT skipped. So when a sleeping lifecycle's NextAttemptAt came due,\nthe next worker tick would re-claim the same row and spawn a SECOND\nlifecycle goroutine for it. \n[…]\n (ClaimedUntil < now), at which point the new worker\nprocess (different ClaimerID from the hostname+random-suffix default)\nre-claims as normal.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(storeinmem): don't re-claim rows we already hold",
          "author_name": "Daniel Bancsi",
          "author_login": "bancsdan",
          "committed_at": "2026-06-05T22:06:47Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "8671ae10ec679df01175d16709e6569d482a4e7c",
          "body": "NAV throttles a technical user that exceeds roughly one request per\nsecond across all endpoints. Without a client-side limiter a burst of\nsubmits / polls (especially during retry storms or initial backfills)\nwill start drawing 429s from NAV and tripping the worker's retry\nbackoff for no real reason.\n[…]\n inter-request spacing of ≥80ms — generous\nslack for goroutine scheduling jitter but tight enough to catch a\nregression where Wait is bypassed.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(nav): rate-limit outbound requests to 1/s by default",
          "author_name": "Daniel Bancsi",
          "author_login": "bancsdan",
          "committed_at": "2026-06-05T22:06:34Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "03ed224212df0728177382987024f6dd4b03f67f",
          "body": "CI hit a timeout on TestE2E_DomesticCustomer_AcceptedAtNAV — the\nsubmission had a real transactionId and was stuck in PROCESSING at\nNAV after 90s. Locally the same test resolves in ~2.5s, so the\ndelta is almost certainly higher latency from the CI runner to\nNAV's HU endpoint plus variable NAV-side q\n[…]\nated `env:` block on the e2e step that, on the\nprior diff, would have wiped out every NAV/SUPPLIER secret and made\nthe job fail authentication.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "ci: raise E2E timeouts for NAV test-env latency spikes",
          "author_name": "Daniel Bancsi",
          "author_login": "bancsdan",
          "committed_at": "2026-06-05T21:33:00Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "f8630f81984cb871989ee037e05e031a24e08a99",
          "body": "Every yyyy-MM-dd field submitted to NAV was being formatted from a\nUTC time, which produced the wrong calendar date for invoices\nfinalized in the 22:00–00:00 UTC window (the equivalent local\nHungarian time is past midnight on the next day). NAV's auditors\ncompare the rendered date against the local \n[…]\nnvoiceIssueDate and\n  InvoiceDeliveryDate use the HU date.\n\nREADME documents the trade-off so integrators know about the winter\none-hour drift.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(mapping): render NAV date fields in Hungarian calendar (UTC+2)",
          "author_name": "Daniel Bancsi",
          "author_login": "bancsdan",
          "committed_at": "2026-06-05T19:57:20Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "f89ae81a3b0b465f20f21fbfa55221d232622995",
          "body": "invoiceAsStorno was doing a shallow clone of *stripe.Invoice, which\npreserved the pointer to StatusTransitions. The mapper then read\nFinalizedAt off that struct and emitted it as the STORNO's\ninvoiceIssueDate / invoiceDeliveryDate — i.e. the original CREATE's\nissue date. Per Áfa tv. §169 the storno \n[…]\nssueDate) pins both that the clone\ncarries the new date and that the original invoice's\nStatusTransitions / Lines are not mutated by the clone.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(credit_note): give STORNO its own issue date",
          "author_name": "Daniel Bancsi",
          "author_login": "bancsdan",
          "committed_at": "2026-06-05T19:57:09Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "6730270554efe3eac6a711d24aad2a4a08971a04",
          "body": "Previously, renewLease returning on a RenewClaim error left the\nlifecycle goroutine running under a stale claim — leaseCtx was only\ncancelled by the lifecycle's own defer, not by renew failure. If\nanother replica had stolen the claim, both could continue calling\nUpdateStatus and submit duplicate inv\n[…]\nlient's submit blocks. Asserts the row stays Pending and\nTransactionID empty — i.e. no submit-success transition happened\nunder the lost claim.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(worker): cancel lifecycle when lease renewal fails",
          "author_name": "Daniel Bancsi",
          "author_login": "bancsdan",
          "committed_at": "2026-06-05T19:56:57Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "c97636664fd28b315b8ff9c2aab6823fdedf5fc6",
          "body": "Extends both unit and e2e coverage to the scenarios identified as\nreal but untested code paths.\n\nUnit:\n- mapping/mapping_test TestMapInvoice_EUReverseChargeCustomer: DE\n  buyer with eu_vat → OTHER + communityVatNumber; 0% line currently\n  ships as vatPercentage=0.00 with no vatOutOfScope. The test p\n[…]\nnessOpts variadic on\nnewHarness to plumb the ExchangeRateProvider through cleanly.\n\nAll 8 e2e tests pass in ~23s; unit suite passes with -race.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "test: cover EU reverse-charge, mixed VAT, foreign currency, fat payload",
          "author_name": "Daniel Bancsi",
          "author_login": "bancsdan",
          "committed_at": "2026-06-03T16:25:46Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "27af2c909942a20deba152011fe24d37e46f7232",
          "body": "Extends the e2e harness to validate the recent mapper changes against\nthe real NAV test environment. Each new test owns its own file and\nasserts the submission reaches StatusAccepted with a non-empty NAV\ntransactionId:\n\n- subscription_invoice_test.go: billing_reason=subscription_cycle +\n  period_sta\n[…]\n per-scenario files so it's clear\nwhat coverage exists.\n\nAll five tests pass end-to-end against api-test.onlineszamla.nav.gov.hu\nin ~15s total.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "test(e2e): cover subscription, inclusive-tax, domestic customer, void",
          "author_name": "Daniel Bancsi",
          "author_login": "bancsdan",
          "committed_at": "2026-06-03T15:25:33Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "9d51808a884649db634ebfcb38d7003f0d32bdfe",
          "body": "Contributing block sets PR expectations up front: Conventional\nCommits, test-or-it-rots, big.Rat-only money math, net+vat=gross\nreconciliation contract, NAV XSD field-order rule for schema edits,\nREADME-in-same-PR hygiene, and \"don't expand scope beyond the\nchange.\"\n\nRoadmap surfaces the known limit\n[…]\ning work, with credit-note correctness\nfixes at the top (since the README now flags them as broken) and\nergonomics + audit-defense items below.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs(readme): add Contributing and Roadmap sections",
          "author_name": "Daniel Bancsi",
          "author_login": "bancsdan",
          "committed_at": "2026-06-02T21:26:51Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "b281f01a4da381e4d37d5da1b22597c1ed1a2ab9",
          "body": "The README previously claimed both credit_note.created and\ncredit_note.voided map cleanly to a NAV MODIFY. In reality the\ncurrent implementation has four known issues, two of which are\nsilent data-corruption bugs:\n\n1. credit_note.voided produces another negative MODIFY rather than a\n   reversing pos\n[…]\ndistinguished.\n\nThis commit only updates the README so callers can decide whether to\nsubscribe to these events; the code fixes are a follow-up.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs(readme): flag credit_note.* handling as broken",
          "author_name": "Daniel Bancsi",
          "author_login": "bancsdan",
          "committed_at": "2026-06-02T21:24:26Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "a057fb98de6c1bdc4ef7d4258b4a8498e205ab60",
          "body": "Two related correctness fixes surfaced by a real Stripe Tax HUF payload\nwhere line.amount=1000000 (gross), taxes[0].amount=212598 (VAT),\ntax_behavior=\"inclusive\".\n\n1. Inclusive vs exclusive tax behavior. The mapper previously assumed\n   every line's amount was net and computed gross = amount + vat. \n[…]\nveTax with the real-payload numbers and\nTestMapInvoice_NetVatGrossReconciles that pins the rounding contract.\nREADME documents both behaviours.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(mapping): handle Stripe Tax inclusive pricing and reconcile rounding",
          "author_name": "Daniel Bancsi",
          "author_login": "bancsdan",
          "committed_at": "2026-06-02T19:42:33Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "2f82f625afc5f24501d4698c37abce8785fa2c70",
          "body": "Switch from billing_reason=\"subscription_*\" to the more honest signal\nperiod_end > period_start. The prefix check missed subscription\ninvoices originated from accepted quotes (billing_reason=quote_accept)\nand was a derivative signal anyway — the period span is the literal\nexpression of \"this invoice\n[…]\ntest alongside the existing subscription\ncycle test. README updated to describe the period-span rule and why it\nbeats the billing_reason check.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "refactor(mapping): detect §58 periodicity via period span",
          "author_name": "Daniel Bancsi",
          "author_login": "bancsdan",
          "committed_at": "2026-06-02T14:41:10Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "356a6f0378e0e0fe8edb53853a6fc5c5b1fc3e79",
          "body": "Stripe invoices with billing_reason starting with \"subscription_\" now\npopulate the NAV §58 fields (periodicalSettlement,\ninvoiceDeliveryPeriodStart/End) from invoice.period_start/end. Under\nthe advance-billing rule that Stripe's charge_automatically default\nfollows, the §58 tax point equals the invo\n[…]\nses:\nsubsequent billing (utólagos / metered subscriptions), unimplemented\nelectronicInvoiceHash, and the lack of paymentMethod auto-derivation.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(mapping): support §58 periodic settlement for subscriptions",
          "author_name": "Daniel Bancsi",
          "author_login": "bancsdan",
          "committed_at": "2026-06-02T14:24:08Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "c2fcee368f744144cc32d1d96566456914804956",
          "body": "Drift accumulated across the v0.3.0 store refactor and the recent e2e\nwork. Updates:\n\n- SubmissionStore interface gains ClaimBatch / RenewClaim / ReleaseClaim\n  (replaces the old ListPending), with a paragraph on the SKIP LOCKED\n  + TTL-lease contract.\n- Config block lists the new WorkerMaxSleep / W\n[…]\nection documents the e2e/ package, the navtest build tag,\n  `task test:e2e`, the .env workflow, and the CI wiring.\n- Package layout lists e2e/.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs(readme): refresh for claim-based store, worker pacing, e2e harness",
          "author_name": "Daniel Bancsi",
          "author_login": "bancsdan",
          "committed_at": "2026-06-02T09:48:45Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "34dc71b8ee4143e74b38a7bc54a0794e6db04f4f",
          "body": "The lifecycle goroutine re-reads its row after each step. During\nHandler.Shutdown the context is canceled mid-loop, so the Get fails\nwith context.Canceled — expected, not actionable. Swallow that case\nsilently; only warn on other errors. Eliminates the per-claim\n\"post-action get failed\" noise visible in CI test logs.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(worker): don't warn on context cancellation during shutdown",
          "author_name": "Daniel Bancsi",
          "author_login": "bancsdan",
          "committed_at": "2026-06-01T21:02:01Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "d102167ce29e8bcf56f44aef205df13b1137a978",
          "body": "Lets you re-run E2E against NAV from the Actions tab on an arbitrary\nbranch — useful when debugging a NAV-side issue or re-running a job\nafter rotating credentials, without having to push a new commit.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "ci: allow manual workflow_dispatch on any branch",
          "author_name": "Daniel Bancsi",
          "author_login": "bancsdan",
          "committed_at": "2026-06-01T20:58:34Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "611f64c509c43af02869a9630222a13c65dcda12",
          "body": "Adds an e2e job parallel to the existing test job. Env vars come from\nrepository secrets (NAV_*, SUPPLIER_*). On PRs from forks the secrets\nare empty and loadEnv calls t.Skip, so the job passes neutrally\nwithout leaking credentials.\n\nA concurrency group cancels superseded runs so a flurry of pushes\ndoesn't pile up against NAV's test endpoint.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "ci: run E2E against NAV test env on PR and main",
          "author_name": "Daniel Bancsi",
          "author_login": "bancsdan",
          "committed_at": "2026-06-01T20:47:16Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "686dcd2c18b8b554bd41da22e7baccab81127538",
          "body": "Gated behind the navtest build tag so `go test ./...` never touches\nNAV. The first scenario (invoice.finalized → accepted) exercises the\nfull bridge: signed Stripe payload → handler → in-mem store →\nworker → real NAV submit → poll → accepted with a NAV transaction id.\n\nLocal creds live in e2e/.env (\n[…]\ntask\ntest:e2e` loads the dotenv file and runs the suite — Task's dotenv\ndirective handles unquoted values with spaces, which `source` does\nnot.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "test(e2e): add NAV test-environment harness",
          "author_name": "Daniel Bancsi",
          "author_login": "bancsdan",
          "committed_at": "2026-06-01T20:41:44Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "b15089ec1b2e1b0fa6ffc4d1bb98c03febdfaa74",
          "body": "When NAV rejected a submission, the worker recorded only\n\"NAV reported ABORTED\" and threw away the per-line technical and\nbusiness validation messages. Debugging an aborted invoice then\nrequired logging into the NAV portal manually. Capture ERROR and\nCRITICAL messages into LastError so prod operators (and the E2E\nharness) see the actual reason without re-querying.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(worker): surface NAV validation messages on ABORTED",
          "author_name": "Daniel Bancsi",
          "author_login": "bancsdan",
          "committed_at": "2026-06-01T20:41:37Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "4e8e326dab84343cff9e72c1748f6ab9232f8c89",
          "body": "BREAKING: SubmissionStore interface changes.\n- ListPending removed.\n- ClaimBatch(ctx, claimer, limit, lease) added: returns rows the\n  caller has claimed for lease duration. Implementations MUST\n  ensure concurrent ClaimBatch calls do not return the same row.\n- RenewClaim/ReleaseClaim added for leas\n[…]\nllInterval +\nLeaseDuration + ClaimerID. Config gains WorkerMaxSleep /\nWorkerPollInterval / WorkerLeaseDuration / WorkerClaimerID.\n\nDefaults: MaxSleep=10s (was 30s), PollInterval=5s,\nLeaseDuration=60s.",
          "is_bot": false,
          "headline": "v0.3.0: claim-based store + per-lifecycle goroutines",
          "author_name": "Daniel Bancsi",
          "author_login": "bancsdan",
          "committed_at": "2026-06-01T19:30:02Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "bc762efe482288bf77614439a12219895fa9161f",
          "body": "Lets callers override how often the background worker scans the\nstore. Defaults to 30s (existing behaviour). Set lower in local\ndevelopment for snappier processing without baking dev tunables\ninto the library.",
          "is_bot": false,
          "headline": "Expose WorkerTickInterval on Config",
          "author_name": "Daniel Bancsi",
          "author_login": "bancsdan",
          "committed_at": "2026-05-31T11:37:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "57314d8fe090bf24ee9dd890cceb1af73e2c44b2",
          "body": "Split the binary, Dockerfile, Postgres adapter, and deployment docs\nout into the sibling stripenav repo\n(github.com/bancsdan/stripenav). This repo is now a library only:\nfive Go packages, godoc, tests, the storeinmem reference, and the\nNAV sample XMLs for reference.\n\nRemoved:\n- cmd/                 \n[…]\nGo module\nwith no container or DB infrastructure. The service repo handles\nthe deployable artifact.\n\nREADME rewritten to point at the service repo for the\n\"don't-write-Go-or-don't-want-to-embed\" path.",
          "is_bot": false,
          "headline": "Promote bridge to a deployable container",
          "author_name": "Daniel Bancsi",
          "author_login": "bancsdan",
          "committed_at": "2026-05-31T11:13:17Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1b51eb50201c4e9b2b1c85d1cad9c2298aa696f5",
          "body": "Three additions, all wiring up the cmd/ binary into a production-ready\ncontainer artifact:\n\n1. Postgres SubmissionStore (cmd/internal/storepg)\n   - pgx/v5-backed implementation of stripenav.SubmissionStore.\n   - Embedded schema migration (idempotent, run on Open).\n   - SELECT ... FOR UPDATE in Updat\n[…]\nple with bundled postgres, and updates the\n     scaling section to reflect the new safety guarantees.\n\nContainer size after additions: 12.9 MB (was 9.2 MB; +3.7 MB for\npgx/v5 and its transitive deps).",
          "is_bot": false,
          "headline": "Postgres SubmissionStore, --healthcheck flag, README refresh",
          "author_name": "Daniel Bancsi",
          "author_login": "bancsdan",
          "committed_at": "2026-05-31T10:47:55Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "13b0fc55a09662fb22a0d7a1bd415d0a917bc927",
          "body": "Restructures the repo so the bridge has two distribution channels\nsharing one source tree:\n\n- Go library at github.com/bancsdan/go-stripenav (unchanged).\n- Docker image at ghcr.io/bancsdan/go-stripenav, built from\n  cmd/gostripenav and published on every v* tag.\n\nLayout changes\n- cmd/ becomes a nest\n[…]\n              clean (both modules)\n- go test ./... -count=1                all pass\n- go build ./cmd/gostripenav ./cmd/nav-status  build clean\n- docker build .                       9.2 MB final image",
          "is_bot": false,
          "headline": "Promote bridge to a deployable container",
          "author_name": "Daniel Bancsi",
          "author_login": "bancsdan",
          "committed_at": "2026-05-31T09:32:34Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "fe32e5670e5f1dd3aa88dd8f4b06644b492d6f8e",
          "body": "These XML files are NAV-published reference samples, not test\nfixtures we read at runtime. docs/ is the well-known place for\n\"files that aren't code\" and gets the prototype-era folder out\nof the repo root.\n\nAlso adds a README enumerating each sample's endpoint and points\nthe schema-regeneration doc at the new location.",
          "is_bot": false,
          "headline": "Move NAV API samples under docs/",
          "author_name": "Daniel Bancsi",
          "author_login": "bancsdan",
          "committed_at": "2026-05-31T08:58:20Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "11194775e690d39b8c5b371b65fe24ab43dd9175",
          "body": "Adds examples/go.mod so the example code becomes a separate module\nunder github.com/bancsdan/go-stripenav/examples. A replace directive\nbinds the examples back to the parent checkout for local dev.\n\nA go.work at the repo root ties both modules into one workspace, so\nexisting dev workflows (task dev,\n[…]\neps. Importers see only\nthe library packages (stripenav, mapping, nav, nav/schemas,\nstoreinmem). The local development experience is unchanged.\n\nAlso gitignores go.work.sum (generated workspace lock).",
          "is_bot": false,
          "headline": "Hoist examples/ into a nested Go module",
          "author_name": "Daniel Bancsi",
          "author_login": "bancsdan",
          "committed_at": "2026-05-31T08:51:08Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c63f74f1d2eba2ad43986e2b3552d534030a6b35",
          "body": "A Go package that bridges Stripe webhook events to Hungary's NAV\nOnline Számla v3.0 invoice reporting API, satisfying the 24-hour\ndomestic invoice reporting requirement.\n\nSurface:\n- stripenav.Handler — embeddable webhook http.Handler\n- mapping.MapInvoice — pure Stripe → NAV InvoiceData translator\n- \n[…]\neference SubmissionStore\n\nRouting: invoice.finalized → CREATE, invoice.voided /\ninvoice.marked_uncollectible → STORNO, credit_note.created/voided\n→ MODIFY. ANNUL is reserved for out-of-band admin use.",
          "is_bot": false,
          "headline": "Initial commit: Stripe → NAV Online Számla v3.0 bridge",
          "author_name": "Daniel Bancsi",
          "author_login": "bancsdan",
          "committed_at": "2026-05-31T08:33:18Z",
          "body_truncated": true,
          "is_coding_agent": false
        }
      ],
      "releases_count": 2,
      "commits_last_year": 46,
      "latest_release_at": "2026-07-14T22:39:50Z",
      "latest_release_tag": "v0.4.1",
      "releases_from_tags": false,
      "days_since_last_push": 12,
      "active_weeks_last_year": 4,
      "days_since_latest_release": 12,
      "mean_days_between_releases": 33.6
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": false,
      "health_percentage": 42,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "github.com/bancsdan/go-stripenav",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": true,
          "registry_url": "https://pkg.go.dev/github.com/bancsdan/go-stripenav",
          "is_deprecated": false,
          "latest_version": "v0.4.1",
          "repository_url": "https://github.com/bancsdan/go-stripenav",
          "versions_count": 5,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-14T22:39:41Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 12
        }
      ]
    },
    "popularity": {
      "forks": 0,
      "stars": 1,
      "watchers": 0,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 0
      },
      "star_history": null,
      "open_issues_and_prs": 0
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [],
      "has_llms_txt": false,
      "has_dockerfile": false,
      "has_mcp_signal": false,
      "bootstrap_files": [
        "Taskfile.yml"
      ],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [
        "go.mod"
      ],
      "largest_source_bytes": 29845,
      "source_files_sampled": 52,
      "oversized_source_files": 0,
      "agent_instruction_files": [],
      "agent_instruction_max_bytes": null
    },
    "dependencies": {
      "manifests": [
        "go.mod"
      ],
      "advisories": {
        "error": null,
        "scope": null,
        "source": null,
        "findings": [],
        "collected": false,
        "malicious": [],
        "truncated": false,
        "by_severity": {},
        "advisory_count": 0,
        "affected_count": 0,
        "assessed_count": 0,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "go"
      ],
      "dependencies": [
        {
          "name": "github.com/stripe/stripe-go/v82",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v82.5.1"
        },
        {
          "name": "golang.org/x/time",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.15.0"
        }
      ],
      "all_dependencies": {
        "error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
        "source": null,
        "packages": [],
        "collected": false,
        "truncated": false,
        "total_count": null,
        "direct_count": null,
        "indirect_count": null
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 2,
        "open_issues": 0,
        "closed_ratio": null,
        "closed_issues": 0,
        "closed_unmerged_prs": 0
      },
      "bus_factor": 1,
      "bot_contributors": 1,
      "top_contributors": [
        {
          "type": "User",
          "login": "bancsdan",
          "commits": 44,
          "avatar_url": "https://avatars.githubusercontent.com/u/7544608?v=4"
        }
      ],
      "contributors_sampled": 1,
      "top_contributor_share": 1
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "ci.yml",
        "release-please.yml"
      ],
      "has_docs_dir": true,
      "linter_configs": [
        ".golangci.yml"
      ],
      "has_editorconfig": false,
      "has_linter_config": true,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "go.sum"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 0,
            "reason": "0 out of 2 merged PRs checked by a CI test -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/26 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 0,
            "reason": "project has 0 contributing companies or organizations -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 0,
            "reason": "no update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 0,
            "reason": "project was created within the last 90 days. Please review its contents carefully",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": null,
            "reason": "packaging workflow not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 0,
            "reason": "dependency not pinned by hash detected -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "SAST tool is not run on all commits -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 0,
            "reason": "security policy file not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": null,
            "reason": "no releases found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 3,
            "reason": "7 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "82573f13419d5db5c92b1ce7bce5bb643a839fad",
        "ran_at": "2026-07-27T17:08:17Z",
        "aggregate_score": 2.4,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": false,
      "has_dependabot_config": false
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-14T22:39:57Z",
      "oldest_open_prs": [],
      "last_merged_pr_at": "2026-07-14T22:39:41Z",
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": []
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/bancsdan/go-stripenav",
    "host": "github.com",
    "name": "go-stripenav",
    "owner": "bancsdan"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "at_risk",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 49,
      "inputs": {
        "security": 24,
        "vitality": 68,
        "community": 24,
        "governance": 51,
        "engineering": 68
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "moderate",
        "name": "Vitality",
        "value": 68,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "at_risk",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 47,
            "inputs": {
              "commits_last_year": 46,
              "human_commit_share": 0.957,
              "days_since_last_push": 12,
              "active_weeks_last_year": 4
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 12 days ago",
                "points": 28.8,
                "status": "partial",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 12
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "4/52 weeks with commits",
                "points": 2.8,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 4
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "46 commits in the last year",
                "points": 15,
                "status": "partial",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 46
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "releases_count": 2,
              "latest_release_tag": "v0.4.1",
              "releases_from_tags": false,
              "days_since_latest_release": 12,
              "mean_days_between_releases": 33.6
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "2 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 12 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 12
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~33.6 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 33.6
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "critical",
        "name": "Community & Adoption",
        "value": 24,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 1,
            "inputs": {
              "forks": 0,
              "stars": 1,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "1 stars",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "0 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "moderate",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 50,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": false,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (MIT)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "MIT"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "moderate",
        "name": "Sustainability & Governance",
        "value": 51,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 10,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 1,
              "top_contributor_share": 1
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 100% of commits",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 100
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "1 contributors",
                "points": 1.4,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 0 contributing companies or organizations -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "good",
            "name": "Issue & PR responsiveness",
            "note": "Excluded from scoring (no data or not applicable): Issue resolution. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "issue_resolution"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 72,
            "inputs": {
              "merged_prs": 2,
              "open_issues": 0,
              "closed_issues": 0,
              "issue_closed_ratio": null,
              "closed_unmerged_prs": 0
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "no issues or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_issues_or_data",
                    "params": {}
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "2/2 decided PRs merged",
                "points": 38.2,
                "status": "met",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 2,
                      "decided": 2
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/26 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "at_risk",
            "name": "Ownership & stewardship",
            "note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "verified_domain"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 39,
            "inputs": {
              "followers": 1,
              "owner_type": "User",
              "is_verified": null,
              "owner_login": "bancsdan",
              "public_repos": 8,
              "account_age_days": 4460
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "personal (user) account",
                "points": 10,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_personal",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": "not applicable to user accounts",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_applicable_to_user_accounts",
                    "params": {}
                  }
                ],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "1 followers of bancsdan",
                "points": 2.2,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 1,
                      "login": "bancsdan"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "8 public repos, account ~12 yr old",
                "points": 18.9,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 8
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 12
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "github.com/bancsdan/go-stripenav"
              ],
              "ecosystems": "go",
              "any_deprecated": false,
              "min_days_since_publish": 12
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on go",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "go"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 12 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 12
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "5 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 5
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "moderate",
        "name": "Engineering Quality",
        "value": 68,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "moderate",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 64,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": true,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "2 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": ".golangci.yml",
                "points": 16,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yml"
                    }
                  }
                ],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "0 out of 2 merged PRs checked by a CI test -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "good",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 75,
            "inputs": {
              "topics": [],
              "has_wiki": true,
              "homepage": null,
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "critical",
        "name": "Security",
        "value": 24,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "critical",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): Packaging, Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "packaging",
                    "signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 24,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 16,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 2,
              "scorecard_aggregate": 2.4
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "0 out of 2 merged PRs checked by a CI test -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/26 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 0 contributing companies or organizations -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "no update tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow not detected",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool is not run on all commits -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file not detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "7 existing vulnerabilities detected",
                "points": 2.2,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "good",
        "name": "AI Readiness",
        "value": 70,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "at_risk",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 0.977,
              "agent_instruction_files": [],
              "agent_instruction_max_bytes": null
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "no CLAUDE.md / AGENTS.md / editor rules",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_instructions",
                    "params": {}
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "43 of 44 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 43,
                      "sampled": 44
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "good",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 82,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "go.sum"
              ],
              "has_dockerfile": false,
              "typed_language": true,
              "bootstrap_files": [
                "Taskfile.yml"
              ],
              "has_devcontainer": false,
              "has_linter_config": true,
              "typecheck_configs": [],
              "agent_commit_share": 0.5,
              "toolchain_manifests": [
                "go.mod"
              ],
              "dependency_bot_commit_share": 0
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "Taskfile.yml",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Taskfile.yml"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": ".golangci.yml",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yml"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "Go (statically typed)",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "23 of the last 46 commits agent-authored or agent-credited",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "agent_authored_commits",
                    "params": {
                      "count": 23,
                      "sampled": 46
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "no automated dependency updates observed",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_dependency_automation",
                    "params": {}
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "Go",
              "largest_source_bytes": 29845,
              "source_files_sampled": 52,
              "oversized_source_files": 0
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Go (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "0/52 source files over 60KB",
                "points": 55,
                "status": "met",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 52,
                      "oversized": 0
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
    "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-27T17:08:24.958679Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/b/bancsdan/go-stripenav.svg",
  "full_name": "bancsdan/go-stripenav",
  "license_state": "standard",
  "license_spdx": "MIT"
}

Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.

Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v1.13.0, schema v0.27.0 — full methodology · metrics wiki.

How one result sits in the wider record: aggregate statistics — Go.

Software health index

Score profile

Ownership

Package ecosystems

Metrics by category

Key facts

Data collection warnings

More detail

Related records