delano / otto

Full resolved dependency set from the GitHub dependency graph: 0 direct and 83 indirect (transitive) packages. The transitive closure is complete when the repository commits a lockfile.

This repository publishes no package the index resolves, so its own dependency graph was assessed — 77 packages, which also include development and test pins that never ship: 0 carry known advisories, of which 0 are direct. 6 could not be assessed — no resolved version, an unsupported ecosystem, or beyond the reported package list.

No known advisories affect the assessed dependencies.

An advisory means the version recorded in the dependency graph falls inside an advisory’s affected range. Reachability is not analysed, and the graph includes development and test pins — a finding may concern tooling rather than shipped software.

{
  "data": {
    "repo": {
      "topics": [],
      "is_fork": false,
      "size_kb": 2522,
      "has_wiki": false,
      "homepage": null,
      "languages": {
        "Ruby": 1441925
      },
      "pushed_at": "2026-08-03T09:53:25Z",
      "created_at": "2011-07-07T04:03:25Z",
      "owner_type": "User",
      "updated_at": "2026-08-03T09:51:38Z",
      "description": "Define your Ruby 3 Rack apps in plain-text.",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "MIT",
      "default_branch": "main",
      "license_spdx_raw": "MIT",
      "primary_language": "Ruby",
      "significant_languages": [
        "Ruby"
      ]
    },
    "owner": {
      "blog": "https://onetimesecret.com/",
      "name": "Delano",
      "type": "User",
      "login": "delano",
      "company": "@onetimesecret",
      "location": "Canada",
      "followers": 365,
      "avatar_url": "https://avatars.githubusercontent.com/u/1206?v=4",
      "created_at": "2008-02-27T22:46:05Z",
      "is_verified": null,
      "public_repos": 95,
      "account_age_days": 6731
    },
    "license": {
      "state": "standard",
      "spdx_id": "MIT",
      "raw_spdx": "MIT",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v2.7.0-coda",
          "kind": "prerelease",
          "published_at": "2026-08-03T09:53:25Z"
        },
        {
          "tag": "v2.6.0",
          "kind": "minor",
          "published_at": "2026-07-10T10:13:16Z"
        },
        {
          "tag": "v2.5.0",
          "kind": "minor",
          "published_at": "2026-07-03T06:55:09Z"
        },
        {
          "tag": "v2.4.0",
          "kind": "minor",
          "published_at": "2026-07-01T06:51:55Z"
        },
        {
          "tag": "v2.3.1",
          "kind": "patch",
          "published_at": "2026-06-22T02:58:16Z"
        },
        {
          "tag": "v2.3.0",
          "kind": "minor",
          "published_at": "2026-06-21T22:48:39Z"
        },
        {
          "tag": "v2.2.0",
          "kind": "minor",
          "published_at": "2026-06-09T08:15:26Z"
        },
        {
          "tag": "v2.1.1",
          "kind": "patch",
          "published_at": "2026-05-27T06:20:18Z"
        },
        {
          "tag": "v2.1.0",
          "kind": "minor",
          "published_at": "2026-05-27T06:09:31Z"
        },
        {
          "tag": "v2.0.0",
          "kind": "major",
          "published_at": "2026-03-15T05:53:18Z"
        },
        {
          "tag": "v2.0.0-pre10",
          "kind": "prerelease",
          "published_at": "2025-12-10T05:56:21Z"
        },
        {
          "tag": "v2.0.0-pre9",
          "kind": "prerelease",
          "published_at": "2025-12-07T07:15:34Z"
        },
        {
          "tag": "v2.0.0-pre8",
          "kind": "prerelease",
          "published_at": "2025-11-27T08:47:44Z"
        },
        {
          "tag": "v2.0.0-pre7",
          "kind": "prerelease",
          "published_at": "2025-11-24T07:39:43Z"
        },
        {
          "tag": "v2.0.0-pre4",
          "kind": "prerelease",
          "published_at": "2025-10-21T06:11:14Z"
        },
        {
          "tag": "v2.0.0-pre3",
          "kind": "prerelease",
          "published_at": "2025-10-15T20:40:49Z"
        },
        {
          "tag": "v2.0.0-pre2",
          "kind": "prerelease",
          "published_at": "2025-10-12T01:50:54Z"
        },
        {
          "tag": "v2.0.0-pre1",
          "kind": "prerelease",
          "published_at": "2025-09-13T01:32:11Z"
        },
        {
          "tag": "v1.6.0",
          "kind": "minor",
          "published_at": "2025-08-13T00:42:40Z"
        },
        {
          "tag": "v1.5.0",
          "kind": "minor",
          "published_at": "2025-08-12T18:00:05Z"
        },
        {
          "tag": "v1.4.0",
          "kind": "minor",
          "published_at": "2025-08-04T00:35:56Z"
        },
        {
          "tag": "v1.3.0",
          "kind": "minor",
          "published_at": "2025-08-03T20:49:17Z"
        },
        {
          "tag": "v1.1.0-alpha4",
          "kind": "prerelease",
          "published_at": "2025-07-19T03:47:09Z"
        },
        {
          "tag": "v1.2.0",
          "kind": "minor",
          "published_at": "2025-08-03T20:33:33Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "d22322eb8520b10e15cab70fe1197a1123b771d8",
          "body": "Prepare 2.7.0 release: bump version and collect changelog",
          "is_bot": false,
          "headline": "Merge pull request #225 from delano/release/v2.7.0",
          "author_name": "Delano",
          "author_login": "delano",
          "committed_at": "2026-08-03T09:50:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2e0a04b2026fbb0358ccabe8e0b898ddfc00605a",
          "body": "Collects the five pending fragments (#206, #214, #218, #219, #220) plus a\nnew one for the configure_ip_privacy transactional/fail-loud fixes that\nlanded without one, then trims the aggregate to user-facing prose.",
          "is_bot": false,
          "headline": "Prepare 2.7.0 release: bump version and collect changelog",
          "author_name": "delano",
          "author_login": "delano",
          "committed_at": "2026-08-03T09:41:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "48ae9a119fcdf64ba2be2975a57cf1878f2c176d",
          "body": "feat: add IP precision capability and privacy profiles",
          "is_bot": false,
          "headline": "Merge pull request #218 from delano/feat/ip-precision-privacy-profiles",
          "author_name": "Delano",
          "author_login": "delano",
          "committed_at": "2026-08-03T09:31:50Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a811bd8b2cd1126e656c4ad2eb38655d201be99a",
          "body": null,
          "is_bot": false,
          "headline": "Merge branch 'main' into feat/ip-precision-privacy-profiles",
          "author_name": "Delano",
          "author_login": "delano",
          "committed_at": "2026-08-03T09:29:29Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cbcf756a5abd600e130a4fb14e914772989eff18",
          "body": "Dry-run knob assignments on a config copy and validate there before\ntouching the live config, so a rejected knob (e.g. octet_precision: 7\nafter a profile preset) can no longer leave a half-applied preset.\nAddresses the non-transactional-mutation finding from the PR #218\nreview.",
          "is_bot": false,
          "headline": "fix: make configure_ip_privacy all-or-nothing",
          "author_name": "delano",
          "author_login": "delano",
          "committed_at": "2026-08-03T09:27:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "37669771698b37fbbc0107009f25d6d0b2591c4f",
          "body": "…1CUwHiSGC4Tpuddo4tndxU\n\nAdd comprehensive SSE/WebSocket analysis and integration examples",
          "is_bot": false,
          "headline": "Merge pull request #223 from delano/claude/investigate-otto-routes-01…",
          "author_name": "Delano",
          "author_login": "delano",
          "committed_at": "2026-08-03T09:22:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a6c5a8b40fce9991bef607a2be6d0f8656899d11",
          "body": "- Add auth=session to the four routes whose Logic bodies read\n  context.user_id. Without it RouteAuthWrapper supplies\n  StrategyResult.anonymous, whose user_id is nil, so the snippets would\n  have silently polled and published for a nil identity.\n- Namespace the Mercure publish topic under context.u\n[…]\n matching the warning the adjacent\n  snippet already carries.\n- Replace Redis.current, removed in redis-rb 5.x, with a shared client\n  and a note pointing at connection_pool for production.\n\nRefs #224",
          "is_bot": false,
          "headline": "[#ROUTES-011] Fix QA findings in relocated streaming docs",
          "author_name": "delano",
          "author_login": "delano",
          "committed_at": "2026-07-31T18:59:32Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "34bd9b335fc00e74cde0070831da576920638ec3",
          "body": "…is docs\n\nThe two example files added in 6ab1228 targeted an Otto API surface that\ndoes not exist: Otto::RequestContext, enable_sessions!, raise_concern\n(singular), a session helper, and Rack::Handler::Puma under the Rack 3\npin. They also used symbol-keyed params, which Logic routes never\npopulate -\n[…]\nated identity rather than\n  request params\n- Note that each in-flight long poll holds a server thread for its full\n  timeout window\n- Split the client-side JavaScript out of a ```ruby fence\n\nRefs #224",
          "is_bot": false,
          "headline": "[#ROUTES-011] Drop non-functional streaming examples; relocate analys…",
          "author_name": "delano",
          "author_login": "delano",
          "committed_at": "2026-07-31T18:52:51Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "47b4b22a44e63a80c3aa1830cdc3966ecc98306a",
          "body": null,
          "is_bot": false,
          "headline": "Update IPPrivacyMiddleware idempotency documentation",
          "author_name": "delano",
          "author_login": "delano",
          "committed_at": "2026-07-30T22:58:36Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f87fb2ce6d3de9bcd3ebacd7d46e153226dc4df7",
          "body": "Follow-up to the profile: false guard fix, applying the same nil-guard\nconvention to the remaining truthiness-guarded kwargs (octet_precision,\nhash_rotation, redis): nil means \"leave unchanged\", any other value is\na real assignment that must take effect or fail validation loudly.\n\nvalidate! now type\n[…]\nme error-class\nprinciple the profile guard fix established.\n\nredis: false is stored but falsy, so it behaves as \"no connection\";\npinned by spec alongside the two raising paths and the 60-second floor.",
          "is_bot": false,
          "headline": "fix: fail loudly on falsy configure_ip_privacy knobs",
          "author_name": "delano",
          "author_login": "delano",
          "committed_at": "2026-07-30T20:28:06Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a411378a3293bfa0d0eaff9e2ac89252e97c4e76",
          "body": "# Conflicts:\n#\tlib/otto/security/middleware/ip_privacy_middleware.rb\n#\tlib/otto/utils.rb",
          "is_bot": false,
          "headline": "Merge branch 'main' into feat/ip-precision-privacy-profiles",
          "author_name": "delano",
          "author_login": "delano",
          "committed_at": "2026-07-30T20:26:08Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ddbc6aace242eaf9089f06ae8cf12f09ba34ae4e",
          "body": "…s and empty CIDR entries\n\nReview follow-ups from PR #218 (Claude bot review, minor notes):\n\n- Config.new and configure_ip_privacy guarded profile: with truthiness,\n  so profile: false silently skipped the preset while the setter raises.\n  Both sites now use nil guards, preserving the documented pro\n[…]\nle names accepted through Config.new, profile=, and\n  configure_ip_privacy; profile: false raises ArgumentError on both paths.\n- Doc: profile option tagged [Symbol, String] for parity with the setter.",
          "is_bot": false,
          "headline": "fix: reject profile: false at both option sites; cover String profile…",
          "author_name": "delano",
          "author_login": "delano",
          "committed_at": "2026-07-30T20:18:12Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "42a97ce10f851a199b15d2ae91aba5feeeaeebed",
          "body": "…-i2f9m2\n\n[#219] Run IPPrivacyMiddleware outermost so all middleware sees masked IPs",
          "is_bot": false,
          "headline": "Merge pull request #221 from delano/claude/ipprivacy-middleware-order…",
          "author_name": "Delano",
          "author_login": "delano",
          "committed_at": "2026-07-30T20:06:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "aa3570a1d3fee0e6dc3a577ca6c1121d93196a54",
          "body": "…auth-hvxwlq\n\nRouteAuthWrapper: terminal auth failures so mixed credentialed/noauth chains fail closed",
          "is_bot": false,
          "headline": "Merge pull request #222 from delano/claude/routeauthwrapper-terminal-…",
          "author_name": "Delano",
          "author_login": "delano",
          "committed_at": "2026-07-30T20:06:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "023c2889fbc39b69d13d12b4c90f32feeb23c33c",
          "body": "…-wins\n\nReview follow-up: the success log reported strategies_attempted as a\ncount while the failure log reported an array — same field, two types.\nBoth now log the executed-strategy array. Also document in the chain\nsemantics that when multiple strategies produce anonymous successes,\nthe first declared is the held fallback.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01FrxDuuvfNojQ3W1b13J4Vm",
          "is_bot": false,
          "headline": "[#220] Unify strategies_attempted log shape; document first-anonymous…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-30T08:15:30Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "6d2d0fe8ffe4a0a27d686d15bd2b39af48ecca3a",
          "body": "Two independent review passes read ordered_stack as request-path code and\nsuggested caching the sorted result with invalidation on mutation. It isn't:\n#wrap has exactly one caller, Otto's build_app!, which runs at construction\nand on stack change. Requests are served by the chain it returns, so the\n\n[…]\n the next reader doesn't add cache-invalidation\nmachinery to a cold path.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01HXyK53CrxTTfdutipBCpFG",
          "is_bot": false,
          "headline": "Note that wrap/ordered_stack run per build, not per request",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-30T08:13:23Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "2bb187418c79248a3c803068a758536975c43226",
          "body": "…emetry\n\n- Log a structured warning when a strategy returns something that is\n  neither a StrategyResult nor a failure type, instead of silently\n  skipping it; specs pin that the chain continues past it, that a later\n  terminal failure still fails closed, and that an all-unexpected chain\n  401s.\n- D\n[…]\nfallback is no longer omitted when a\n  later authenticated success wins.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01FrxDuuvfNojQ3W1b13J4Vm",
          "is_bot": false,
          "headline": "[#220] Review follow-ups: unexpected-type trace, accurate success tel…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-30T08:11:26Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "2a68344245fe08c884a76e2b810bfd4e97013a58",
          "body": "LocalhostGuard#relayed? reads header STATE, which IPPrivacyMiddleware has\nalready touched now that it runs outermost. Masking rewrites a forwarded\nheader rather than removing it, so a relayed request still looks relayed.\nBut the no-resolvable-client-IP path DELETES those headers, which would make\na \n[…]\n guard.\n\nRaised as a no-action observation in review; no behavior change.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01HXyK53CrxTTfdutipBCpFG",
          "is_bot": false,
          "headline": "Pin why upstream header scrubbing can't weaken the localhost guard",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-30T08:09:43Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "1fe144ee9a09f40407548ce73ff982662da59e54",
          "body": "Copilot review follow-up: attempted_strategies was built from the failed\nlist, so a strategy that executed but whose anonymous success was merely\nheld as the fallback (noauth in auth=noauth,basicauth with invalid\ncredentials) vanished from terminal-halt telemetry. Track every executed\nstrategy along\n[…]\nted at the builder). Nothing consumes these keys\nas paired arrays today.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01FrxDuuvfNojQ3W1b13J4Vm",
          "is_bot": false,
          "headline": "[#220] Report executed strategies in failure metadata",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-30T08:06:25Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "eb7d9d4ac7c51ccf00ac70eb3da153d56e6dc0da",
          "body": "Entries are identified by (class, args, options), so the same middleware\nclass can legitimately be registered more than once with different\nconfiguration. Keying pins by class meant a single :outermost registration\nreordered EVERY registration of that class -- an unpinned sibling would be\ndragged in\n[…]\nun-pins on removal\" behavior is unchanged.\n\nReported by Greptile on #221.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01HXyK53CrxTTfdutipBCpFG",
          "is_bot": false,
          "headline": "Record middleware pin tiers per entry, not per class",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-30T08:04:26Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "8e89b8d39982aa7657ef3011978bffad67441c41",
          "body": "Review follow-up: pin that an earlier AuthorizationFailure still wins\nthe response (403 with its reason) over a later terminal AuthFailure,\nwhile the terminal failure still halts the chain before any\nanonymous-capable strategy runs.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01FrxDuuvfNojQ3W1b13J4Vm",
          "is_bot": false,
          "headline": "[#220] Spec 403-over-terminal-401 precedence",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-30T08:03:16Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "d6a88eb607356ae45c1c49e79b9d1c14830b7179",
          "body": "The multi-append pin test relied on probe_class minting a distinct\nanonymous class per call — true, but not evident from the test, and a\nreader could reasonably suspect #add's identical-config dedup collapsed\nthem into one entry (which would make the assertion vacuous). Assert the\nresulting stack size so the premise is checked rather than assumed.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01HXyK53CrxTTfdutipBCpFG",
          "is_bot": false,
          "headline": "Assert the five probes actually land in the stack",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-30T07:49:59Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "228381a9b6ba89bc261759121319da2b9ee05fe1",
          "body": "Let a strategy return AuthFailure with terminal: true (via\nfailure(reason, terminal: true)) to signal that the request explicitly\npresented credentials which were examined and rejected. RouteAuthWrapper\nnow halts the chain on a terminal failure and renders the 401 with that\nfailure's reason, so mixe\n[…]\nction\nwithout the new keyword is unchanged (terminal defaults to false).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01FrxDuuvfNojQ3W1b13J4Vm",
          "is_bot": false,
          "headline": "[#220] Support terminal auth failures in RouteAuthWrapper",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-30T07:33:48Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "7ed3b95acd9f60cf4036b2606dc639c430be77e7",
          "body": "…d IPs\n\nIPPrivacyMiddleware was registered `position: :first`, which is\nfirst-in-ARRAY and therefore INNERMOST once MiddlewareStack#wrap folds the\nstack with reduce. That inverted the documented contract: only the wrapped\napplication saw masked values, while every other middleware Otto mounts --\nand\n[…]\n now assert what other middleware observes, which nothing\ncovered before.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01HXyK53CrxTTfdutipBCpFG",
          "is_bot": false,
          "headline": "[#219] Run IPPrivacyMiddleware outermost so all middleware sees maske…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-30T07:24:14Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "c8a5a9541b0ff2b3e0a6aa5d62c8782f06bcf81a",
          "body": "QA follow-ups on c14a5a9.\n\nStripped of the client IP, the pre-mask resolution log carried no\ninformation: it fired on every privacy-enabled request as a constant\nstring, and every branch below it already logs its own outcome. Removed,\nwith a note against re-adding the address.\n\nChangelog corrections\n[…]\nbug wiring broke; it now guards for non-empty output. Adds the\nmissing type-guard coverage for the option form, at both Config.new and\nconfigure_ip_privacy, plus the profile: nil leave-unchanged case.",
          "is_bot": false,
          "headline": "fix: drop the uninformative pre-mask log line; correct changelog claims",
          "author_name": "delano",
          "author_login": "delano",
          "committed_at": "2026-07-26T06:23:12Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c14a5a9f0635a0557f74a6017fa9c3ec0ed1cf8e",
          "body": "Resolves outstanding review feedback on PR #218.\n\nIPPrivacyMiddleware interpolated the resolved, unmasked client IP into two\ndebug lines that only run on the masking profiles: the pre-mask resolution\nline (:masked, :anonymous) and the private/localhost exemption line\n(:masked). Under Otto.debug that\n[…]\nymous -> :audit leaves mask_private_ips set, which is inert\nbecause disabled short-circuits privacy_enabled?), and adds specs for the\nthree-profile round trip, the type guard, and both log-leak paths.",
          "is_bot": false,
          "headline": "fix: keep unmasked IPs out of debug logs; validate profile type",
          "author_name": "delano",
          "author_login": "delano",
          "committed_at": "2026-07-26T06:13:30Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e6f30696de9a0522411a88ac9e1e9c4d3f69ee16",
          "body": "IPAddr#ipv4_compat? is obsolete and warns under -w, so gating the unfreeze on\nit emitted a deprecation line per CIDR entry per request for anyone running\nwith warnings on. #native already short-circuits to self for ranges that do\nnot fold, so an unconditional dup of a frozen receiver is both simpler and\nquieter — the extra allocation only lands on frozen entries.",
          "is_bot": false,
          "headline": "fix: drop deprecated ipv4_compat? call from the CIDR fold",
          "author_name": "delano",
          "author_login": "delano",
          "committed_at": "2026-07-26T05:50:23Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e5515029575d4313d7af9946c06542d262ffd223",
          "body": "…daries\n\nFollow-up hardening from QA review of fce18dc.\n\nIPAddr#native builds its result with #clone, which carries frozen state over\nand then fails to mutate it, so a caller who froze their range configuration\n(or passed it through Ractor.make_shareable) hit FrozenError on mapped\nentries. Unfreeze \n[…]\nn\nthe same terms — each now spec-covered. Also asserts the normal stacked-pass\npath never reaches the fail-closed repair branch, and corrects the guard\ncomment's claim about the no-resolvable-IP path.",
          "is_bot": false,
          "headline": "fix: keep frozen mapped CIDR entries from raising; document fold boun…",
          "author_name": "delano",
          "author_login": "delano",
          "committed_at": "2026-07-26T05:48:13Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "fce18dcb74fe3764828106f583900666c1f7d182",
          "body": "…ed ip_match\n\nResolves PR #218 review feedback.\n\n- Utils.ip_in_cidrs? and trusted-proxy entries now fold CIDR *ranges* through\n  IPAddr#native, matching the fold already applied to the client address. A\n  mapped range (::ffff:10.0.0.0/104) previously failed the address-family\n  check and was silentl\n[…]\nout-of-contract guard path, post-construction profile changes, and the two\ncoverage gaps named in review (privacy-disabled with no REMOTE_ADDR, and the\n:anonymous profile through the full middleware).",
          "is_bot": false,
          "headline": "fix: symmetric IPv4-mapped CIDR folding, live privacy flag, fail-clos…",
          "author_name": "delano",
          "author_login": "delano",
          "committed_at": "2026-07-26T05:35:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "cc3fc69dd9f0f6d25d8d743918acfa8e5582b3e2",
          "body": "[#214] Re-align Otto::Request#secure? with Rack scheme",
          "is_bot": false,
          "headline": "Merge pull request #217 from delano/fix/214-secure",
          "author_name": "Delano",
          "author_login": "delano",
          "committed_at": "2026-07-26T05:23:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a155cd56b14b4fdfd4516d10eaf224269eb2bf2f",
          "body": "…y-1.3.8\n\nbuild(deps): bump concurrent-ruby from 1.3.7 to 1.3.8",
          "is_bot": false,
          "headline": "Merge pull request #216 from delano/dependabot/bundler/concurrent-rub…",
          "author_name": "Delano",
          "author_login": "delano",
          "committed_at": "2026-07-26T05:23:34Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "08901c86a02759569c3e5741902408c54428c5f3",
          "body": "Install env['otto.ip_match'], a verdict-only CIDR membership check over\nthe resolved unmasked client IP, on every resolution path. Downstream\npolicy code (allowlists, network isolation) gets full /32-/128 precision\nunder any profile without the raw IP landing in env.\n\nAdd named privacy profiles (:an\n[…]\nvalidated\npresets over disabled/mask_private_ips, settable via\nconfigure_ip_privacy(profile:).\n\nEnables fix for onetimesecret/onetimesecret#3912 (AdminNetworkIsolation\nmatching against the masked IP).",
          "is_bot": false,
          "headline": "feat: add IP precision capability and privacy profiles",
          "author_name": "delano",
          "author_login": "delano",
          "committed_at": "2026-07-26T04:36:56Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "392ec91543c554425c45597a394d51a660bd05cc",
          "body": null,
          "is_bot": false,
          "headline": "[#214] Re-align Otto::Request#secure? with Rack scheme",
          "author_name": "delano",
          "author_login": "delano",
          "committed_at": "2026-07-26T04:17:05Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a26cb28f422c15f99485c19208c05a04e012358c",
          "body": "Bumps [concurrent-ruby](https://github.com/ruby-concurrency/concurrent-ruby) from 1.3.7 to 1.3.8.\n- [Release notes](https://github.com/ruby-concurrency/concurrent-ruby/releases)\n- [Changelog](https://github.com/ruby-concurrency/concurrent-ruby/blob/master/CHANGELOG.md)\n- [Commits](https://github.com\n[…]\n\n- dependency-name: concurrent-ruby\n  dependency-version: 1.3.8\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): bump concurrent-ruby from 1.3.7 to 1.3.8",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-26T03:49:51Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "67ee6c88eeec5996304606c90c620767e63eb798",
          "body": "…/checkout-7.0.1\n\nbuild(deps): bump actions/checkout from 7.0.0 to 7.0.1",
          "is_bot": false,
          "headline": "Merge pull request #215 from delano/dependabot/github_actions/actions…",
          "author_name": "Delano",
          "author_login": "delano",
          "committed_at": "2026-07-26T03:48:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3e655e07b28e62e74207cc1930c18cf07c18045d",
          "body": "build(deps-dev): bump yard from 0.9.44 to 0.9.45",
          "is_bot": false,
          "headline": "Merge pull request #213 from delano/dependabot/bundler/yard-0.9.45",
          "author_name": "Delano",
          "author_login": "delano",
          "committed_at": "2026-07-26T03:48:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f978d0bdb5aa8dd95b1a7ab50cfb0380791d3b85",
          "body": "build(deps): bump loofah from 2.25.1 to 2.25.2",
          "is_bot": false,
          "headline": "Merge pull request #212 from delano/dependabot/bundler/loofah-2.25.2",
          "author_name": "Delano",
          "author_login": "delano",
          "committed_at": "2026-07-26T03:47:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5acd091e7b41d8fbc5d071ff0c5c41ef12a2d1aa",
          "body": "Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1.\n- [Release notes](https://github.com/actions/checkout/releases)\n- [Commits](https://github.com/actions/checkout/compare/v7...v7.0.1)\n\n---\nupdated-dependencies:\n- dependency-name: actions/checkout\n  dependency-version: 7.0.1\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): bump actions/checkout from 7.0.0 to 7.0.1",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-25T10:32:11Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9597bf83e78fea419326e722bc879d85fc381382",
          "body": "Bumps [yard](https://github.com/lsegal/yard) from 0.9.44 to 0.9.45.\n- [Release notes](https://github.com/lsegal/yard/releases)\n- [Changelog](https://github.com/lsegal/yard/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/lsegal/yard/compare/v0.9.44...v0.9.45)\n\n---\nupdated-dependencies:\n- dependency-name: yard\n  dependency-version: 0.9.45\n  dependency-type: direct:development\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps-dev): bump yard from 0.9.44 to 0.9.45",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-18T10:34:05Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "83aa0010ca659b52215e99d64b981fc262b7f503",
          "body": "Bumps [loofah](https://github.com/flavorjones/loofah) from 2.25.1 to 2.25.2.\n- [Release notes](https://github.com/flavorjones/loofah/releases)\n- [Changelog](https://github.com/flavorjones/loofah/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/flavorjones/loofah/compare/v2.25.1...v2.25.2)\n\n---\n[…]\ndencies:\n- dependency-name: loofah\n  dependency-version: 2.25.2\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): bump loofah from 2.25.1 to 2.25.2",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-18T10:32:30Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7e1f4ef3519e5dd7ae991f9f542b76cf6715ea2f",
          "body": "build(deps-dev): bump ruby-lsp from 0.26.9 to 0.26.10",
          "is_bot": false,
          "headline": "Merge pull request #209 from delano/dependabot/bundler/ruby-lsp-0.26.10",
          "author_name": "Delano",
          "author_login": "delano",
          "committed_at": "2026-07-17T06:23:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "48c44770cbbdfa1a0b2d976c99d490dde0d40d88",
          "body": "build(deps-dev): bump rubocop from 1.88.1 to 1.88.2",
          "is_bot": false,
          "headline": "Merge pull request #208 from delano/dependabot/bundler/rubocop-1.88.2",
          "author_name": "Delano",
          "author_login": "delano",
          "committed_at": "2026-07-17T06:22:50Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3551ebe7d0840a345146f95a67abb7d6877c37ce",
          "body": "docs: geo-country resolution guide",
          "is_bot": false,
          "headline": "Merge pull request #211 from delano/docs/geo-country",
          "author_name": "Delano",
          "author_login": "delano",
          "committed_at": "2026-07-17T06:22:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "47a9a30817dd27689e3a9981b6b1ead6ba892037",
          "body": "- extract_db_country handles nested country.iso_code, flat country_code,\n  and bare-string country only; drop the inaccurate registered_country.iso_code\n  claim carried over from #207.\n- custom_resolver is a class-level singleton on GeoResolver (shared across all\n  Otto instances), unlike the per-instance Config geo settings; call that out.\n\nRefs #206",
          "is_bot": false,
          "headline": "docs: fix record-shape list and note custom_resolver is class-level",
          "author_name": "delano",
          "author_login": "delano",
          "committed_at": "2026-07-17T06:17:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "391db1962cdc48ed3369cd653344605e087e1e81",
          "body": "The merged #210 raises ArgumentError (unreadable path, corrupt/non-MMDB\nfile, or missing maxmind-db gem) from Config#build_maxmind_reader at boot;\nthere is no GeoResolver::DatabaseError class (that was #207-only). Fix the\ncarried-over reference.\n\nRefs #206",
          "is_bot": false,
          "headline": "docs: correct geo_db_path error class to ArgumentError",
          "author_name": "delano",
          "author_login": "delano",
          "committed_at": "2026-07-17T06:08:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b6f209e47c4977d2ff579d4d5267c6cce3e63bbd",
          "body": null,
          "is_bot": false,
          "headline": "Merge remote-tracking branch 'origin/main' into docs/geo-country",
          "author_name": "delano",
          "author_login": "delano",
          "committed_at": "2026-07-17T06:08:30Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8aeaa6b28d656ebe8f6872faad335d4b70930772",
          "body": "Salvaged from the closed PR #207 and corrected to the merged #210 API:\nconfig lives on the per-instance Otto::Privacy::Config via\nconfigure_ip_privacy (geo_header:/geo_db_path:/geo_db_reader:), not\nGeoResolver class setters; header trust requires a verified CIDR trusted\nproxy (no-proxy-config and depth mode are untrusted); and the masked-env\nseal now covers the RFC 7239 Forwarded header.\n\nRefs #206",
          "is_bot": false,
          "headline": "docs: add geo-country resolution guide",
          "author_name": "delano",
          "author_login": "delano",
          "committed_at": "2026-07-17T05:48:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8157c068db8d56b37a13072a52c7f4b0370b4255",
          "body": "…hns97b\n\nAdd configurable geo-location resolution with database fallback",
          "is_bot": false,
          "headline": "Merge pull request #210 from delano/claude/geo-country-header-source-…",
          "author_name": "Delano",
          "author_login": "delano",
          "committed_at": "2026-07-17T05:40:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a443f89a23bb1a3254d66c38f6b3bfae450b000b",
          "body": "- Changelog migration note incorrectly listed trusted_proxy_depth as a way to\n  keep header-based geo. Depth mode does NOT trust geo headers (the edge can't\n  be verified as a geo-CDN), so only CIDR trusted_proxies restores header trust;\n  depth-mode/header-only setups should use geo_db_path.\n- READ\n[…]\n was renamed to\n  AGENTS.md). Point both links at AGENTS.md.\n\nRefs #206\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01MPVQ5qk148iQ4GninyJJfD",
          "is_bot": false,
          "headline": "Fix docs flagged by PR #210 review",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-17T03:07:34Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "908e15eec48eb416f0a830cf95598e8965cceb59",
          "body": "Previously, when no trusted proxy was configured, geo headers were trusted\nfrom direct clients — so an internet client could pick its own resolved\ncountry by sending CF-IPCountry / X-Client-Country (Otto's long-standing\nbehavior). Following the PR #210 review, tighten this: geo headers are now\ntrust\n[…]\nxy_depth) so Otto can verify the origin, or set geo_db_path.\n\nRefs #206\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01MPVQ5qk148iQ4GninyJJfD",
          "is_bot": false,
          "headline": "Trust geo headers only via a verified proxy origin (strict default)",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-17T02:48:16Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "18701d2217c54762a1303c8ca64596a0a0d9f3cb",
          "body": "Reflect that only the `for=` value is redacted (proto=/host=/by= preserved),\nand that forwarded headers are dropped when no client IP resolves.\n\nRefs #206\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01MPVQ5qk148iQ4GninyJJfD",
          "is_bot": false,
          "headline": "Update changelog for the Forwarded-header redaction refinements",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-16T19:35:05Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "31d32014690ef491fe169bc16aa3436368189b62",
          "body": "Two forwarded-header fixes from the PR #210 review:\n\n- Preserve metadata: the previous masking collapsed the whole RFC 7239\n  Forwarded header to a single `for=<masked>`, discarding proto=, host= and\n  by=. Downstream code that reads Forwarded for scheme/host/proxy decisions\n  (absolute URLs, redire\n[…]\n-IP /\n  Forwarded (Rack-SPEC-safe — an absent key is valid).\n\nRefs #206\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01MPVQ5qk148iQ4GninyJJfD",
          "is_bot": false,
          "headline": "Redact only for= in Forwarded, and scrub it when no client IP resolves",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-16T19:34:22Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "7a07b287d36a3150203007451b98e1b9b2a303e9",
          "body": "configure_ip_privacy(geo_db_reader:) sets an override that load_geo_database!\nprefers over any path. A later configure_ip_privacy(geo_db_path:) left that\noverride in place, so the new path was silently ignored — lookups kept using\nthe old (possibly closed) injected reader, and there was no way to sw\n[…]\nath (documented precedence). Reported by the PR #210 review.\n\nRefs #206\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01MPVQ5qk148iQ4GninyJJfD",
          "is_bot": false,
          "headline": "Fix geo_db_path being shadowed by a stale reader override",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-16T19:34:10Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "8b7e7bddaff035386abd728e5480bb2661379b0e",
          "body": "Two minor, cheap items from the automated review:\n\n- valid_country_code? now anchors with \\A/\\z (string boundaries) instead of\n  ^/$ (line boundaries), so an embedded newline can never satisfy the pattern.\n  Behavior is unchanged for the reachable 2-char inputs; this is idiomatic\n  correctness.\n\n- A\n[…]\nd as harmless in the review\nand are intentional; left as-is.\n\nRefs #206\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01MPVQ5qk148iQ4GninyJJfD",
          "is_bot": false,
          "headline": "Address PR #210 review notes",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-16T17:03:13Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "5c309cb69fe8c3aeedc50467b564e296d2709f8e",
          "body": "IPPrivacyMiddleware masked REMOTE_ADDR, X-Forwarded-For, X-Real-IP and\nX-Client-IP but left HTTP_FORWARDED (RFC 7239) intact — even though Otto reads\nit as an authoritative client-IP source in count-based depth mode\n(trusted_proxy_header 'Forwarded'/'Both'). So downstream code could still read\nthe r\n[…]\n env). Surfaced by the adversarial\nreview of the geo change.\n\nRefs #206\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01MPVQ5qk148iQ4GninyJJfD",
          "is_bot": false,
          "headline": "Mask the RFC 7239 Forwarded header in IP privacy",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-16T00:42:34Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "a25fdec2eaa17316e0e8f8180d87421d1cb5e080",
          "body": "detect_by_range walked a hardcoded ~14-entry CIDR->country table (public DNS\nresolvers, plus broad AWS blocks like 54.0.0.0/8 -> US) as a last resort. It\nresolved essentially no real client traffic — DNS-resolver IPs aren't clients,\nand labeling entire cloud regions by country is frequently wrong — \n[…]\ndatabase (a stronger signal than a range-table\ncoincidence).\n\nRefs #206\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01MPVQ5qk148iQ4GninyJJfD",
          "is_bot": false,
          "headline": "Remove the built-in KNOWN_RANGES IP-range guess table",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-16T00:38:48Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "3cdad03819b13b340ad6075273596d7723f21d93",
          "body": "Both were verified with proof-of-concept against the running code.\n\nPrivacy leak (geo_env seal was incomplete): the masked env view handed to a\ncustom resolver masked REMOTE_ADDR / X-Forwarded-For / X-Real-IP / X-Client-IP\nbut not HTTP_FORWARDED (RFC 7239). Otto reads HTTP_FORWARDED as an\nauthoritat\n[…]\nd iso_code, flat country_code, bare country string) resolve.\n\nRefs #206\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01MPVQ5qk148iQ4GninyJJfD",
          "is_bot": false,
          "headline": "Fix two defects found by adversarial review of the geo seal",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-16T00:16:03Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "0098be63a36aacc00608cfc6495622c82b774bfa",
          "body": "…store\n\nFollow-up to the geo-country feature addressing review feedback.\n\nPrivacy sealing: geo resolution now runs against a masked view — the masked\nIP and an env with the IP-bearing headers (REMOTE_ADDR, X-Forwarded-For,\nX-Real-IP, X-Client-IP) masked — so a custom_resolver or the database can no\n\n[…]\nsealing, depth-mode trust, and authoritative-miss semantics.\n\nRefs #206\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01MPVQ5qk148iQ4GninyJJfD",
          "is_bot": false,
          "headline": "Harden geo resolution: seal resolver, authoritative DB, no unbounded …",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-15T23:54:32Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "ee05ad1dedc83c9ecbfd776d901ac7d061df205b",
          "body": "req.geo_country previously checked a hardcoded CDN header list and fell\nback to a ~14-entry KNOWN_RANGES table. This makes the header source\nconfigurable, adds a real offline IP->country database fallback that\noperates on Otto's already-masked IP, and gates header trust on the\ntrusted-proxy decision\n[…]\n, boot-time validation, DB schema shapes, and freeze safety.\n\nRefs #206\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01MPVQ5qk148iQ4GninyJJfD",
          "is_bot": false,
          "headline": "Add configurable geo-country header source + local MMDB fallback",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-15T23:03:31Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "b7c15248b0f66897d4b08093da65ba3ea85ee9ef",
          "body": "Bumps [ruby-lsp](https://github.com/Shopify/ruby-lsp) from 0.26.9 to 0.26.10.\n- [Release notes](https://github.com/Shopify/ruby-lsp/releases)\n- [Commits](https://github.com/Shopify/ruby-lsp/compare/v0.26.9...v0.26.10)\n\n---\nupdated-dependencies:\n- dependency-name: ruby-lsp\n  dependency-version: 0.26.10\n  dependency-type: direct:development\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps-dev): bump ruby-lsp from 0.26.9 to 0.26.10",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-11T10:32:29Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4fe17c2e3d0a4bff305d8dd8d24f9143eabaab70",
          "body": "Bumps [rubocop](https://github.com/rubocop/rubocop) from 1.88.1 to 1.88.2.\n- [Release notes](https://github.com/rubocop/rubocop/releases)\n- [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md)\n- [Commits](https://github.com/rubocop/rubocop/compare/v1.88.1...v1.88.2)\n\n---\nupdated-\n[…]\nncies:\n- dependency-name: rubocop\n  dependency-version: 1.88.2\n  dependency-type: direct:development\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps-dev): bump rubocop from 1.88.1 to 1.88.2",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-11T10:32:20Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7d30b6e306972732cf90d4e34cf6f6eceea65dd6",
          "body": "Prepare 2.6.0 release",
          "is_bot": false,
          "headline": "Merge pull request #205 from delano/claude/minor-release-prep-8fwdm2",
          "author_name": "Delano",
          "author_login": "delano",
          "committed_at": "2026-07-10T10:08:05Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "601fdd7374c407f55d8120eeef731d7adae01595",
          "body": "Cut implementation rationale and code-example narrative from the\nscriv-collected entries so each bullet states what changed, not\nwhy -- that detail already lives in the commit history and PR\ndescriptions.",
          "is_bot": false,
          "headline": "Trim 2.6.0 changelog to concise, user-facing entries",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-10T10:01:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "fbf1291fdddd7542726d09d223087269dede3b74",
          "body": "Bump Otto::VERSION to 2.6.0 and run scriv collect to roll the\nchangelog.d fragments into CHANGELOG.rst. Consolidates the PR\nreview follow-up fragments into their parent entries so the\nrelease notes read as a coherent summary instead of a per-commit\nlog, and regenerates Gemfile.lock for the new version.",
          "is_bot": false,
          "headline": "Prepare 2.6.0 release: collect and consolidate changelog",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-10T09:59:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "080c3d25f9229a69492a11027b8cc134c42ad112",
          "body": "Fix FrozenError on static file serving after configuration freeze",
          "is_bot": false,
          "headline": "Merge pull request #204 from delano/claude/frozen-routes-static-fix",
          "author_name": "Delano",
          "author_login": "delano",
          "committed_at": "2026-07-10T09:51:29Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a69d8a73ffa44741bb1a6257a7bca3f74193ef75",
          "body": "deep_freeze was dropped entirely for @routes_static to keep the\nConcurrent::Map cache writable, but that also left the outer hash's\nverb-key structure (:GET) mutable post-freeze — contrary to the stated\ndesign. Shallow-freeze the outer hash so its keys can't change while\nthe Concurrent::Map value stays writable for request-time cache writes.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_015A47xpg5seFEMCHMdG2r95",
          "is_bot": false,
          "headline": "fix(csp): shallow-freeze the outer routes_static hash",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-10T09:46:10Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "06c5e4d10d855b0deb824c96f217a384a63ce439",
          "body": "Exercises many threads simultaneously requesting distinct uncached\nstatic files against a frozen configuration, verifying no exceptions\nand no lost cache entries under real parallel writes to\nroutes_static[:GET] (Concurrent::Map).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_015A47xpg5seFEMCHMdG2r95",
          "is_bot": false,
          "headline": "test: add threaded concurrency coverage for routes_static writes",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-10T09:18:49Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "4846e993bc93a7f5bc19e82a108f7133bd2f111d",
          "body": "…ached static files (#185)\n\nfreeze_configuration! deep-froze @routes_static, but lazy static-file\ndiscovery writes into routes_static[:GET] at request time, so the first\nrequest for an uncached asset raised FrozenError in production. The lazy\nfreeze is skipped under RSpec, which masked the bug from \n[…]\n writable and thread-safe after configuration is\notherwise locked down.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_015A47xpg5seFEMCHMdG2r95",
          "is_bot": false,
          "headline": "fix: exclude routes_static from deep-freeze to fix FrozenError on unc…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-10T08:59:41Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "7bea57bec7e4497571a4bf7e5741395b6f840574",
          "body": "CSP: fix default worker-src (blob:) and add per-directive overrides for nonce policies",
          "is_bot": false,
          "headline": "Merge pull request #202 from delano/claude/csp-worker-src-blob-msyr68",
          "author_name": "Delano",
          "author_login": "delano",
          "committed_at": "2026-07-10T08:53:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c85660842b9ff0987b15db53b3bb68b9ccec8ad0",
          "body": "Complete the second half of issue #201: browsers instantiate Web Workers\nfrom blob: URLs (new Worker(URL.createObjectURL(...))) — the mechanism\nused by Sentry Replay, VueUse useWebWorkerFn, bundler-emitted workers,\nand WASM loaders — not from data: URLs. The old default therefore\nblocked mainstream \n[…]\nent gains a\nChanged section documenting the intentional default change.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_015A47xpg5seFEMCHMdG2r95",
          "is_bot": false,
          "headline": "fix(csp): default worker-src to blob: instead of data: (#201)",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-10T08:42:03Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "af597464027c6e74134b4b39ca4b9087ce3908e0",
          "body": "…zation-2myt2a\n\nfix(router): share one path normalization across all dispatch paths (#187)",
          "is_bot": false,
          "headline": "Merge pull request #200 from delano/claude/dynamic-route-path-normali…",
          "author_name": "Delano",
          "author_login": "delano",
          "committed_at": "2026-07-10T08:04:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3ef27d07ac09e1c70a41f11a726861713f3a499a",
          "body": "Per PR #202 review: overriding script-src while nonce mode is enabled\nsilently disables nonce-based script protection, because the per-request\nnonce is generated at response time and cannot be reproduced in a static\noverride. Config now logs a one-time warning (via Otto.structured_log)\nwhen a script\n[…]\nocs,\nwhich wrongly implied the nonce could be retained in the override.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_015A47xpg5seFEMCHMdG2r95",
          "is_bot": false,
          "headline": "feat(csp): warn when a script-src override voids the nonce (#201)",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-10T08:03:33Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "9aa630e9e4642c89d4e9ef85ac24ae0de06c72d0",
          "body": "…ement-2myt2a\n\nfix(csrf): enforce csrf=exempt at the handler layer (#186)",
          "is_bot": false,
          "headline": "Merge pull request #203 from delano/claude/csrf-exempt-handler-enforc…",
          "author_name": "Delano",
          "author_login": "delano",
          "committed_at": "2026-07-10T07:57:11Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7374d7533dae7cac5f185e0419e7c58701d15822",
          "body": "…nk tokens\n\n- Remove the `include CSRFValidation` from CSRFMiddleware: after the split to\n  injection-only it called none of the mixed-in methods, so the include (and\n  its drift-prevention comment) was dead and misleading (Greptile, Claude).\n- Reject nil/blank/whitespace-only tokens in valid_csrf_t\n[…]\n coverage for the blank-token short-circuit and the\n  frozen error body.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01HK9SxMxmuu6MpA3aURoPo8",
          "is_bot": false,
          "headline": "refactor(csrf): address PR #203 review — drop dead include, guard bla…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-10T07:54:19Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "1bc5aac3016ffd27e8bcc5c1b1b0b100cc5f59b6",
          "body": "Address review feedback on PR #202:\n\n- Reject CSP-injection in overrides: build_directive now raises\n  ArgumentError when a directive name or source token contains ';',\n  a newline, or a carriage return, instead of silently emitting extra\n  directives (a footgun when overrides come from env/config f\n[…]\n\n  defeats nonce protection (@note on merge_directives and the setter).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_015A47xpg5seFEMCHMdG2r95",
          "is_bot": false,
          "headline": "refactor(csp): harden directive overrides per PR review (#201)",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-10T07:54:15Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "5ff93a0f3a47ca2a0bdd4d352f1f5195a8204971",
          "body": "…c coverage\n\n- Rename match_dynamic_route's `path_info_clean` parameter to `dispatch_path`\n  and document it: the value is the normalized path with root's '' remapped to\n  '/', not the raw normalize_path output (Copilot review).\n- Add a HEAD example asserting the GET-merged dynamic route normalizes \n[…]\nbed)\n  (Claude review — the previously-uncovered other half of the fix).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01HK9SxMxmuu6MpA3aURoPo8",
          "is_bot": false,
          "headline": "test(router): address PR #200 review — rename param, add HEAD + stati…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-10T07:36:44Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "99f2316faba5376b15e6c1c0a28733b613716b1f",
          "body": "The csrf=exempt route option was parsed and exposed but never enforced:\nCSRFMiddleware runs as global middleware ahead of route matching, branches\nonly on HTTP method, and never consults route options — so exemption was a\nsilent no-op for every handler kind, and every unsafe request was blocked\nrega\n[…]\na\nintegration test now asserts concrete statuses instead of parity-only.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01HK9SxMxmuu6MpA3aURoPo8",
          "is_bot": false,
          "headline": "fix(csrf): enforce csrf=exempt at the handler layer (#186)",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-10T07:32:38Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "894aebbbdc3ee4f858493a4b9d212768b918f526",
          "body": "Otto's nonce CSP previously exposed only report-uri/report-to as\ncustomizable directives; the development and production directive sets\nwere otherwise hardcoded, so a consuming app could not adjust any\ndirective without vendoring the gem. Notably, worker-src shipped as\n'self' data:, blocking the sta\n[…]\nrides are configured;\nthe default worker-src 'self' data: is unchanged.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_015A47xpg5seFEMCHMdG2r95",
          "is_bot": false,
          "headline": "feat(csp): add per-directive override API for nonce policies (#201)",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-10T07:24:13Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "4dcf40a3e72c74268cd4658b8e18fa61e0c02d22",
          "body": "…#187)\n\nDynamic-route and static-file dispatch matched against the raw\n(unescape-only) path while literal matching and LocalhostGuard used the\ntrailing-slash-stripped, UTF-8-scrubbed path from normalize_path. Two\ndivergences followed: dynamic routes were stricter about trailing slashes\nthan literal \n[…]\nl\nmatch /); literal lookup keeps '' since it already keys root that way.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01HK9SxMxmuu6MpA3aURoPo8",
          "is_bot": false,
          "headline": "fix(router): share one path normalization across all dispatch paths (…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-10T05:04:29Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "9082328e672dd24335194ce1158f3693c77d1865",
          "body": "fix(route): make klass.otto per-request accessor thread-safe",
          "is_bot": false,
          "headline": "Merge pull request #199 from delano/claude/thread-safe-klass-otto-2myt2a",
          "author_name": "Delano",
          "author_login": "delano",
          "committed_at": "2026-07-10T04:46:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b1f45fdc6e8cff181f5cabdf87a08d3be1d79c21",
          "body": "Replace \"an ergonomic\" with \"a convenience\" in the ClassMethods v3\nnote — same meaning, clearer for future readers.\n\nRefs #188.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01HK9SxMxmuu6MpA3aURoPo8",
          "is_bot": false,
          "headline": "docs(route): reword v3 note to avoid jargon",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-10T04:42:27Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "4b974e138c04557bc844bbcb77da004827f92f21",
          "body": "Record that the class-level `otto` accessor is an ergonomic wrapper\naround ambient per-request state, and that the clean design — reading\notto from an instance-level reader on the handler (which already\nreceives it explicitly) and dropping ClassMethods — is the recommended\ndirection for Otto v3, removing the shared slot entirely.\n\nRefs #188.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01HK9SxMxmuu6MpA3aURoPo8",
          "is_bot": false,
          "headline": "docs(route): note ambient-free klass.otto design for Otto v3",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-10T04:33:45Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "062b8433cb183624426c6b760f302686acd56427",
          "body": "Swap the Thread.current-keyed hash for a Concurrent::FiberLocalVar\n(concurrent-ruby is already a runtime dependency). Behaviour is\nidentical — per-fiber, per-target-class storage — but the intent is\nexplicit and no longer relies on a magic Thread.current key.\n\nFiberLocalVar (not ThreadLocalVar) is d\n[…]\n storage would re-introduce the same clobber\none level down.\n\nRefs #188.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01HK9SxMxmuu6MpA3aURoPo8",
          "is_bot": false,
          "headline": "refactor(route): back klass.otto with Concurrent::FiberLocalVar",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-10T04:06:14Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "cf74c83a9ef6f141eacf2af7aa32971d5dafe080",
          "body": "Otto::Route::ClassMethods#otto= mutated a plain class-level ivar on\nevery request (lib/otto/route.rb and route_handlers/base.rb both\nextend the same module). Two Otto instances sharing a controller/logic\nclass, or concurrent threads/fibers serving requests under different\nOtto instances, could race \n[…]\nklass.otto=\nAPI is unchanged, so no caller needs to change.\n\nFixes #188.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01HK9SxMxmuu6MpA3aURoPo8",
          "is_bot": false,
          "headline": "fix(route): make klass.otto per-request accessor thread-safe",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-10T03:22:40Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "887c56b051d2eff5be1edac5da30adf9cbbcc10b",
          "body": "…-2myt2a\n\nFail fast on malformed security options in route definitions",
          "is_bot": false,
          "headline": "Merge pull request #196 from delano/claude/malformed-routes-fail-open…",
          "author_name": "Delano",
          "author_login": "delano",
          "committed_at": "2026-07-10T03:13:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ce51fc0f09a1c20f2fb967961cc68ebd509eed61",
          "body": "…n-2myt2a\n\nfix(uri): stop duplicate targets corrupting reverse URI lookup",
          "is_bot": false,
          "headline": "Merge pull request #197 from delano/claude/route-definitions-collisio…",
          "author_name": "Delano",
          "author_login": "delano",
          "committed_at": "2026-07-10T03:12:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3b88c8d5738238d0ae592e8b770f67643404e920",
          "body": "…yt2a\n\nfix(route): stop double request/response setup when handler factory present",
          "is_bot": false,
          "headline": "Merge pull request #198 from delano/claude/route-call-double-setup-2m…",
          "author_name": "Delano",
          "author_login": "delano",
          "committed_at": "2026-07-10T03:12:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "86b16f037f85e5d337136eba99aca5045645bc30",
          "body": "Move the otto.security_config/route_definition/route_options env-key\nwrites inside the route_handler_factory branch, and build req/res\nbefore writing them on the legacy fallback path. This restores the\nexact pre-#189 ordering for the no-factory path, so a custom\nrequest_class/response_class#initiali\n[…]\nass.new is called; it fails against\nthe unfixed ordering and passes now.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01HK9SxMxmuu6MpA3aURoPo8",
          "is_bot": false,
          "headline": "fix(route): address PR #198 review feedback on legacy env-key ordering",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-10T03:09:56Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "f3d0d909eadd5c236aa235833f433c70cdee5229",
          "body": "- Downgrade the duplicate-route-definition log from :warn to :debug.\n  Mounting one handler at several paths is a fully supported pattern\n  (that's the point of this fix), so warning on every boot made valid\n  configs like `/users/:id` + `/me` aliases look unhealthy.\n- Exclude the synthetic `splat` \n[…]\navior),\n  matching the \"ties keep load order\" contract in the docstring.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01HK9SxMxmuu6MpA3aURoPo8",
          "is_bot": false,
          "headline": "fix(uri): address PR #197 review feedback on duplicate-target selection",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-10T03:07:24Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "f86fd1260ba9b14d502dad82d9d432a31fd1ebbd",
          "body": "- Case-fold the security-gating check so Auth=/CSRF=/ROLE= variants\n  raise Otto::RouteDefinitionError instead of silently registering as\n  an unrecognized option with the gate disabled.\n- Treat an empty-key token (e.g. \"=foo\") as malformed (warn) rather\n  than storing it under an empty symbol key.\n\n[…]\n  without Otto.debug\" assertions don't depend on the OTTO_DEBUG env var.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01HK9SxMxmuu6MpA3aURoPo8",
          "is_bot": false,
          "headline": "fix(route): address PR #196 review feedback on security-gating options",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-10T03:04:15Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "7ee36f905cb4c6daca43455f15447ceac4299202",
          "body": "…resent\n\nWith the default handler factory, Route#call constructed a req/res pair,\nmerged extra_params, applied indifferent_params, set security headers,\nand extended CSRF/validation helpers — then delegated to the handler,\nwhose BaseHandler#call rebuilt a second req/res from the same env and\nre-ran \n[…]\ngacy path (no handler factory) keeps its previous behavior.\n\nCloses #189\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01HK9SxMxmuu6MpA3aURoPo8",
          "is_bot": false,
          "headline": "fix(route): stop double request/response setup when handler factory p…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-09T19:01:20Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "2dc2583963ce7c27f343515b94572df0b0378943",
          "body": "@route_definitions was keyed only by the definition string, so mounting\nthe same handler at several verb/path pairs overwrote the entry and\nuri() returned whichever path loaded last (#190).\n\n- Keep every route per definition in load order in a new\n  @routes_by_definition index (exposed via attr_read\n[…]\n\nDispatch is unaffected — it never used @route_definitions.\n\nCloses #190\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01HK9SxMxmuu6MpA3aURoPo8",
          "is_bot": false,
          "headline": "fix(uri): stop duplicate targets corrupting reverse URI lookup",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-09T18:58:00Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "10d60c9676d128d8adbd4b9e57f52c7394212ab6",
          "body": "Route loading previously swallowed malformed input silently (#191):\n\n- A `VERB /path` line with a missing handler was skipped with no signal.\n  Now logs an unconditional warning (not gated behind Otto.debug).\n- An option token without `=` (e.g. `csrf exempt`, `response json`) was\n  dropped, leaving \n[…]\n`empty=` are still stored) so existing routes keep loading.\n\nCloses #191\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01HK9SxMxmuu6MpA3aURoPo8",
          "is_bot": false,
          "headline": "fix(router): stop failing open on malformed route lines and options",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-09T18:52:55Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "b3e260c7f2231bd509e241bbc4dd3d85611e398c",
          "body": "Extract User-Agent anonymization to public UserAgentPrivacy class",
          "is_bot": false,
          "headline": "Merge pull request #195 from delano/claude/ruby-3-4-9-rbenv-setup-j68nkc",
          "author_name": "Delano",
          "author_login": "delano",
          "committed_at": "2026-07-09T18:39:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7067c0a1cd804ce1f829b2c6d2a81f4ad4984450",
          "body": "Add stable-keyed IP correlation hash for long-horizon tracking",
          "is_bot": false,
          "headline": "Merge pull request #193 from delano/claude/ruby-3-4-9-rbenv-setup-2vvrgt",
          "author_name": "Delano",
          "author_login": "delano",
          "committed_at": "2026-07-09T18:39:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cf22f88a6efcd0a8a82597aaa62ed71a7a7190e0",
          "body": "The previous docs opened with \"the long-horizon IP correlation hash\" —\nleading with the exact jargon a reader needs the doc to explain. Rewrite\nin plain language: short sentences, \"visitor\" not \"host\", \"real IP\" not\n\"raw IP\", a concrete masking example (203.0.113.42 -> 203.0.113.0), and\nlead with th\n[…]\nhe two verbose middleware comments.\n\nComments only; no behavior change.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_014ux4fsNDAzB8sx9g8YsDVg",
          "is_bot": false,
          "headline": "docs(privacy): plain-language correlation_secret docs",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-09T18:23:06Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "b08d71cc80725530cfd026d84c655e5bfc4df0f1",
          "body": "The config-option and configure_ip_privacy docs described the mechanism\n(stable vs daily-rotating key) before the purpose, so a reader could see\nwhat it does without grasping what it's for. Reframe both to open with\nthe problem it solves: correlating the same host across days/months for\nlong-lived r\n[…]\nechanism and the empty-key refusal.\n\nComments only; no behavior change.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_014ux4fsNDAzB8sx9g8YsDVg",
          "is_bot": false,
          "headline": "docs(privacy): lead correlation_secret docs with the motivation",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-09T18:18:11Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "a2f11a4096c2ef88dcbacfbb9dc908863b86a66b",
          "body": "Otto::Privacy::RedactedFingerprint#anonymize_user_agent — which strips\nversion/build identifiers from a User-Agent — was a private instance method,\nso downstream consumers that need to reduce a UA outside the full\nfingerprint/middleware flow had to re-implement (and risk drifting from) its\nregexes.\n\n[…]\nips and it\nbumps its otto dependency; see onetimesecret#3640 / ADR-022.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_011S57TVKW6YZVvyiSEj8dsY",
          "is_bot": false,
          "headline": "feat(privacy): expose public UserAgentPrivacy.anonymize surface (#194)",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-09T07:38:56Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "caad9d1e7f741f8c642c2d3a2523d0a2de706ca4",
          "body": "Address PR #193 follow-up review (Claude + Greptile): private/localhost\nIPs take the exempt early-return in apply_privacy, so — like masked_ip,\nhashed_ip and the fingerprint — no correlation_hash is produced for them.\nThis is intentional (the correlation hash targets public audit-trail\ntraffic), but\n[…]\n\n  pre-existing merge artifact flagged in review).\n\nNo behavior change.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_014ux4fsNDAzB8sx9g8YsDVg",
          "is_bot": false,
          "headline": "docs(privacy): document + test nil correlation hash for exempt IPs",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-09T07:34:32Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "2894a4f2c4f2210cc7a1b28df406950cd8ed4f15",
          "body": "Address PR #193 review feedback:\n\n- Type-validate correlation_secret at configuration time. A non-String,\n  non-nil value (e.g. an Integer) previously surfaced far from its cause\n  as a NoMethodError on #empty? inside per-request middleware. Route\n  assignment through a custom Config#correlation_sec\n[…]\n and configure_ip_privacy set / leave-unchanged / disable-via-\"\" paths.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_014ux4fsNDAzB8sx9g8YsDVg",
          "is_bot": false,
          "headline": "fix(privacy): validate correlation_secret type; align configure guard",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-09T07:21:21Z",
          "body_truncated": true,
          "is_coding_agent": true
        }
      ],
      "releases_count": 24,
      "commits_last_year": 709,
      "latest_release_at": "2026-08-03T09:53:25Z",
      "latest_release_tag": "v2.7.0-coda",
      "releases_from_tags": false,
      "days_since_last_push": 0,
      "active_weeks_last_year": 31,
      "days_since_latest_release": 0,
      "mean_days_between_releases": 15.7
    },
    "artifacts": {
      "collected": true,
      "structure": [],
      "declarations": [
        {
          "name": "otto",
          "path": "otto.gemspec",
          "tokens": [
            "gem.gemspec"
          ],
          "ecosystem": "rubygems"
        }
      ]
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "readme_badges": {
        "hosts": [],
        "total": 0,
        "header": 0,
        "collected": true,
        "has_inspect_badge": false
      },
      "has_description": true,
      "has_contributing": false,
      "health_percentage": 42,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "otto",
          "exists": true,
          "license": "MIT",
          "keywords": [],
          "ecosystem": "rubygems",
          "categories": [],
          "matches_repo": true,
          "registry_url": "https://rubygems.org/gems/otto",
          "declared_type": null,
          "is_deprecated": false,
          "latest_version": "2.7.0",
          "repository_url": "https://github.com/delano/otto",
          "versions_count": 37,
          "total_downloads": 124593,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": "2011-07-07T04:27:32.801000Z",
          "latest_published_at": "2026-08-03T18:02:19.742000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 0
        }
      ]
    },
    "popularity": {
      "forks": 1,
      "stars": 19,
      "watchers": 2,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 1
      },
      "star_history": null,
      "open_issues_and_prs": 3
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [
        "examples"
      ],
      "has_llms_txt": false,
      "has_dockerfile": false,
      "has_mcp_signal": false,
      "bootstrap_files": [],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [],
      "largest_source_bytes": 90773,
      "source_files_sampled": 225,
      "oversized_source_files": 2,
      "agent_instruction_files": [
        "AGENTS.md"
      ],
      "agent_instruction_max_bytes": 5907
    },
    "dependencies": {
      "manifests": [
        "Gemfile"
      ],
      "advisories": {
        "error": null,
        "scope": "repository_graph",
        "source": "osv",
        "findings": [],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {},
        "advisory_count": 0,
        "affected_count": 0,
        "assessed_count": 77,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 6,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "rubygems"
      ],
      "dependencies": [],
      "all_dependencies": {
        "error": null,
        "source": "github-sbom",
        "packages": [
          {
            "name": "ast",
            "direct": false,
            "version": "2.4.3",
            "ecosystem": "rubygems"
          },
          {
            "name": "benchmark",
            "direct": false,
            "version": "0.5.0",
            "ecosystem": "rubygems"
          },
          {
            "name": "bigdecimal",
            "direct": false,
            "version": "4.1.1",
            "ecosystem": "rubygems"
          },
          {
            "name": "concurrent-ruby",
            "direct": false,
            "version": null,
            "ecosystem": "rubygems"
          },
          {
            "name": "concurrent-ruby",
            "direct": false,
            "version": "1.3.8",
            "ecosystem": "rubygems"
          },
          {
            "name": "crass",
            "direct": false,
            "version": "1.0.7",
            "ecosystem": "rubygems"
          },
          {
            "name": "date",
            "direct": false,
            "version": "3.5.1",
            "ecosystem": "rubygems"
          },
          {
            "name": "debug",
            "direct": false,
            "version": "1.11.1",
            "ecosystem": "rubygems"
          },
          {
            "name": "diff-lcs",
            "direct": false,
            "version": "1.6.2",
            "ecosystem": "rubygems"
          },
          {
            "name": "dry-configurable",
            "direct": false,
            "version": "1.3.0",
            "ecosystem": "rubygems"
          },
          {
            "name": "dry-core",
            "direct": false,
            "version": "1.1.0",
            "ecosystem": "rubygems"
          },
          {
            "name": "dry-inflector",
            "direct": false,
            "version": "1.2.0",
            "ecosystem": "rubygems"
          },
          {
            "name": "dry-initializer",
            "direct": false,
            "version": "3.2.0",
            "ecosystem": "rubygems"
          },
          {
            "name": "dry-logic",
            "direct": false,
            "version": "1.6.0",
            "ecosystem": "rubygems"
          },
          {
            "name": "dry-schema",
            "direct": false,
            "version": "1.14.1",
            "ecosystem": "rubygems"
          },
          {
            "name": "dry-types",
            "direct": false,
            "version": "1.9.1",
            "ecosystem": "rubygems"
          },
          {
            "name": "erb",
            "direct": false,
            "version": "6.0.4",
            "ecosystem": "rubygems"
          },
          {
            "name": "hana",
            "direct": false,
            "version": "1.3.7",
            "ecosystem": "rubygems"
          },
          {
            "name": "io-console",
            "direct": false,
            "version": "0.8.2",
            "ecosystem": "rubygems"
          },
          {
            "name": "irb",
            "direct": false,
            "version": "1.18.0",
            "ecosystem": "rubygems"
          },
          {
            "name": "json",
            "direct": false,
            "version": "2.20.0",
            "ecosystem": "rubygems"
          },
          {
            "name": "json_schemer",
            "direct": false,
            "version": "2.5.0",
            "ecosystem": "rubygems"
          },
          {
            "name": "kramdown",
            "direct": false,
            "version": "2.5.2",
            "ecosystem": "rubygems"
          },
          {
            "name": "language_server-protocol",
            "direct": false,
            "version": "3.17.0.6",
            "ecosystem": "rubygems"
          },
          {
            "name": "lint_roller",
            "direct": false,
            "version": "1.1.0",
            "ecosystem": "rubygems"
          },
          {
            "name": "logger",
            "direct": false,
            "version": null,
            "ecosystem": "rubygems"
          },
          {
            "name": "logger",
            "direct": false,
            "version": "1.7.0",
            "ecosystem": "rubygems"
          },
          {
            "name": "loofah",
            "direct": false,
            "version": null,
            "ecosystem": "rubygems"
          },
          {
            "name": "loofah",
            "direct": false,
            "version": "2.25.2",
            "ecosystem": "rubygems"
          },
          {
            "name": "maxmind-db",
            "direct": false,
            "version": "1.4.0",
            "ecosystem": "rubygems"
          },
          {
            "name": "minitest",
            "direct": false,
            "version": "5.26.0",
            "ecosystem": "rubygems"
          },
          {
            "name": "nokogiri",
            "direct": false,
            "version": "1.19.4",
            "ecosystem": "rubygems"
          },
          {
            "name": "parallel",
            "direct": false,
            "version": "1.28.0",
            "ecosystem": "rubygems"
          },
          {
            "name": "parser",
            "direct": false,
            "version": "3.3.11.1",
            "ecosystem": "rubygems"
          },
          {
            "name": "pastel",
            "direct": false,
            "version": "0.8.0",
            "ecosystem": "rubygems"
          },
          {
            "name": "pp",
            "direct": false,
            "version": "0.6.3",
            "ecosystem": "rubygems"
          },
          {
            "name": "prettier_print",
            "direct": false,
            "version": "1.2.1",
            "ecosystem": "rubygems"
          },
          {
            "name": "prettyprint",
            "direct": false,
            "version": "0.2.0",
            "ecosystem": "rubygems"
          },
          {
            "name": "prism",
            "direct": false,
            "version": "1.9.0",
            "ecosystem": "rubygems"
          },
          {
            "name": "psych",
            "direct": false,
            "version": "5.3.1",
            "ecosystem": "rubygems"
          },
          {
            "name": "racc",
            "direct": false,
            "version": "1.8.1",
            "ecosystem": "rubygems"
          },
          {
            "name": "rack",
            "direct": false,
            "version": null,
            "ecosystem": "rubygems"
          },
          {
            "name": "rack",
            "direct": false,
            "version": "3.2.6",
            "ecosystem": "rubygems"
          },
          {
            "name": "rack-attack",
            "direct": false,
            "version": "6.8.0",
            "ecosystem": "rubygems"
          },
          {
            "name": "rack-parser",
            "direct": false,
            "version": null,
            "ecosystem": "rubygems"
          },
          {
            "name": "rack-parser",
            "direct": false,
            "version": "0.7.0",
            "ecosystem": "rubygems"
          },
          {
            "name": "rack-test",
            "direct": false,
            "version": "2.2.0",
            "ecosystem": "rubygems"
          },
          {
            "name": "rackup",
            "direct": false,
            "version": "2.3.1",
            "ecosystem": "rubygems"
          },
          {
            "name": "rainbow",
            "direct": false,
            "version": "3.1.1",
            "ecosystem": "rubygems"
          },
          {
            "name": "rake",
            "direct": false,
            "version": "13.4.2",
            "ecosystem": "rubygems"
          },
          {
            "name": "rbs",
            "direct": false,
            "version": "4.0.3",
            "ecosystem": "rubygems"
          },
          {
            "name": "rdoc",
            "direct": false,
            "version": "7.2.0",
            "ecosystem": "rubygems"
          },
          {
            "name": "reek",
            "direct": false,
            "version": "6.5.0",
            "ecosystem": "rubygems"
          },
          {
            "name": "regexp_parser",
            "direct": false,
            "version": "2.12.0",
            "ecosystem": "rubygems"
          },
          {
            "name": "reline",
            "direct": false,
            "version": "0.6.3",
            "ecosystem": "rubygems"
          },
          {
            "name": "rexml",
            "direct": false,
            "version": null,
            "ecosystem": "rubygems"
          },
          {
            "name": "rexml",
            "direct": false,
            "version": "3.4.4",
            "ecosystem": "rubygems"
          },
          {
            "name": "rspec",
            "direct": false,
            "version": "3.13.2",
            "ecosystem": "rubygems"
          },
          {
            "name": "rspec-core",
            "direct": false,
            "version": "3.13.6",
            "ecosystem": "rubygems"
          },
          {
            "name": "rspec-expectations",
            "direct": false,
            "version": "3.13.5",
            "ecosystem": "rubygems"
          },
          {
            "name": "rspec-mocks",
            "direct": false,
            "version": "3.13.8",
            "ecosystem": "rubygems"
          },
          {
            "name": "rspec-support",
            "direct": false,
            "version": "3.13.7",
            "ecosystem": "rubygems"
          },
          {
            "name": "rubocop",
            "direct": false,
            "version": "1.88.2",
            "ecosystem": "rubygems"
          },
          {
            "name": "rubocop-ast",
            "direct": false,
            "version": "1.50.0",
            "ecosystem": "rubygems"
          },
          {
            "name": "rubocop-performance",
            "direct": false,
            "version": "1.26.1",
            "ecosystem": "rubygems"
          },
          {
            "name": "rubocop-rspec",
            "direct": false,
            "version": "3.10.2",
            "ecosystem": "rubygems"
          },
          {
            "name": "rubocop-thread_safety",
            "direct": false,
            "version": "0.7.3",
            "ecosystem": "rubygems"
          },
          {
            "name": "ruby-lsp",
            "direct": false,
            "version": "0.26.10",
            "ecosystem": "rubygems"
          },
          {
            "name": "ruby-progressbar",
            "direct": false,
            "version": "1.13.0",
            "ecosystem": "rubygems"
          },
          {
            "name": "simpleidn",
            "direct": false,
            "version": "0.2.3",
            "ecosystem": "rubygems"
          },
          {
            "name": "stackprof",
            "direct": false,
            "version": "0.2.28",
            "ecosystem": "rubygems"
          },
          {
            "name": "stringio",
            "direct": false,
            "version": "3.2.0",
            "ecosystem": "rubygems"
          },
          {
            "name": "syntax_tree",
            "direct": false,
            "version": "6.3.0",
            "ecosystem": "rubygems"
          },
          {
            "name": "tryouts",
            "direct": false,
            "version": "3.7.1",
            "ecosystem": "rubygems"
          },
          {
            "name": "tsort",
            "direct": false,
            "version": "0.2.0",
            "ecosystem": "rubygems"
          },
          {
            "name": "tty-color",
            "direct": false,
            "version": "0.6.0",
            "ecosystem": "rubygems"
          },
          {
            "name": "tty-cursor",
            "direct": false,
            "version": "0.7.1",
            "ecosystem": "rubygems"
          },
          {
            "name": "tty-screen",
            "direct": false,
            "version": "0.8.2",
            "ecosystem": "rubygems"
          },
          {
            "name": "unicode-display_width",
            "direct": false,
            "version": "3.2.0",
            "ecosystem": "rubygems"
          },
          {
            "name": "unicode-emoji",
            "direct": false,
            "version": "4.2.0",
            "ecosystem": "rubygems"
          },
          {
            "name": "user_agent_parser",
            "direct": false,
            "version": "2.21.0",
            "ecosystem": "rubygems"
          },
          {
            "name": "yard",
            "direct": false,
            "version": "0.9.45",
            "ecosystem": "rubygems"
          },
          {
            "name": "zeitwerk",
            "direct": false,
            "version": "2.7.3",
            "ecosystem": "rubygems"
          }
        ],
        "collected": true,
        "truncated": false,
        "total_count": 83,
        "direct_count": 0,
        "indirect_count": 83
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 155,
        "open_issues": 3,
        "closed_ratio": 0.939,
        "closed_issues": 46,
        "closed_unmerged_prs": 21
      },
      "bus_factor": 1,
      "bot_contributors": 1,
      "top_contributors": [
        {
          "type": "User",
          "login": "delano",
          "commits": 633,
          "avatar_url": "https://avatars.githubusercontent.com/u/1206?v=4"
        },
        {
          "type": "User",
          "login": "claude",
          "commits": 155,
          "avatar_url": "https://avatars.githubusercontent.com/u/81847?v=4"
        }
      ],
      "contributors_sampled": 2,
      "top_contributor_share": 0.803
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "ci.yml",
        "claude-code-review.yml",
        "claude.yml",
        "code-smells.yml",
        "release-gem.yml",
        "ruby-lint.yml",
        "yardoc.yml"
      ],
      "has_docs_dir": true,
      "linter_configs": [
        ".rubocop.yml"
      ],
      "has_editorconfig": false,
      "has_linter_config": true,
      "has_precommit_config": true
    },
    "security_signals": {
      "lockfiles": [
        "Gemfile.lock"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 3,
            "reason": "branch protection is not maximal on development and all release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 10,
            "reason": "6 out of 6 merged PRs checked by a CI test -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/6 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 6,
            "reason": "project has 2 contributing companies or organizations -- score normalized to 6",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 10,
            "reason": "update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 10,
            "reason": "30 commit(s) and 30 issue activity found in the last 90 days -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": null,
            "reason": "packaging workflow not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 2,
            "reason": "dependency not pinned by hash detected -- score normalized to 2",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "SAST tool is not run on all commits -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 0,
            "reason": "security policy file not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": null,
            "reason": "no releases found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 9,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 10,
            "reason": "0 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "d22322eb8520b10e15cab70fe1197a1123b771d8",
        "ran_at": "2026-08-03T18:10:52Z",
        "aggregate_score": 6.1,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": false,
      "has_dependabot_config": true
    },
    "contribution_flow": {
      "collected": true,
      "recent_prs": {
        "merged_7d": 5,
        "decided_7d": 5,
        "merged_30d": 20,
        "authors_30d": 1,
        "decided_30d": 21,
        "sample_size": 60,
        "window_days": 30,
        "sample_exhausted": false,
        "authors_probed_30d": 1,
        "newcomer_merged_30d": 0,
        "bot_prs_excluded_30d": 8,
        "newcomer_authors_30d": 0,
        "newcomer_decided_30d": 0
      },
      "ci_last_run_at": "2026-08-03T09:55:04Z",
      "oldest_open_prs": [],
      "last_merged_pr_at": "2026-08-03T09:50:55Z",
      "ci_last_conclusion": "FAILURE",
      "oldest_open_issues": [
        {
          "number": 41,
          "created_at": "2025-09-12T05:18:20Z",
          "last_comment_at": "2026-07-05T18:26:52Z",
          "last_comment_author": "delano"
        },
        {
          "number": 148,
          "created_at": "2026-06-21T06:03:12Z",
          "last_comment_at": "2026-06-22T03:41:40Z",
          "last_comment_author": "delano"
        },
        {
          "number": 206,
          "created_at": "2026-07-11T00:16:04Z",
          "last_comment_at": null,
          "last_comment_author": null
        }
      ]
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/delano/otto",
    "host": "github.com",
    "name": "otto",
    "owner": "delano"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "excellent",
      "name": "Overall health",
      "note": "The weighted overall 70 is calibrated to 83 on the published index scale (record calibration 2026-08-02).",
      "notes": [
        {
          "code": "overall_calibration",
          "params": {
            "raw": 70,
            "calibrated": 83,
            "calibration": "2026-08-02"
          }
        }
      ],
      "value": 83,
      "inputs": {
        "security": 69,
        "vitality": 92,
        "community": 42,
        "governance": 62,
        "calibration": "2026-08-02",
        "engineering": 82,
        "ai_readiness": 65,
        "weighted_overall_raw": 70
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "excellent",
        "name": "Vitality",
        "value": 92,
        "weight": 0.21,
        "metrics": [
          {
            "key": "development_activity",
            "band": "excellent",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 86,
            "inputs": {
              "commits_last_year": 709,
              "human_commit_share": 0.94,
              "days_since_last_push": 0,
              "active_weeks_last_year": 31
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 0 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 0
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "31/52 weeks with commits",
                "points": 21.5,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 31
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "709 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 709
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "30 commit(s) and 30 issue activity found in the last 90 days -- score normalized to 10",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "exceptional",
            "name": "Release discipline",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "releases_count": 24,
              "latest_release_tag": "v2.7.0-coda",
              "releases_from_tags": false,
              "days_since_latest_release": 0,
              "mean_days_between_releases": 15.7
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "24 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 24
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 0 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 0
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~15.7 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 15.7
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "exceptional",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "maintained",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": null,
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": 0,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "last human commit 0 days ago",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_maintained",
                    "params": {
                      "days": 0
                    }
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "weak",
        "name": "Community & Adoption",
        "value": 42,
        "weight": 0.17,
        "metrics": [
          {
            "key": "popularity",
            "band": "at_risk",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 20,
            "inputs": {
              "forks": 1,
              "stars": 19,
              "watchers": 2,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "19 stars",
                "points": 20.4,
                "status": "partial",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 19
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "1 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "2 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "moderate",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 50,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "readme_badges": 0,
              "has_contributing": false,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "readme_badge_services": [],
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (MIT)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "MIT"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          },
          {
            "key": "ecosystem_adoption",
            "band": "good",
            "name": "Ecosystem adoption (downloads)",
            "note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "registry_dependents"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 66,
            "inputs": {
              "packages": [
                "otto"
              ],
              "dependents": null,
              "ecosystems": "rubygems",
              "total_downloads": 124593,
              "monthly_downloads": null
            },
            "components": [
              {
                "key": "total_downloads",
                "name": "Total downloads",
                "detail": "124,593 downloads all-time across rubygems",
                "points": 52.9,
                "status": "partial",
                "details": [
                  {
                    "code": "downloads_total",
                    "params": {
                      "count": 124593,
                      "ecosystems": "rubygems"
                    }
                  }
                ],
                "max_points": 80
              },
              {
                "key": "registry_dependents",
                "name": "Registry dependents",
                "detail": "not reported by this ecosystem",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_reported_by_this_ecosystem",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "moderate",
        "name": "Sustainability & Governance",
        "value": 62,
        "weight": 0.23,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "at_risk",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 22,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 2,
              "top_contributor_share": 0.803
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 80% of commits",
                "points": 4.4,
                "status": "partial",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 80
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "2 contributors",
                "points": 2.7,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 2 contributing companies or organizations -- score normalized to 6",
                "points": 6,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "good",
            "name": "Issue & PR responsiveness",
            "note": "Excluded from scoring (no data or not applicable): Newcomer PR acceptance. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "newcomer_pr_acceptance"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 76,
            "inputs": {
              "merged_prs": 155,
              "open_issues": 3,
              "closed_issues": 46,
              "prs_merged_7d": 5,
              "prs_decided_7d": 5,
              "prs_merged_30d": 20,
              "prs_decided_30d": 21,
              "issue_closed_ratio": 0.939,
              "closed_unmerged_prs": 21,
              "first_time_authors_30d": 0,
              "first_time_prs_merged_30d": 0,
              "first_time_prs_decided_30d": 0
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "94% of issues closed",
                "points": 39.4,
                "status": "partial",
                "details": [
                  {
                    "code": "issues_closed_share",
                    "params": {
                      "share": 94
                    }
                  }
                ],
                "max_points": 42
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "155/176 decided PRs merged",
                "points": 26.4,
                "status": "partial",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 155,
                      "decided": 176
                    }
                  }
                ],
                "max_points": 30
              },
              {
                "key": "newcomer_pr_acceptance",
                "name": "Newcomer PR acceptance",
                "detail": "no first-time contributor's PR decided in 30d",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_newcomer_prs",
                    "params": {
                      "days": 30
                    }
                  }
                ],
                "max_points": 13
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/6 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "good",
            "name": "Ownership & stewardship",
            "note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "verified_domain"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 67,
            "inputs": {
              "followers": 365,
              "owner_type": "User",
              "is_verified": null,
              "owner_login": "delano",
              "public_repos": 95,
              "account_age_days": 6731
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "personal (user) account",
                "points": 10,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_personal",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": "not applicable to user accounts",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_applicable_to_user_accounts",
                    "params": {}
                  }
                ],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "365 followers of delano",
                "points": 18.4,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 365,
                      "login": "delano"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "95 public repos, account ~18 yr old",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 95
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 18
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "exceptional",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "otto"
              ],
              "ecosystems": "rubygems",
              "any_deprecated": false,
              "min_days_since_publish": 0
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on rubygems",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "rubygems"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 0 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 0
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "37 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 37
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "excellent",
        "name": "Engineering Quality",
        "value": 82,
        "weight": 0.19,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "exceptional",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 94,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": true,
              "has_precommit_config": true
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "7 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 7
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": ".rubocop.yml",
                "points": 16,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".rubocop.yml"
                    }
                  }
                ],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 9.6,
                "status": "met",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "6 out of 6 merged PRs checked by a CI test -- score normalized to 10",
                "points": 20,
                "status": "met",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "good",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 65,
            "inputs": {
              "topics": [],
              "has_wiki": false,
              "homepage": null,
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "good",
        "name": "Security",
        "value": 69,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "moderate",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): Packaging, Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "packaging",
                    "signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 61,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 16,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 2,
              "scorecard_aggregate": 6.1
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection is not maximal on development and all release branches",
                "points": 2.2,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "6 out of 6 merged PRs checked by a CI test -- score normalized to 10",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/6 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 2 contributing companies or organizations -- score normalized to 6",
                "points": 1.5,
                "status": "partial",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "update tool detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "30 commit(s) and 30 issue activity found in the last 90 days -- score normalized to 10",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow not detected",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 2",
                "points": 1,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool is not run on all commits -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file not detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 6.8,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "0 existing vulnerabilities detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "exceptional",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 77 resolved dependencies against OSV; 6 could not be assessed (no resolved version, an unsupported ecosystem, or beyond the reported package list). This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "indirect_dependencies_free_of_known_advisories",
                    "no_advisories_left_outstanding"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_repository",
                "params": {
                  "assessed": 77
                }
              },
              {
                "code": "advisories_unassessed",
                "params": {
                  "count": 6
                }
              },
              {
                "code": "advisories_repo_graph_caveat",
                "params": {}
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "source": "osv",
              "advisories": 0,
              "affected_packages": 0,
              "assessed_packages": 77,
              "unassessed_packages": 6,
              "affected_by_severity": "none",
              "direct_affected_packages": 0
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "no direct dependency carries a known advisory",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "no_direct_advisories",
                    "params": {}
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "transitive set not separable from development and test dependencies in this scope",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_scope_not_separable",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory carries a publication date",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_no_publication_date",
                    "params": {}
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "exceptional",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 77,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "exceptional",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "commit_weight_rule": {
                "min_commits": 50,
                "min_commit_share": 0.1
              },
              "review_only_matches": 0,
              "below_threshold_exposures": [],
              "assessed_self_published_locations": 3
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "good",
        "name": "AI Readiness",
        "value": 65,
        "weight": 0.04,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "excellent",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 0.968,
              "agent_instruction_files": [
                "AGENTS.md"
              ],
              "agent_instruction_max_bytes": 5907
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "AGENTS.md",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "AGENTS.md"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "91 of 94 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 91,
                      "sampled": 94
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "moderate",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 63,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "Gemfile.lock"
              ],
              "has_dockerfile": false,
              "typed_language": false,
              "bootstrap_files": [],
              "has_devcontainer": false,
              "has_linter_config": true,
              "typecheck_configs": [],
              "agent_commit_share": 0.47,
              "toolchain_manifests": [],
              "dependency_bot_commit_share": 0.06
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": ".rubocop.yml",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".rubocop.yml"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "47 of the last 100 commits agent-authored or agent-credited",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "agent_authored_commits",
                    "params": {
                      "count": 47,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "6 of the last 100 commits are automated dependency updates",
                "points": 8,
                "status": "met",
                "details": [
                  {
                    "code": "dependency_bot_commits",
                    "params": {
                      "count": 6,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 2",
                "points": 2,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "moderate",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 54,
            "inputs": {
              "primary_language": "Ruby",
              "largest_source_bytes": 90773,
              "source_files_sampled": 225,
              "oversized_source_files": 2
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Ruby without a type-check config",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_typecheck_config_language",
                    "params": {
                      "language": "Ruby"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "2/225 source files over 60KB",
                "points": 54.5,
                "status": "partial",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 225,
                      "oversized": 2
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "weak",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "example_dirs": [
                "examples"
              ],
              "has_mcp_signal": false,
              "api_schema_files": []
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": "examples",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "examples"
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? Carries a deliberately small weight: agent tooling is a real maintenance signal, but its absence must never gate the top of the scale (calibration saturates at raw 91, so 100/100 remains reachable with AI Readiness at zero)."
      }
    ],
    "classification": {
      "labels": [
        "library"
      ],
      "scores": {
        "library": 14
      },
      "primary": "library",
      "evidence": [
        {
          "tier": "declared",
          "label": "library",
          "source": "gem.gemspec",
          "weight": 8
        },
        {
          "tier": "distribution",
          "label": "library",
          "source": "registry:rubygems",
          "weight": 6
        }
      ],
      "artifacts": [
        {
          "path": "otto.gemspec",
          "labels": [
            "library"
          ],
          "ecosystem": "rubygems"
        }
      ],
      "confidence": "high",
      "host_extension": false,
      "runs_as_process": false,
      "consumed_by_code": true
    },
    "metrics_version": "2.3.1"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
  ],
  "report_type": "repository",
  "generated_at": "2026-08-03T18:11:09.891651Z",
  "schema_version": "0.30.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/d/delano/otto.svg",
  "full_name": "delano/otto",
  "license_state": "standard",
  "license_spdx": "MIT"
}