Software health reportschema 0.27.0 · metrics 1.13.0 · 2026-07-23 00:07 UTC
getaxonflow / axonflow-sdk-go

Official Go SDK for AxonFlow — runtime control, MCP policy enforcement, approvals, and audit trails for production AI
GoMIT★ 1 star⑂ 0 forkssince Oct 2025View on GitHub ↗
#agent-governance #ai-control-plane #ai-governance #go #llm-sdk #llm-security #mcp #production-ai #responsible-ai #runtime-control #workflow-governance
getaxonflow/axonflow-sdk-go holds a health index of 66 out of 100, placing it in the Moderate band. It scores highest on Vitality (93/100) and lowest on Community & Adoption (43/100). It was last updated 2 days ago. A single contributor accounts for most of its recent work.
overall / 100
Moderate
Software health index

Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At risk ceiling of 49. AI Readiness sits outside the overall score.
Excellent85-100Exemplary; meets essentially all checked criteria
Good70-84Healthy; minor gaps
Moderate50-69Acceptable with notable gaps; review recommended
At risk30-49Significant weaknesses; adoption warrants caution
Critical1-29Severe problems (abandoned, single-maintainer, no hygiene)
Score profile

Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.
Ownership

getaxonflowOrganization
4 followers15 public repossince Oct 2025
This repository is backed by an organization — shared, accountable stewardship that can outlive any single maintainer.
Package ecosystems

Registry	Package	Version	Downloads / mo	Versions	Last publish
Go	github.com/getaxonflow/axonflow-sdk-go/v9	v9.0.0	-	1	5 days ago
Metrics by category

Vitality

Is the project alive — is code being written and are releases shipping?
93Excellent · 22% of overall
Development activity

88Excellent
How it's scored
36/36	Push recency — last push 2 days ago
23.5/36	Commit cadence — 34/52 weeks with commits
18/18	Commit volume — 197 commits in the last year
10/10	OpenSSF Scorecard: Maintained — 30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Inputs used
commits_last_year	197
human_commit_share	1
days_since_last_push	2
active_weeks_last_year	34
Release discipline

100Excellent
How it's scored
27/27	Ships releases — 65 releases published
36/36	Release recency — latest release 4 days ago
27/27	Release cadence — a release every ~8.8 days
0/10	OpenSSF Scorecard: Signed-Releases — no data
Inputs used
releases_count	65
latest_release_tag	v9.0.0
releases_from_tags	no
days_since_latest_release	4
mean_days_between_releases	8.8
Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.
Community & Adoption

Does the project have users, downloads, attention, and a welcoming setup for contributors?
43At risk · 18% of overall
Popularity & adoption

1Critical
How it's scored
0/60	Stars — 1 stars
0/25	Forks — 0 forks
0/15	Watchers — 1 watchers
Inputs used
forks	0
stars	1
watchers	1
growth_state	unverified
growth_factor_pct	100
growth_unverified_reason	no_history
Community health

92Excellent
How it's scored
22.5/22.5	README
22.5/22.5	License — recognized license (MIT)
18/18	CONTRIBUTING guide
13.5/13.5	Code of conduct
0/7.2	Issue template
6.3/6.3	PR template
Inputs used
has_readme	yes
has_license	yes
has_contributing	yes
has_issue_template	no
has_code_of_conduct	yes
has_pull_request_template	yes
Sustainability & Governance

Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?
52Moderate · 24% of overall
Maintainer resilience (bus factor)

18Critical
How it's scored
9/54	Bus factor — 1 contributor(s) cover half of all commits
0.5/22.5	Commit distribution — top contributor authored 98% of commits
2.7/13.5	Contributor breadth — 2 contributors
6/10	OpenSSF Scorecard: Contributors — project has 2 contributing companies or organizations -- score normalized to 6
Inputs used
bus_factor	1
contributors_sampled	2
top_contributor_share	0.98
Issue & PR responsiveness

76Good
How it's scored
38.9/46.8	Issue resolution — 83% of issues closed
36.8/38.3	PR acceptance — 175/182 decided PRs merged
0/15	OpenSSF Scorecard: Code-Review — Found 2/30 approved changesets -- score normalized to 0
Inputs used
merged_prs	175
open_issues	1
closed_issues	5
issue_closed_ratio	0.833
closed_unmerged_prs	7
Ownership & stewardship

45At risk
How it's scored
30/30	Ownership backing — organization-owned
0/20	Verified domain
5/25	Owner reach — 4 followers of getaxonflow
10.3/25	Track record — 15 public repos, account ~0 yr old
Inputs used
followers	4
owner_type	Organization
is_verified	—
owner_login	getaxonflow
public_repos	15
account_age_days	272
Package maintenance

84Good
How it's scored
25/25	Published & resolvable — 1 package(s) on go
35/35	Publish recency — latest publish 5 days ago
4/20	Version history — 1 published versions
20/20	Not deprecated — active, not deprecated or yanked
Inputs used
packages	github.com/getaxonflow/axonflow-sdk-go/v9
ecosystems	go
any_deprecated	no
min_days_since_publish	5
Engineering Quality

Are baseline engineering and documentation practices in place?
75Good · 20% of overall
Engineering practices

68Moderate
How it's scored
24/24	CI workflows — 6 workflow(s)
24/24	Tests present
0/16	Linter config
0/9.6	Pre-commit hooks
0/6.4	.editorconfig
20/20	OpenSSF Scorecard: CI-Tests — 30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Inputs used
has_ci	yes
has_tests	yes
has_editorconfig	no
has_linter_config	no
has_precommit_config	no
Documentation

85Excellent
How it's scored
30/30	README
25/25	Documentation directory
0/15	Documentation / homepage site
10/10	Repository description
10/10	Topics — 11 topics
10/10	Wiki
Inputs used
topics	agent-governance, ai-control-plane, ai-governance, go, llm-sdk, llm-security, mcp, production-ai, responsible-ai, runtime-control, workflow-governance
has_wiki	yes
homepage	—
has_readme	yes
has_docs_dir	yes
has_description	yes
Security

Are visible security and supply-chain practices strong, without unresolved high-risk jurisdiction exposure?
64Moderate · 16% of overall
Security posture

55Moderate
How it's scored
7.5/7.5	Binary-Artifacts — no binaries found in the repo
2.2/7.5	Branch-Protection — branch protection is not maximal on development and all release branches
2.5/2.5	CI-Tests — 30 out of 30 merged PRs checked by a CI test -- score normalized to 10
0/2.5	CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected
0/7.5	Code-Review — Found 2/30 approved changesets -- score normalized to 0
1.5/2.5	Contributors — project has 2 contributing companies or organizations -- score normalized to 6
10/10	Dangerous-Workflow — no dangerous workflow patterns detected
0/7.5	Dependency-Update-Tool — no update tool detected
0/5	Fuzzing — project is not fuzzed
2.5/2.5	License — license file detected
7.5/7.5	Maintained — 30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
0/5	Packaging — no data
0/5	Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0
5/5	SAST — SAST tool is run on all commits
5/5	Security-Policy — security policy file detected
0/7.5	Signed-Releases — no data
0/7.5	Token-Permissions — detected GitHub workflow tokens with excessive permissions
7.5/7.5	Vulnerabilities — 0 existing vulnerabilities detected
Inputs used
source	openssf_scorecard
checks_evaluated	16
scorecard_version	v5.5.0
checks_inconclusive	2
scorecard_aggregate	5.5
Excluded from scoring (no data or not applicable): packaging, signed_releases. Remaining weights renormalized.
Dependency advisories

100Excellent
How it's scored
35/35	Direct dependencies free of known advisories — no direct dependency carries a known advisory
0/25	Indirect dependencies free of known advisories — transitive set not separable from development and test dependencies in this scope
0/40	No advisories left outstanding — no advisory carries a publication date
Inputs used
source	osv
advisories	0
affected_packages	0
assessed_packages	2
unassessed_packages	0
affected_by_severity	none
direct_affected_packages	0
Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 2 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.
AI Readiness

How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score.
55Moderate · 0% of overall
Agent context & guidance

40At risk
How it's scored
0/45	Agent instructions — no CLAUDE.md / AGENTS.md / editor rules
0/15	Machine-readable docs (llms.txt)
40/40	Legible commit history — 99 of 100 human commits state their intent (structured subject or explanatory body)
Inputs used
has_llms_txt	no
legible_history_share	0.99
agent_instruction_files	—
agent_instruction_max_bytes	—
Verify loop (build / test / typecheck)

56Moderate
How it's scored
12.6/18	One-command bootstrap — examples/explain-decision/go.mod, examples/wcp-retry-idempotency/go.mod, go.mod (toolchain convention, no task runner)
22/22	Automated tests
0/11	Lint / format config
11/11	Static type checking — Go (statically typed)
10/10	Reproducible environment — lockfile
0/10	Demonstrated agent practice — no agent-authored commits among the last 100
0/8	Automated maintenance — no automated dependency updates observed
0/10	OpenSSF Scorecard: Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0
Inputs used
has_nix	no
has_tests	yes
lockfiles	go.sum
has_dockerfile	no
typed_language	yes
bootstrap_files	—
has_devcontainer	no
has_linter_config	no
typecheck_configs	—
agent_commit_share	0
toolchain_manifests	examples/explain-decision/go.mod, examples/wcp-retry-idempotency/go.mod, go.mod, tests/heartbeat-real-stack/go.mod
dependency_bot_commit_share	0
Code legibility for models

99Excellent
How it's scored
45/45	Type-checkable code — Go (statically typed)
53.8/55	Manageable file sizes — 2/93 source files over 60KB
Inputs used
primary_language	Go
largest_source_bytes	106,737
source_files_sampled	93
oversized_source_files	2
Machine-readable interfaces

40At risk
How it's scored
0/40	API schema (OpenAPI/GraphQL/proto)
0/20	MCP server
40/40	Runnable examples — examples
Inputs used
example_dirs	examples
has_mcp_signal	no
api_schema_files	—
Key facts

1GitHub stars
2contributors
197commits, last 12 months
2days since last push
65releases
1bus factor
1open issues
Gopackage ecosystems
Data collection warnings

Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
More detail

OpenSSF Scorecard 5.5 / 10
5.5aggregate
Independent, tool-agnostic security assessment from the open-source OpenSSF Scorecard. Each check rewards a security practice, not a specific vendor's tool. Checks Scorecard could not determine are marked n/a and excluded from the security score (never counted as zero).Scorecard v5.5.0 · 2026-07-23 00:07 UTC
10	Binary-Artifacts	no binaries found in the repo
3	Branch-Protection	branch protection is not maximal on development and all release branches
10	CI-Tests	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
0	CII-Best-Practices	no effort to earn an OpenSSF best practices badge detected
0	Code-Review	Found 2/30 approved changesets -- score normalized to 0
6	Contributors	project has 2 contributing companies or organizations -- score normalized to 6
10	Dangerous-Workflow	no dangerous workflow patterns detected
0	Dependency-Update-Tool	no update tool detected
0	Fuzzing	project is not fuzzed
10	License	license file detected
10	Maintained	30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
n/a	Packaging	packaging workflow not detected
0	Pinned-Dependencies	dependency not pinned by hash detected -- score normalized to 0
10	SAST	SAST tool is run on all commits
10	Security-Policy	security policy file detected
n/a	Signed-Releases	no releases found
0	Token-Permissions	detected GitHub workflow tokens with excessive permissions
10	Vulnerabilities	0 existing vulnerabilities detected
Direct dependencies 1
Registry	Package	Version constraint	Manifest
Go	gopkg.in/yaml.v3	`v3.0.1`	go.mod
All dependencies 2
Full resolved dependency set from the GitHub dependency graph: 1 direct and 1 indirect (transitive) packages. The transitive closure is complete when the repository commits a lockfile.
Registry	Package	Version	Relation
Go	gopkg.in/yaml.v3	`v3.0.1`	direct
Go	../..	`9.0.0`	indirect
Dependency advisories 0
This repository publishes no package the index resolves, so its own dependency graph was assessed — 2 packages, which also include development and test pins that never ship: 0 carry known advisories, of which 0 are direct.
No known advisories affect the assessed dependencies.
An advisory means the version recorded in the dependency graph falls inside an advisory’s affected range. Reachability is not analysed, and the graph includes development and test pins — a finding may concern tooling rather than shipped software.
Raw JSON report machine-readable
{
  "data": {
    "repo": {
      "topics": [
        "agent-governance",
        "ai-control-plane",
        "ai-governance",
        "go",
        "llm-sdk",
        "llm-security",
        "mcp",
        "production-ai",
        "responsible-ai",
        "runtime-control",
        "workflow-governance"
      ],
      "is_fork": false,
      "size_kb": 721,
      "has_wiki": true,
      "homepage": null,
      "languages": {
        "Go": 1307634,
        "Shell": 6865,
        "Python": 9615
      },
      "pushed_at": "2026-07-20T06:12:28Z",
      "created_at": "2025-10-27T20:11:57Z",
      "owner_type": "Organization",
      "updated_at": "2026-07-20T06:12:40Z",
      "description": "Official Go SDK for AxonFlow — runtime control, MCP policy enforcement, approvals, and audit trails for production AI",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "MIT",
      "default_branch": "main",
      "license_spdx_raw": "MIT",
      "primary_language": "Go",
      "significant_languages": [
        "Go"
      ]
    },
    "owner": {
      "blog": null,
      "name": null,
      "type": "Organization",
      "login": "getaxonflow",
      "company": null,
      "location": null,
      "followers": 4,
      "avatar_url": "https://avatars.githubusercontent.com/u/239772217?v=4",
      "created_at": "2025-10-23T10:11:57Z",
      "is_verified": null,
      "public_repos": 15,
      "account_age_days": 272
    },
    "license": {
      "state": "standard",
      "spdx_id": "MIT",
      "raw_spdx": "MIT",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v9.0.0",
          "kind": "major",
          "published_at": "2026-07-18T00:10:10Z"
        },
        {
          "tag": "v8.5.1",
          "kind": "patch",
          "published_at": "2026-07-10T00:29:04Z"
        },
        {
          "tag": "v8.5.0",
          "kind": "minor",
          "published_at": "2026-06-09T10:46:47Z"
        },
        {
          "tag": "v8.4.0",
          "kind": "minor",
          "published_at": "2026-05-30T11:22:13Z"
        },
        {
          "tag": "v8.3.0",
          "kind": "minor",
          "published_at": "2026-05-27T11:11:14Z"
        },
        {
          "tag": "v8.2.0",
          "kind": "minor",
          "published_at": "2026-05-23T16:40:03Z"
        },
        {
          "tag": "v8.1.0",
          "kind": "minor",
          "published_at": "2026-05-22T18:19:54Z"
        },
        {
          "tag": "v8.0.0",
          "kind": "major",
          "published_at": "2026-05-09T15:33:01Z"
        },
        {
          "tag": "v7.1.0",
          "kind": "minor",
          "published_at": "2026-05-06T12:37:02Z"
        },
        {
          "tag": "v7.0.0",
          "kind": "major",
          "published_at": "2026-04-29T23:21:57Z"
        },
        {
          "tag": "v6.0.0",
          "kind": "major",
          "published_at": "2026-04-28T18:49:57Z"
        },
        {
          "tag": "v5.8.0",
          "kind": "minor",
          "published_at": "2026-04-25T20:42:02Z"
        },
        {
          "tag": "v5.7.0",
          "kind": "minor",
          "published_at": "2026-04-25T14:34:50Z"
        },
        {
          "tag": "v5.6.1",
          "kind": "patch",
          "published_at": "2026-04-24T22:21:47Z"
        },
        {
          "tag": "v5.6.0",
          "kind": "minor",
          "published_at": "2026-04-22T13:28:10Z"
        },
        {
          "tag": "v5.5.0",
          "kind": "minor",
          "published_at": "2026-04-21T22:08:04Z"
        },
        {
          "tag": "v5.4.0",
          "kind": "minor",
          "published_at": "2026-04-18T12:19:36Z"
        },
        {
          "tag": "v5.3.1",
          "kind": "patch",
          "published_at": "2026-04-11T00:25:41Z"
        },
        {
          "tag": "v5.3.0",
          "kind": "minor",
          "published_at": "2026-04-09T23:46:19Z"
        },
        {
          "tag": "v5.2.0",
          "kind": "minor",
          "published_at": "2026-04-08T21:08:52Z"
        },
        {
          "tag": "v5.1.0",
          "kind": "minor",
          "published_at": "2026-04-06T18:33:55Z"
        },
        {
          "tag": "v5.0.0",
          "kind": "major",
          "published_at": "2026-04-05T13:25:57Z"
        },
        {
          "tag": "v4.3.0",
          "kind": "minor",
          "published_at": "2026-03-25T10:52:34Z"
        },
        {
          "tag": "v4.2.0",
          "kind": "minor",
          "published_at": "2026-03-16T18:53:29Z"
        },
        {
          "tag": "v4.1.0",
          "kind": "minor",
          "published_at": "2026-03-14T18:19:32Z"
        },
        {
          "tag": "v4.0.0",
          "kind": "major",
          "published_at": "2026-03-09T05:26:47Z"
        },
        {
          "tag": "v3.8.0",
          "kind": "minor",
          "published_at": "2026-03-03T11:17:48Z"
        },
        {
          "tag": "v3.7.0",
          "kind": "minor",
          "published_at": "2026-02-28T09:17:57Z"
        },
        {
          "tag": "v3.6.0",
          "kind": "minor",
          "published_at": "2026-02-22T10:35:41Z"
        },
        {
          "tag": "v3.5.0",
          "kind": "minor",
          "published_at": "2026-02-18T02:49:17Z"
        },
        {
          "tag": "v3.4.0",
          "kind": "minor",
          "published_at": "2026-02-13T12:02:31Z"
        },
        {
          "tag": "v3.3.1",
          "kind": "patch",
          "published_at": "2026-02-11T23:13:20Z"
        },
        {
          "tag": "v3.3.0",
          "kind": "minor",
          "published_at": "2026-02-10T16:20:57Z"
        },
        {
          "tag": "v3.2.0",
          "kind": "minor",
          "published_at": "2026-02-05T12:59:53Z"
        },
        {
          "tag": "v3.1.0",
          "kind": "minor",
          "published_at": "2026-02-04T13:18:27Z"
        },
        {
          "tag": "v3.0.0",
          "kind": "major",
          "published_at": "2026-02-03T00:28:52Z"
        },
        {
          "tag": "v2.7.1",
          "kind": "patch",
          "published_at": "2026-01-26T02:19:46Z"
        },
        {
          "tag": "v2.7.0",
          "kind": "minor",
          "published_at": "2026-01-25T16:55:05Z"
        },
        {
          "tag": "v2.6.0",
          "kind": "minor",
          "published_at": "2026-01-18T17:30:35Z"
        },
        {
          "tag": "v2.5.0",
          "kind": "minor",
          "published_at": "2026-01-17T14:08:39Z"
        },
        {
          "tag": "v2.4.0",
          "kind": "minor",
          "published_at": "2026-01-14T22:30:13Z"
        },
        {
          "tag": "v2.3.0",
          "kind": "minor",
          "published_at": "2026-01-09T16:33:10Z"
        },
        {
          "tag": "v2.2.0",
          "kind": "minor",
          "published_at": "2026-01-08T05:06:52Z"
        },
        {
          "tag": "v2.1.0",
          "kind": "minor",
          "published_at": "2026-01-05T23:05:39Z"
        },
        {
          "tag": "v2.0.0",
          "kind": "major",
          "published_at": "2026-01-05T20:34:09Z"
        },
        {
          "tag": "v1.17.0",
          "kind": "minor",
          "published_at": "2026-01-04T16:24:19Z"
        },
        {
          "tag": "v1.16.0",
          "kind": "minor",
          "published_at": "2026-01-04T14:44:09Z"
        },
        {
          "tag": "v1.15.0",
          "kind": "minor",
          "published_at": "2026-01-04T01:43:27Z"
        },
        {
          "tag": "v1.14.0",
          "kind": "minor",
          "published_at": "2025-12-30T13:29:28Z"
        },
        {
          "tag": "v1.12.0",
          "kind": "minor",
          "published_at": "2025-12-29T23:43:29Z"
        },
        {
          "tag": "v1.11.0",
          "kind": "minor",
          "published_at": "2025-12-29T18:32:01Z"
        },
        {
          "tag": "v1.10.0",
          "kind": "minor",
          "published_at": "2025-12-29T13:24:15Z"
        },
        {
          "tag": "v1.9.0",
          "kind": "minor",
          "published_at": "2025-12-29T01:44:23Z"
        },
        {
          "tag": "v1.8.0",
          "kind": "minor",
          "published_at": "2025-12-28T17:48:45Z"
        },
        {
          "tag": "v1.7.0",
          "kind": "minor",
          "published_at": "2025-12-28T16:50:56Z"
        },
        {
          "tag": "v1.6.0",
          "kind": "minor",
          "published_at": "2025-12-24T23:58:05Z"
        },
        {
          "tag": "v1.5.1",
          "kind": "patch",
          "published_at": "2025-12-23T01:06:56Z"
        },
        {
          "tag": "v1.5.0",
          "kind": "minor",
          "published_at": "2025-12-19T14:52:30Z"
        },
        {
          "tag": "v1.4.1",
          "kind": "patch",
          "published_at": "2025-12-15T20:05:24Z"
        },
        {
          "tag": "v1.4.0",
          "kind": "minor",
          "published_at": "2025-12-05T16:55:35Z"
        },
        {
          "tag": "v1.3.0",
          "kind": "minor",
          "published_at": "2025-11-11T21:20:38Z"
        },
        {
          "tag": "v1.2.1",
          "kind": "patch",
          "published_at": "2025-10-29T22:27:42Z"
        },
        {
          "tag": "v1.2.0",
          "kind": "minor",
          "published_at": "2025-10-29T15:29:27Z"
        },
        {
          "tag": "v1.1.0",
          "kind": "minor",
          "published_at": "2025-10-29T12:18:20Z"
        },
        {
          "tag": "v1.0.0",
          "kind": "major",
          "published_at": "2025-10-27T20:20:21Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "14c1fe04ad78e28a15bc3f24ab1f3955ac7a1963",
          "body": "…#2912) (#192)\n\ngetaxonflow/axonflow-enterprise#2953 merged and shipped in platform\nv9.11.0. Folded into that same merge, #2903 changed the server's\nfallback default (when neither CallerName nor the legacy ToolType is\nsupplied) from \"claude_code\" to \"unknown\", so an unidentified caller\nis no longer \n[…]\nither-supplied case\nagainst a real running stack, alongside the existing CallerName\nround-trip assertion, and correct the CHANGELOG wording to match.\n\nSigned-off-by: Gregory Zak <gzak@getaxonflow.com>",
          "is_bot": false,
          "headline": "fix: cover the unknown no-identity default in caller_name e2e proof (…",
          "author_name": "Greg",
          "author_login": "gzak",
          "committed_at": "2026-07-20T06:12:26Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3328356b1adc4f62f0b1fdceb2f6cd270dae3234",
          "body": "… (#189)\n\n* fix(langgraph): stop concatenating ServerName+Name into connectorType\n\nNewMCPToolInterceptor derived a single connectorType by concatenating\n\"{serverName}.{toolName}\" before sending it as the sole identity field\non MCPCheckInput/MCPCheckOutput. The platform's check-input/check-output\nsch\n[…]\nin@getaxonflow.com>\n\n---------\n\nSigned-off-by: Gregory Zak <gzak@getaxonflow.com>\nSigned-off-by: Saurabh Jain <saurabh.jain@getaxonflow.com>\nCo-authored-by: Saurabh Jain <saurabh.jain@getaxonflow.com>",
          "is_bot": false,
          "headline": "fix(langgraph): stop concatenating ServerName+Name into connectorType…",
          "author_name": "Greg",
          "author_login": "gzak",
          "committed_at": "2026-07-17T23:19:44Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "120419b513edff2a15b4f6deb0b8bfa82c07e84a",
          "body": "* feat: add CallerName to AuditToolCallRequest (#2912)\n\ntool_type on AuditToolCallRequest was misleadingly named: every real\ncaller (claude_code/codex/cursor/openclaw) used it to identify which\nclient made the tool call, not any property of the tool. Add\nCallerName as the correctly-named field for t\n[…]\nin@getaxonflow.com>\n\n---------\n\nSigned-off-by: Gregory Zak <gzak@getaxonflow.com>\nSigned-off-by: Saurabh Jain <saurabh.jain@getaxonflow.com>\nCo-authored-by: Saurabh Jain <saurabh.jain@getaxonflow.com>",
          "is_bot": false,
          "headline": "feat: add CallerName to AuditToolCallRequest (#2912) (#190)",
          "author_name": "Greg",
          "author_login": "gzak",
          "committed_at": "2026-07-17T20:43:43Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7164b228579cc6bdcea3a31792d916fdbbe71c2b",
          "body": "* fix: fail-closed on 4xx in production mode, gate debug logs, repair examples\n\n- ProxyLLMCall production-mode fail-open no longer converts HTTP 401/4xx\n  into a synthetic success (structural isFailOpenEligible; 5xx/429/transport\n  stay eligible)\n- [SDK-DEBUG] raw-body/result logging now requires Co\n[…]\n 1.22 is EOL.\n\nSigned-off-by: Saurabh Jain <saurabh.jain@getaxonflow.com>\n\n---------\n\nSigned-off-by: Saurabh Jain <saurabhjain1592@gmail.com>\nSigned-off-by: Saurabh Jain <saurabh.jain@getaxonflow.com>",
          "is_bot": false,
          "headline": "fix: fail-closed on 4xx, gate debug logs, repair examples (#183)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-07-09T23:54:49Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6606be2ddd2a1a6e90ca70f2c31d3a9c2db0e960",
          "body": "The /api/v1/decisions read surface canonicalized in platform 9.0.0:\nthe endpoint returns allowed|blocked|redacted|needs_approval|error and\nthe ?decision= filter rejects the old allow|deny|require_approval with\nHTTP 400. The SDK code is a string passthrough and is unaffected, but\nthe list_decisions /\n[…]\neds_approval) and the workflow-control gate\ndecision (allow|block|require_approval) are deliberately untouched.\n\nHeld for the 9.0.0 release.\n\nSigned-off-by: Saurabh Jain <saurabh.jain@getaxonflow.com>",
          "is_bot": false,
          "headline": "docs(decisions): canonical /decisions verdict values for 9.0.0 (#182)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-06-12T06:28:05Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e2f5dc6eed4d81971bf26f214cb43ad4d7c3e2f6",
          "body": "* feat(pep): decide -> fulfill -> forward Decision Mode PEP (#2571)\n\nPort the Decision Mode PEP (Policy Enforcement Point) contract into the Go\nSDK: a single blessed path of decide -> fulfill -> forward (ADR-056, epic\nthe platform/shared/pep Go reference PEP.\n\nThe structural guarantee #2563 demands:\n[…]\ncideAndFulfill\ntests (the latter asserts empty content on this path).\n\nSigned-off-by: Saurabh Jain <saurabh.jain@getaxonflow.com>\n\n---------\n\nSigned-off-by: Saurabh Jain <saurabh.jain@getaxonflow.com>",
          "is_bot": false,
          "headline": "feat(pep): decide -> fulfill -> forward Decision Mode PEP (#2571) (#181)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-06-09T09:57:40Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1503ae0171a9ade6ed1d27c95abcd2c55a9a2420",
          "body": "…sfer basis (#180)\n\nTargets AxonFlow platform v8.5.0 (epic #2508).\n\n- DecisionSummary + DecisionExplanation gain a Context map[string]string\n  (json:\"context,omitempty\") surfacing the sanitized request context a PEP\n  attaches to a Decision Mode call (platform #2509). ListDecisions returns the\n  pla\n[…]\n.0, CHANGELOG entry, unit tests, and a runtime-e2e driver\n  that creates a decision via the PEP path and reads Context back through the SDK.\n\nSigned-off-by: Saurabh Jain <saurabh.jain@getaxonflow.com>",
          "is_bot": false,
          "headline": "feat(release): v8.4.0 — decision request context + pasal_56b_dpa tran…",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-05-30T11:20:59Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ee59ecbad8a8125adaa116dd530417fa04d7fb86",
          "body": "Signed-off-by: Saurabh Jain <saurabh.jain@getaxonflow.com>",
          "is_bot": false,
          "headline": "chore(changelog): fix release date to 2026-05-27 (#179)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-05-27T09:46:36Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6fc8fc431aa9411f758227a9a1f029303107d9fd",
          "body": "…-runtime-e2e] (#178)\n\n* feat(indonesia): add pii-indonesia category, cross-border audit fields, OJK types\n\nAdd CategoryPIIIndonesia policy category constant (\"pii-indonesia\")\nfor Indonesian PII detection (NIK, KK, NPWP, BPJS).\n\nAdd DataResidency and TransferBasis optional fields to AuditLogEntry\nfo\n[…]\ndev@getaxonflow.com>\nSigned-off-by: Saurabh Jain <saurabh.jain@getaxonflow.com>\n\n---------\n\nSigned-off-by: Saurabh Jain <dev@getaxonflow.com>\nSigned-off-by: Saurabh Jain <saurabh.jain@getaxonflow.com>",
          "is_bot": false,
          "headline": "feat(indonesia): pii-indonesia + cross-border audit + OJK types [skip…",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-05-26T14:38:39Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1d303fd72bed81a6c9fc029815b75a8605fa87f9",
          "body": "…177)\n\n- Replace \"6 months free Enterprise / 3 months managed SaaS\" with scoped\n  design-partner engagement + preferential pricing after successful rollout\n- LoI signed at kickoff; case study + reference after deployment\n- Aligns with broader sweep across landing + SDK + docs repos\n\nSigned-off-by: Saurabh Jain <saurabh.jain@getaxonflow.com>",
          "is_bot": false,
          "headline": "docs: update design-partner messaging to scoped engagement framing (#…",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-05-25T01:35:18Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "654c759ba750b1ba3eca1edfce92e9315f5fbc81",
          "body": "Add platform >= 8.1.0 requirement to v8.2.0 Compatibility section.\nReplace \"operator\" with compliant wording in unreleased v8.1.0 entry.\n\nPart of the cross-repo release-prep sweep\n(getaxonflow/axonflow-enterprise#2428).\n\nSigned-off-by: Saurabh Jain <saurabh.jain@getaxonflow.com>",
          "is_bot": false,
          "headline": "chore(release): v8.2.0 platform cross-ref + terminology fix (#176)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-05-23T15:41:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "83ca358da2bac1594432abef1bff4930383aec2b",
          "body": "… v1 (#175)\n\n* feat(hitl): add CreateHITLRequest for explicit HITL row creation\n\nEnables agent-framework callers (Google ADK, n8n, OpenAI Agents SDK)\nto implement the full 4-step HITL approval flow against AxonFlow:\n\n  1. Gate evaluates require_approval (via pre_check / check_tool_input)\n  2. Caller\n[…]\n from master verification.\n\nRefs getaxonflow/axonflow-enterprise#2421\n\nSigned-off-by: Saurabh Jain <saurabh.jain@getaxonflow.com>\n\n---------\n\nSigned-off-by: Saurabh Jain <saurabh.jain@getaxonflow.com>",
          "is_bot": false,
          "headline": "feat(hitl): add CreateHITLRequest — paired SDK release for ADK plugin…",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-05-23T10:45:09Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2bb8c8244422e3daf287c9308019eeca7caa9351",
          "body": "… (#174)\n\nDate-only update on the topmost release-line section header to match\nthe actual release day. No content changes.\n\n## Skip-runtime-e2e justification\n\nPure documentation change — only CHANGELOG.md is touched. No runtime\nbinary, SDK, or agent code path changes. No env-var defaults, wire\nshape, or feature behavior affected. No runtime feature surface exists\nfor runtime-e2e to exercise.\n\nSigned-off-by: Saurabh Jain <saurabh.jain@getaxonflow.com>",
          "is_bot": false,
          "headline": "chore: update CHANGELOG release date to 2026-05-22 [skip-runtime-e2e]…",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-05-22T17:37:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "48587920dc8d1a5fad823e56af2c3c218393a187",
          "body": "…ntime-e2e] (#173)\n\n## Skip-runtime-e2e justification\n\nCHANGELOG-only edit — pure release-notes hygiene, no code change, no\nruntime contract touched.\n\n## Summary\n\nRemoves the `### Tracking` trailers (with internal issue links) that\nthe v9.0.0 release-notes hygiene audit added to its touched sections\n[…]\nsummary, Added/Changed/Fixed bullets, and\nany URLs that point to customer-accessible resources (e.g. the public\nprivacy page) are unchanged.\n\nSigned-off-by: Saurabh Jain <saurabh.jain@getaxonflow.com>",
          "is_bot": false,
          "headline": "chore(changelog): strip internal-reference Tracking trailers [skip-ru…",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-05-21T18:01:58Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "0a9586f13f31fb59e5a347e5b9d57eb97607b77e",
          "body": "…e-e2e] (#172)\n\n## Skip-runtime-e2e justification\n\nCHANGELOG-only edit — pure release-notes hygiene, no code change, no\nruntime contract touched.\n\n## Summary\n\nCleans the v8.1.0 entry per the release-notes audit criteria:\n\n- Dropped \"Epic #2230\" / \"(v9.1 preflight, #2277)\" inline issue and\n  epic ref\n[…]\ntrengthened the cross-repo coherence of the X-Client-ID +\n  org_id description against the other 4 SDKs.\n\nNo SDK config or behavior changes.\n\nSigned-off-by: Saurabh Jain <saurabh.jain@getaxonflow.com>",
          "is_bot": false,
          "headline": "chore(changelog): audit v8.1.0 entry for release hygiene [skip-runtim…",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-05-21T17:42:17Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c2e29fadbb6e9993bc431e84dc4908a682f8933f",
          "body": "Brings Go SDK telemetry up to parity with the platform's\nstartup_telemetry.go emitter. Every heartbeat body now identifies\nwhich deployment-organization emitted it via an org_id field on the\nwire.\n\nThree sources, precedence order:\n1. ORG_ID env var when set (the operator's explicit configuration on\n\n[…]\n05-21).\n\nRefs: getaxonflow/axonflow-enterprise#2230 (Epic v9 identity)\nRefs: getaxonflow/axonflow-enterprise#2277 (v9.1 SDK + plugin org_id)\n\nSigned-off-by: Saurabh Jain <saurabh.jain@getaxonflow.com>",
          "is_bot": false,
          "headline": "feat(telemetry): include org_id in heartbeat payload (v9.1 #2277) (#171)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-05-21T12:36:45Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6be11d37cb6964c5cbe980fbf9ebd0b5d0d25d6f",
          "body": "* Clarify evaluation and design partner paths in README\n\nSigned-off-by: Saurabh Jain <saurabh.jain@getaxonflow.com>\n\n* docs(readme): restore incident-readiness review\n\nSigned-off-by: Saurabh Jain <saurabh.jain@getaxonflow.com>\n\n---------\n\nSigned-off-by: Saurabh Jain <saurabh.jain@getaxonflow.com>",
          "is_bot": false,
          "headline": "Clarify evaluation and design partner paths in README (#170)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-05-20T15:24:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9618b83ff1f3d7ab000f0c1a503d520be4641d18",
          "body": "Locks in that HTTP 401 responses are terminal in executeWithRetry and\nnever trigger a retry. Backstops getaxonflow/axonflow-enterprise#2275\nwhere a customer's misconfigured deployment caused a tight 401 retry\nloop against community-saas (~30 401/hour from a single source IP).\n\nGo SDK is already safe\n[…]\nkes the test fail with\n`Expected 1 call (no retry on 401), got 3` — confirming the assertion\nisn't tautological.\n\nNo code change; test-only.\n\nSigned-off-by: Saurabh Jain <saurabh.jain@getaxonflow.com>",
          "is_bot": false,
          "headline": "test(2275): add 401-not-retried regression test (#169)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-05-20T11:23:28Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3aa968a2f8906f009d74792092be982624fd093e",
          "body": "…) (#168)\n\n* feat(identity): emit X-Client-ID header on every outbound request (v9)\n\nEvery governed request now carries an X-Client-ID header alongside the\nexisting Basic Auth + X-Axonflow-Client headers, matching the v9 identity\ncontract on the platform (Epic getaxonflow/axonflow-enterprise#2230).\n\n[…]\nreqs: AXONFLOW_AGENT_URL, AXONFLOW_TENANT_ID,\nAXONFLOW_TENANT_SECRET.\n\nSigned-off-by: Saurabh Jain <saurabh.jain@getaxonflow.com>\n\n---------\n\nSigned-off-by: Saurabh Jain <saurabh.jain@getaxonflow.com>",
          "is_bot": false,
          "headline": "feat(identity): emit X-Client-ID header on every outbound request (v9…",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-05-19T21:29:44Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2203826ae5cf877688b481e70849eb24ddaba981",
          "body": "* chore(ci): cancel orphaned PR runs + prune Go matrix on PR\n\nSame shape as axonflow-sdk-{java,python,typescript}#176/#194/#225:\n\n1. Concurrency on test, heartbeat-real-stack, definition-of-done,\n   validate-version-alignment, integration (existing block reshaped\n   to PR-only cancel + sha for push)\n[…]\n stable `Test Summary` check that branch\nprotection should require instead.\n\nSigned-off-by: Saurabh Jain <saurabhjain1592@gmail.com>\n\n---------\n\nSigned-off-by: Saurabh Jain <saurabhjain1592@gmail.com>",
          "is_bot": false,
          "headline": "chore(ci): cancel orphaned PR runs + prune Go matrix on PR (#167)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-05-10T19:37:17Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "62b9fc7677865a07613a489526d51bdd964aa028",
          "body": "…166)\n\nThe Go module migrated to `module github.com/getaxonflow/axonflow-sdk-go/v8`\non main, but release.yml still references `/v7` in three places. Without\nthis fix, v8.0.0 release notes would tell users `go get .../v7@v8.0.0`\n(404) and the pkg.go.dev pre-warm curl would fetch a non-existent path.\n\n[…]\nall instruction in release body template\n* L44 — pkg.go.dev link in release body template\n* L108 — proxy.golang.org pre-warm curl in notify job\n\nSigned-off-by: Saurabh Jain <saurabhjain1592@gmail.com>",
          "is_bot": false,
          "headline": "fix(release): update release.yml v7→v8 paths post module migration (#…",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-05-09T15:31:55Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b0371871e8434a91b0ce206ead3a88a5ae920951",
          "body": "…policy_version (#165)\n\nThe two user-facing surfaces this version delivers are (a) the new\nListDecisions client API + decision-history fanout to the four IDE\nplugins, and (b) policy_version recorded inline on every static-policy\ndecision so explain stays accurate after policies are edited.\n\nThe previous title omitted the policy_version surface entirely.\nRetitle aligns with the v7.9.0 platform release theme.\n\nSigned-off-by: Saurabh Jain <saurabhjain1592@gmail.com>",
          "is_bot": false,
          "headline": "chore(changelog): retitle v8.0.0 to highlight Decision History API + …",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-05-09T14:34:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "705d4aa63f305188eaffb2a04158d5cbf7ae4591",
          "body": "… [skip-runtime-e2e] (#164)\n\nCHANGELOG.md is a customer surface; per the project's hygiene rule it\nshould not carry engineering-context references. Sweep removes:\n\n- ADR references (`ADR-022`, `ADR-024`, `ADR-027`, `ADR-030`, etc.)\n- Issue / Epic / PR numbers (`(Issue #1169)`, `(EPIC #1074)`, `(#126\n[…]\nhe actual ship day.\n\nWire schema, public API surfaces, and version semantics are unchanged —\nthis is a docs-only scrub of release-note content.\n\nSigned-off-by: Saurabh Jain <saurabhjain1592@gmail.com>",
          "is_bot": false,
          "headline": "chore(changelog): hygiene scrub — drop ADR/issue/PR/internal-doc refs…",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-05-09T13:26:52Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "bd99e1d7cb59322f6487009040607742a8e10616",
          "body": "The v1-telemetry `profile` field never reached any tagged customer release — its CHANGELOG mentions are internal noise. Drop the [8.0.1] section entirely and scrub the profile-specific clauses from the [8.0.0] section. Revert version.go from 8.0.1 → 8.0.0.\n\nThe remaining v8.0.0 features (decision hi\n[…]\nflow-enterprise#2033 (original env-var collision bug), getaxonflow/axonflow-enterprise#2035 (code-side fix already shipped on main as ef418ac).\n\nSigned-off-by: Saurabh Jain <saurabhjain1592@gmail.com>",
          "is_bot": false,
          "headline": "docs(changelog): scrub profile-field noise [skip-runtime-e2e] (#163)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-05-08T18:56:06Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ef418ac29b9421c756ed1efc47e2083176b9f00b",
          "body": "* fix(telemetry): drop profile field (collides with governance env var)\n\nThe v8.0.0 telemetry payload added a `profile` field sourced from\nAXONFLOW_PROFILE, but that env var was already used by the agent for\ngovernance enforcement (platform/agent/profile.go EnvProfile, allowlist\ndev|default|strict|c\n[…]\n592@gmail.com>\n\n* chore: retrigger CI after [skip-runtime-e2e] title update\n\nSigned-off-by: Saurabh Jain <saurabhjain1592@gmail.com>\n\n---------\n\nSigned-off-by: Saurabh Jain <saurabhjain1592@gmail.com>",
          "is_bot": false,
          "headline": "fix(telemetry): drop profile field [skip-runtime-e2e] (#162)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-05-08T18:30:06Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "15a448eb968556562848da5f993460deb7a50d2f",
          "body": "* feat(telemetry): emit v1 schema fields (telemetry_type, profile, deployment_mode)\n\nCloses the #2007 contract (axonflow-enterprise) on top of v8.0. v8.0\nshipped the TelemetryEnabled removal + the stream classifier; this\npatch adds the three remaining v1 schema fields.\n\n- telemetry_type: \"sdk\" (disc\n[…]\n@gmail.com>\n\n* chore: trigger CI re-run after [skip-runtime-e2e] title edit\n\nSigned-off-by: Saurabh Jain <saurabhjain1592@gmail.com>\n\n---------\n\nSigned-off-by: Saurabh Jain <saurabhjain1592@gmail.com>",
          "is_bot": false,
          "headline": "feat(telemetry): emit v1 schema fields [skip-runtime-e2e] (#161)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-05-08T13:38:56Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "43bd88b93263541b5698253681572c277bec707b",
          "body": "* feat!: v8.0 — telemetry simplification + V1.1 features\n\nCombined major: V1.1 platform features ride alongside a telemetry contract\ncleanup that removes silent customer-side suppression paths. Drops one\nconfig knob and one mode-based default, leaving AXONFLOW_TELEMETRY=off\nas the sole opt-out lever\n[…]\nexplain-decision/) are\ncustomer-facing decision-history-audit capabilities.\n\nSigned-off-by: Saurabh Jain <saurabhjain1592@gmail.com>\n\n---------\n\nSigned-off-by: Saurabh Jain <saurabhjain1592@gmail.com>",
          "is_bot": false,
          "headline": "feat!: v8.0 — decision history API + telemetry simplification (#160)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-05-08T10:20:06Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "550b84b8fff718fc251e94a9000fbe33bbf22f4d",
          "body": "5-of-5 SDK γ fanout for axonflow-enterprise#1982. Companion to\nExplainDecision; both implement the ADR-043 decision-record contract.\n\n## Added\n\n- ListDecisions(ctx, opts ListDecisionsOptions) ([]DecisionSummary, error)\n  matching the locked GET /api/v1/decisions wire shape.\n- DecisionSummary — slim \n[…]\n:13:38Z deny  f6029a9b-...  policy=- tool=-\n    2026-05-07T14:13:38Z deny  2575a3fe-...  policy=- tool=-\n\n⛔ Do not merge — V1.1 release window.\n\nSigned-off-by: Saurabh Jain <saurabhjain1592@gmail.com>",
          "is_bot": false,
          "headline": "feat(decisions): add list_decisions client method (#1982) (#159)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-05-07T23:21:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "768fb086c8960e3529ad80509f96dc1a3a8cc327",
          "body": "Closes the example-parity gap: ExplainDecision() shipped in April but\nno runnable example existed. Mirror the Rust SDK pattern (#29 in\naxonflow-sdk-rust) so callers can copy a complete demo without\nreading the SDK source.\n\nThe example accepts AXONFLOW_DECISION_ID from env (typically harvested\nfrom a\n[…]\ny-stack docker-compose can run it without setting\ntwo env vars. The community tenant is the cross-SDK default per the\nHTTP Basic auth contract.\n\nSigned-off-by: Saurabh Jain <saurabhjain1592@gmail.com>",
          "is_bot": false,
          "headline": "docs(examples): add explain-decision example end-to-end (#158)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-05-07T23:21:43Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "bf19aeb77ad5a70c1679e08237ffef7048e3f77f",
          "body": "…r (#157)\n\nThe bare \"Opt out: AXONFLOW_TELEMETRY=off\" line implied this is the\nuniversal privacy lever. It isn't — the flag suppresses the anonymous\nSDK heartbeat, which on self-hosted / in-VPC deployments is genuinely\nthe only data the SDK sends. On Community SaaS the hosted service\nalready receive\n[…]\n TELEMETRY.md / TELEMETRY_CONTRACT.md\n/ ADR-039 / ADR-048 / README, all 4 plugin READMEs + openclaw clawhub/2.3.0\nSKILL.md, all 5 SDK READMEs).\n\nSigned-off-by: Saurabh Jain <saurabhjain1592@gmail.com>",
          "is_bot": false,
          "headline": "docs(telemetry): scope AXONFLOW_TELEMETRY=off to its actual data laye…",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-05-07T12:32:20Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "be35a1b2d9150ec5b7f1b94694b13a40639d0204",
          "body": "…[skip-runtime-e2e] (#156)\n\nThe previous release PR (#155) bumped the Go SDK from v7.0.0 directly\nto v7.7.0 to platform-align with the V1 SaaS Plugin Pro launch. That\nwas incorrect semver — the only substantive change since v7.0.0 is the\nX-Axonflow-Client header injection (one minor feature), so the\n[…]\n only; no behavior change since\nthe header injection runtime contract was already validated when #153\nlanded and re-confirmed when #155 merged.\n\nSigned-off-by: Saurabh Jain <saurabhjain1592@gmail.com>",
          "is_bot": false,
          "headline": "fix(release): correct SDK version to v7.1.0 (was incorrectly v7.7.0) …",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-05-06T11:38:56Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8d17a85812088b15185b854388c2b90247fa5555",
          "body": "…se validation [skip-runtime-e2e] (#155)\n\nCompanion release to platform v7.7.0. The Go SDK now sends\nX-Axonflow-Client: sdk-go/<version> on every governed request, which\nthe agent (v7.7.0+) uses to derive SDK request scope and validate\nagainst any license token's audience claim per the ADR-050 licen\n[…]\nly dropped).\n\n[skip-runtime-e2e] — version + CHANGELOG bump only; the underlying\nheader behavior shipped + was runtime-tested when #153 landed.\n\nSigned-off-by: Saurabh Jain <saurabhjain1592@gmail.com>",
          "is_bot": false,
          "headline": "chore(release): v7.7.0 — X-Axonflow-Client header + scope-aware licen…",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-05-06T11:32:30Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b3cfe3f9b73336e9703aead863e201f4691442b8",
          "body": "…me-e2e] (#154)\n\nMirrors axonflow-claude-plugin#59 / axonflow-cursor-plugin#48 /\naxonflow-codex-plugin#48 / axonflow-openclaw-plugin#101.\n\nLands the mechanical enforcement of CLAUDE.md HARD RULE #0 in\naxonflow-sdk-go:\n\n  - .github/workflows/definition-of-done.yml — required check that\n    fails any \n[…]\nred into a CI runner that brings up a full stack; the\ngate will catch future PRs that change user-facing surface\nwithout updating runtime-e2e/.\n\nSigned-off-by: Saurabh Jain <saurabhjain1592@gmail.com>",
          "is_bot": false,
          "headline": "chore(ci): add definition-of-done gate + runtime-e2e seed [skip-runti…",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-05-05T11:27:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "16b8cd247d582327740e880a5aeb79fac89f9926",
          "body": "…est (#153)\n\nPer ADR-050 §4, every governed client must set\n`X-Axonflow-Client: <client-id>/<version>` on every request to the agent\nso the agent can derive request scope (sdk) and validate it against the\ntoken's aud.scope via HasScope().\n\nExtends userAgentRoundTripper to also stamp X-Axonflow-Clien\n[…]\nvalues when both headers are pre-set, and pins the\n  agent-parseable \"sdk-go/<semver>\" format.\n- Full Go test suite stays green: 3 packages OK.\n\nSigned-off-by: Saurabh Jain <saurabhjain1592@gmail.com>",
          "is_bot": false,
          "headline": "feat(license): inject X-Axonflow-Client header on every governed requ…",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-05-05T01:26:01Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "baa2190fe88f0f1bc80febbc6cfb406969fce236",
          "body": "Same DCO block landing in axonflow-sdk-rust#1, applied uniformly across\nall org repos so the org-wide DCO GitHub App check is documented in\neach repo's CONTRIBUTING.md.\n\nSigned-off-by: Saurabh Jain <saurabhjain1592@gmail.com>",
          "is_bot": false,
          "headline": "docs(contributing): require DCO sign-off on every commit (#152)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-05-03T01:03:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6ea437e06fb07cdf6a77a76c0b20ac42d82a6ba2",
          "body": "…ntry (#150)\n\nThe v7.0.0 CHANGELOG security-highlights line described the GHSA fix\nas exposing 'webhookSigningKey' on 'RegisterRequest'. The actual\nshipped field is named 'secret' on 'WebhookSubscription' (returned\nby createWebhook). The capability ships correctly in v7.0.0 — only\nthe prose in the CHANGELOG was inaccurate.\n\nGHSA reference + scope unchanged. No code or test changes.",
          "is_bot": false,
          "headline": "docs(changelog): correct webhook signing-key field naming in v7.0.0 e…",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-04-30T00:03:05Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3aea0f08b3d1fd66fa2484ba6dc6232fec3d307b",
          "body": "* chore(release)!: cut [Unreleased] → [7.0.0] - 2026-04-29 + /v7 migration\n\nMajor release. Two breaking changes:\n\n1. Module import path bumps from `axonflow-sdk-go/v6` to\n   `axonflow-sdk-go/v7`, required by Go's semantic-import-versioning\n   rule for any module at v2+. Updates all internal imports\n\n[…]\n/latest and /security/advisories surfaces of\nthis repository so the README doesn't need a re-edit on every\nrelease. Same one-paragraph blockquote near the top of the README,\njust with evergreen links.",
          "is_bot": false,
          "headline": "release: v7.0.0 (2026-04-29) (#148)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-04-29T23:11:30Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "dcaab28713804aad8b54a597b177fdca5f053e70",
          "body": "…rkflow (#149)\n\nThe `heartbeat-real-stack.yml` workflow declared no top-level\n`permissions:` block, so by default GitHub Actions granted its\n`GITHUB_TOKEN` write access to most scopes (contents, packages,\nissues, pull-requests, etc.). For a workflow that only checks out\ncode, builds a Go binary, and\n[…]\n are required.\n\nCode-scanning alert:\nhttps://github.com/getaxonflow/axonflow-sdk-go/security/code-scanning\n(rule: actions/missing-workflow-permissions on\n.github/workflows/heartbeat-real-stack.yml:20)",
          "is_bot": false,
          "headline": "fix(security): restrict GITHUB_TOKEN to contents:read on heartbeat wo…",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-04-29T22:27:01Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d28621c8ec27b2236487ba5a90a3014f2fc1ade9",
          "body": "* feat(telemetry): 7-day delivered-heartbeat with stamp-on-success\n\nToday's behavior is \"one ping per NewClient call\" — a long-running\nservice ping once at startup and stays silent until redeploy, while\nshort-lived processes (Lambda cold starts, CLI tools, cron jobs)\nover-count by firing per-process\n[…]\nstdout+stderr on timeout so the cause is visible in CI logs\n  instead of failing silently.\n\n- gofmt: heartbeat.go's struct field comment alignment drifted\n  after the lastCheckedNanos atomic addition.",
          "is_bot": false,
          "headline": "feat(telemetry): 7-day delivered-heartbeat with stamp-on-success (#147)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-04-29T20:39:07Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c4e03510ca5624011457e04bb263fa6507e449b3",
          "body": "* fix(telemetry)!: remove DO_NOT_TRACK opt-out across SDK + tests + CI\n\nDO_NOT_TRACK is no longer honored as an AxonFlow telemetry opt-out\nbecause it is commonly inherited from host tools and developer\nenvironments (CLIs like Codex and Claude Code inject it\nunconditionally), which makes it an unreli\n[…]\neach interceptor test —\n22 leaked pings observed in a single hour during the DNT-removal work.\n\nAdding TestMain that sets AXONFLOW_TELEMETRY=off mirrors the pattern in\nthe root package's main_test.go.",
          "is_bot": false,
          "headline": "fix(telemetry)!: remove DO_NOT_TRACK opt-out (BREAKING) (#146)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-04-29T15:50:32Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ccb2af8204ec76b8937cb196e608eae8214ac4e3",
          "body": "…MAJOR bump (#145)\n\nCleanup pass on the Go SDK [Unreleased] section ahead of release tagging.\n\n- Rename [Unreleased] → [6.0.0] - 2026-04-28. MAJOR bump (the\n  SDKCompatibility breaking type change makes anything below it\n  semver-major). Promoted to a `### BREAKING` section to make the\n  contract ch\n[…]\nath / fictional-hostname entries to\n  one or two sentences each, matching the existing [5.8.0] / [5.7.0]\n  tone.\n- Keep an empty [Unreleased] heading per Keep-a-Changelog convention.\n\nNo code changes.",
          "is_bot": false,
          "headline": "docs(changelog): rename [Unreleased] → [6.0.0] - 2026-04-28; surface …",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-04-28T18:08:56Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f372a5285d933c029839ed88520c08079c21704e",
          "body": "…d demo tokens (#144)\n\nDeep code review (cross-SDK audit prompted by user's \"Python and Go\nweren't in scope\" question) caught several real issues in the Go SDK\nthat the original QF-10 pass missed because Go was tagged\n\"gold-standard, don't touch.\"\n\nWorkflow correctness (.github/workflows/integration\n[…]\nut the fake hostname was getting cargo-culted into other places.\n\nVerified: `go build ./...` clean; `go test ./...` passes (3 packages,\nno failures, ~7s).\n\nCHANGELOG: Fixed entries under [Unreleased].",
          "is_bot": false,
          "headline": "review fixes: integration.yml gates + module-path traps + JWT-rejecte…",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-04-28T17:12:28Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6cab6dc28c3abc7ef3a76c5a569c7f677a7e05b1",
          "body": "…sioned (#143)\n\nCross-SDK audit prompted by review of TS + Java QF-10 work caught the\nsame staging-eu URL drift in Go.\n\nReal bug:\n\n- axonflow.go:705 — Sandbox() hard-coded https://staging-eu.getaxonflow.com,\n  the host that was decommissioned 2026-04-09. Anyone calling\n  axonflow.Sandbox(...) hit a \n[…]\n  localhost:8080 in code samples and env-var instructions.\n\nVerified: `go build ./...` clean; `go test ./...` passes.\n\nCHANGELOG: Fixed entries under [Unreleased] for Sandbox + example +\ndocs changes.",
          "is_bot": false,
          "headline": "fix: Sandbox() and examples target localhost; staging-eu was decommis…",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-04-28T16:54:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "21bf390e499c54f1767160aead0408928db0fa08",
          "body": "…ion, ctx, warning test (#142)\n\nSix review-driven fixes on the just-shipped ListProviders (PR #141):\n\n1. Wire-shape: LLMProvider was silently dropping endpoint, model, region,\n   rate_limit, timeout_seconds, and settings — every provider config the\n   SDK couldn't introspect. Surfaced all six fields\n[…]\n  pins that a cancelled ctx surfaces as an error rather than hanging.\n\n7 new tests in list_providers_review_fixes_test.go; existing test file\nupdated to pass context.Background() to the new signature.",
          "is_bot": false,
          "headline": "fix(client): close review gaps on ListProviders — full shape, paginat…",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-04-28T15:25:54Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "68081df2c50e250ad7a7c630bb140b46d9b16ff2",
          "body": "…p (#141)\n\n* feat(client): add ListProviders() — closes provider-listing parity gap\n\n* style: gofmt",
          "is_bot": false,
          "headline": "feat(client): add ListProviders() — closes provider-listing parity ga…",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-04-28T13:32:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2470d9034c75b7be318d19ebdbf5bb5e12261a7c",
          "body": "…on compat (#140)\n\nThe platform /health endpoint returns sdk_compatibility.min_sdk_version\nand recommended_sdk_version as per-language maps:\n\n  {\"go\": \"5.0.0\", \"java\": \"5.0.0\", \"python\": \"6.0.0\", \"typescript\": \"5.0.0\"}\n\nThe Go SDK declared both as plain strings, so encoding/json silently\nunmarshalle\n[…]\ner dict shape, nil-receiver\nsafety, and the live HealthCheckDetailed integration via httptest.\n\nCaught by Phase 1 quality-freeze sweep alongside the parallel Python\nSDK fix at axonflow-sdk-python#163.",
          "is_bot": false,
          "headline": "fix(types): SDKCompatibility map[string]string for per-language versi…",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-04-28T10:01:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b5838c2a243d591b7dee5f6a421a89c8da6b2bff",
          "body": "…ble (#139)\n\n* docs(readme): add Evidence Export + Policy Simulation rows to Eval table\n\nBrings SDK README Eval Tier table to 7 rows, matching the 4 plugin\nREADMEs and the 'consistent level of detail' standard. Audience-tuned\nrows differ between SDK (Concurrent executions, Pending execution\napproval\n[…]\n Note callout below the existing footnote line that says exactly\nthat. Rows stay (they are real Evaluation-tier upgrade triggers worth\nsurfacing), the framing is now honest about how they're consumed.",
          "is_bot": false,
          "headline": "docs(readme): add Evidence Export + Policy Simulation rows to Eval ta…",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-04-27T09:12:50Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "81692e586cfeb417d74af09eb2ae6c2217d44f4f",
          "body": "…cal videos (#138)\n\nReplaces the single mislabelled \"Architecture Overview (2 min)\"\nvideo block (WwQXHKuZhxc) with a See AxonFlow in Action section\nlinking the three canonical demo videos used across the community\nREADME and docs site:\n\n- Community Quickstart Demo (2.5 min) — BSqU1z0xxCo\n- Runtime Control Demo (3 min) — 6UatGpn7KwE\n- Architecture Deep Dive (12 min) — Q2CZ1qnquhg\n\nBrings SDK README discoverability in line with axonflow/README.md\nand docs.getaxonflow.com/docs/getting-started.",
          "is_bot": false,
          "headline": "docs(readme): replace stale Architecture Overview video with 3 canoni…",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-04-26T20:02:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "53228aa89c06c6c89f17d4e7efa2bae59ba6afcb",
          "body": "…OG (#137)\n\nHygiene sweep — CHANGELOG entries reference public-facing concepts only.\nNo ADR numbers, no axonflow-enterprise issue refs.",
          "is_bot": false,
          "headline": "chore(changelog): strip ADR refs and internal issue refs from CHANGEL…",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-04-25T21:10:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "dd9100727d8d744c23f40433b58b45d4ea004f43",
          "body": "…sponses (v5.8.0) (#136)\n\n* feat(types): Plugin Batch 1 / ADR-043 explainability fields on MCP responses (v5.8.0)\n\nSurfaces fields the AxonFlow agent has emitted since v7.1.0 that\nMCPCheckInputResponse / MCPCheckOutputResponse didn't declare. Pure\nCat B field-additions — all ,omitempty so existing u\n[…]\nise#1716 — not this\nrelease's scope.\n\ngo test ./... clean; validate-version-alignment green.\n\n* chore(wire-shape): bump baseline SHA to v7.4.3 + regen\n\n* ci: retrigger with spec-pin-bump label visible",
          "is_bot": false,
          "headline": "feat(types): Plugin Batch 1 / ADR-043 explainability fields on MCP re…",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-04-25T19:54:35Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9f4d94b8f62621bb88d2cafffa24738403844c34",
          "body": "* chore(release): Go SDK v5.7.0\n\nMinor release. Wire-shape canonicalization sweep — purely additive,\npointer / ,omitempty-tagged so existing user code keeps compiling;\ndeprecated aliases preserved.\n\nBumps:\n- version.go Version: 5.6.1 -> 5.7.0\n- CHANGELOG [Unreleased] -> [5.7.0] - 2026-04-25\n\nWire-sh\n[…]\nicyInfo entry auto-resolves.\nNet 33 -> 32.\n\nCoordinated v6 alignment release: ships same day as TypeScript v6.0.0,\nJava v6.0.0, Python v6.7.0.\n\n* ci: retrigger wire-shape gate with spec-pin-bump label",
          "is_bot": false,
          "headline": "release: Go SDK v5.7.0 (#135)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-04-25T14:31:19Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "0463673f905dae557539850babf7127216d6f4d8",
          "body": null,
          "is_bot": false,
          "headline": "docs(contrib): add baseline burndown policy (#134)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-04-25T12:31:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c1bd9bc70740a83f67ef408412b97f8671eeddd3",
          "body": "…VERABLE) (#133)\n\n* feat(types): wire-shape alignment sweep (Cat B + RENAME_SAFE + UNRECOVERABLE)\n\nAudit-driven cleanup against the wire-shape contract gate. Mirrors\nthe equivalent sweep on the TS SDK (axonflow-sdk-typescript#185).\nAll changes are additive (new fields are `,omitempty`-tagged or\npoin\n[…]\n axonflow-enterprise#1708 — AISystemRegistry.materiality_classification\n- axonflow-enterprise#1709 — DynamicPolicyInfo schema wrong shape\n\nTests + vet clean.\n\n* chore: gofmt -s policies.go after sweep",
          "is_bot": false,
          "headline": "feat(types): wire-shape alignment sweep (Cat B + RENAME_SAFE + UNRECO…",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-04-25T12:04:29Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6fa595bbe627544515625ce526ba8f6636348682",
          "body": "Under 'set -euo pipefail', the LATEST_VERSION extraction aborted\nthe whole script before reaching the friendly '-z' error check\nwhen CHANGELOG has no released section. The grep's non-zero exit\nfailed the command substitution, which set -e treated as a\nscript-wide abort.\n\nWrapped the grep in { ... || true; } so the -z branch fires with\nthe intended error message. Same fix applied to Python (#153) and\nTypeScript (#182) scripts.",
          "is_bot": false,
          "headline": "fix(script): handle grep-no-match without silently aborting (#132)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-04-24T23:06:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "58e5ab4f5d5db679ef69c8b99adffa6e05b9064c",
          "body": "Release-prep for Go SDK v5.6.1. Renames the CHANGELOG [Unreleased]\nsection to [5.6.1] - 2026-04-25 and bumps version.go::Version to\n5.6.1 in the same commit so the new validate-version-alignment CI\ngate stays green across the transition.\n\nWhat ships in v5.6.1 (user-facing, in release order):\n- READM\n[…]\ne same Unreleased window are internal tooling and don't\nappear in the user-facing section per our no-internal-entries\npolicy; they're mentioned in Notes only for the observable go.mod\ntest-dep change.",
          "is_bot": false,
          "headline": "chore(release): promote [Unreleased] to [5.6.1] + bump version.go (#131)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-04-24T22:17:11Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b68563cfb51d9f532f54aacd032000d59c1feaf0",
          "body": "* ci: add wire-shape contract CI (QF-11, Go arm)\n\nPorts the Python SDK's QF-15 wire-shape contract CI pattern to the\nGo SDK. Catches camelCase / snake_case drift and missing-field drift\nbetween the authoritative OpenAPI specs and the SDK's exported\nstructs — the same class of wire bug that slipped p\n[…]\nrified:\n- baseline state (version.go 5.6.0 == CHANGELOG [5.6.0]) → PASS\n- drift injected (version.go 5.6.1, CHANGELOG [5.6.0]) → FAIL with\n  clear remediation pointer\n- revert to baseline → PASS again",
          "is_bot": false,
          "headline": "ci: add wire-shape contract CI (QF-11, Go arm) (#130)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-04-24T22:13:48Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4ad290a4af2ca6e1bb53aa04f8095ea6425dd9ba",
          "body": "…#129)\n\n* docs(readme): make /v5 module path explicit to stop pkg.go.dev trap (#1695)\n\nCloses getaxonflow/axonflow-enterprise#1695\n\nRoot cause: Go's semantic import versioning requires the /v5 suffix for\nv2+ releases. `go get github.com/getaxonflow/axonflow-sdk-go@latest`\nresolves to v1.17.0 (a 2026\n[…]\nate command.\n\nAlso tightened the top-banner wording: 'missing three major versions of\nfunctionality' → 'four major release lines behind current'. v1 → v2 → v3\n→ v4 → v5 is four major bumps, not three.",
          "is_bot": false,
          "headline": "docs(readme): make /v5 module path explicit to stop pkg.go.dev trap (…",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-04-24T13:21:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8fa1365937502041f782c1159c7d7bb25b0ad243",
          "body": "… ping (#128)\n\n* fix(telemetry): synchronous send so short-lived processes deliver the ping (#1693)\n\nRoot cause: NewClient spawned sendTelemetryPing as a goroutine. When the\nmain() function returned before the goroutine's HTTP POST to checkpoint\ncompleted — in CLI binaries, serverless handlers, quic\n[…]\ndetectPlatformVersion is unexported so the context-parameter change is\nan internal-only API shift. Full test suite green.\n\n* docs(changelog): trim telemetry entries per feedback — visible but not loud",
          "is_bot": false,
          "headline": "fix(telemetry): synchronous send so short-lived processes deliver the…",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-04-24T12:48:29Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "35f1b83baa0b9ce045a0bfece2a06e1a3c92f67b",
          "body": "* feat: rich ApproveStepResponse / RejectStepResponse for v7.4.0 (#1677)\n\nExtend both response types to carry the same shape as the step-gate\nresponse: Decision resolves to \"allow\" / \"block\", RetryContext mirrors\nthe gate response retry state, ApprovedBy / ApprovedAt / RejectedBy /\nRejectedAt carry \n[…]\nentity too. Tests updated; Go SDK full\nsuite green.\n\nThis is a signature change — callers must now pass a comment/reason.\nFor the typed overloads, use the ApproveStepRequest/RejectStepRequest\nstructs.",
          "is_bot": false,
          "headline": "feat: rich ApproveStep / RejectStep response types (v5.6.0) (#126)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-04-22T12:12:26Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2e89168f0c5846487e92744a2b9fa96911b779d7",
          "body": "DO_NOT_TRACK=1 is commonly set broadly across CI / corporate environments as\na generic privacy convention. The signal is real, but when it's the only\nopt-out many users disable AxonFlow telemetry accidentally as a side-effect of\na generic policy — not as an intentional AxonFlow-specific choice. That\n[…]\nted section.\n\nNo test changes — the deprecation is log-only; the underlying telemetry\ndecision logic is unchanged and the existing TestIsTelemetryEnabled suite\nstill covers the opt-out priority order.",
          "is_bot": false,
          "headline": "chore(telemetry): deprecate DO_NOT_TRACK env var (warn on use) (#127)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-04-22T08:26:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "0fe8bb141cc17f27320203e8ee584d280246573b",
          "body": "Closes #1673 Phase 1+2 for Go SDK.",
          "is_bot": false,
          "headline": "feat(wcp): retry_context + idempotency_key (#1673 P1+P2)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-04-21T21:44:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "797daf7af7d0a676047f7cd9c0f095eb161ef46e",
          "body": "…ht validation (#124)\n\nThe previous release workflow published a generic \"install + see CHANGELOG\"\nbody for every tagged release. Anyone landing on the release page (from\nREADME links, registry listings that pull GitHub release descriptions, or\nblog posts citing the tag) had to click through to see \n[…]\nct.\n\n- Pinned actions/upload-artifact and actions/download-artifact to SHAs\n  matching the repo's SHA-pinning convention where present.\n\nMatches the pattern established in axonflow-openclaw-plugin#47.",
          "is_bot": false,
          "headline": "fix(release): emit CHANGELOG section as GitHub release body + preflig…",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-04-19T12:11:54Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e61414fc33922f5bcd4d7e6f5ddbb6654dca01db",
          "body": "* feat: decisions.Explain + audit search filter parity (Plugin Batch 1)\n\nAdds Go SDK half of ADR-043 (Explainability Data Contract) + ADR-042\n(audit search filters for override lifecycle reconstruction).\n\nNew:\n- ExplainDecision(ctx, decisionID) — calls GET /api/v1/decisions/:id/explain\n  and returns\n[…]\ne changes belong in the same\nv5.4.0 release as the execution-boundary / checkpoint features from the\nother session. Merged them into the single v5.4.0 changelog entry and\nreverted version.go to 5.4.0.",
          "is_bot": false,
          "headline": "feat: decisions.Explain + audit search filter parity (#122)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-04-18T11:07:40Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "711ba43f1aa03585f13513e35591ddbf2f49170e",
          "body": "* feat(wcp): add RetryPolicy to StepGateRequest + cached/decision_source to StepGateResponse\n\nSupport execution boundary semantics (#1414): callers can now specify\nretry_policy (\"idempotent\" or \"reevaluate\") on step gate requests.\nResponses include cached (bool) and decision_source (\"fresh\"/\"cached\"\n[…]\nerprise).\n\n* chore: bump version to 5.4.0, add changelog for workflow state management\n\n* feat(wcp): add ResumeFromLastCheckpoint for Evaluation+ tier\n\n* chore: ignore worktrees and coverage artifacts",
          "is_bot": false,
          "headline": "feat(wcp): execution boundary semantics + checkpoint methods (v5.4.0)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-04-18T09:26:56Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "54b2bb03db028aee356c0c9c2afd358ff56c0886",
          "body": "* fix: send Basic auth on all authenticated endpoints\n\nListConnectors, GetConnector, GetConnectorHealth, GetPlanStatus, and\nall execution replay methods were using httpClient.Get() directly,\nbypassing addAuthHeaders(). This caused 401 errors on servers that\nrequire authentication (enterprise, evalua\n[…]\n CHANGELOG: fix date to 2026-04-11, correct method names\n  (GetExecutionAudit/ReplayExecution don't exist; added\n  GetExecutionSteps, ExportExecution, DeleteExecution)\n- version.go: bump 5.3.0 → 5.3.1",
          "is_bot": false,
          "headline": "fix: send Basic auth on all authenticated endpoints (#121)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-04-11T00:24:44Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ad417788a8ed5c0f0779e8e9f318125a3ee3cdbb",
          "body": null,
          "is_bot": false,
          "headline": "docs: add try.getaxonflow.com trial callout to README (#120)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-04-10T00:55:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a8ed5690d3b5f565cb28fa571b36e4d5d63a8a13",
          "body": "* feat(client): add AXONFLOW_DEMO env var for demo mode\n\n* feat(client): append random suffix to ClientID in demo mode\n\n* feat(community-saas): try.getaxonflow.com integration\n\n- Remove random suffix on ClientID (server generates UUID tenant_id)\n- Add RegisterTry() and RegisterTryWithEndpoint() help\n[…]\nready set in rebase conflict resolution\n\n* chore: set release date 2026-04-09\n\n* fix(changelog): remove entries not in this release\n\n---------\n\nCo-authored-by: Saurabh Jain <saurabhjain1592@gmail.com>",
          "is_bot": false,
          "headline": "feat(client): add demo mode via AXONFLOW_DEMO env var (#112)",
          "author_name": "Greg",
          "author_login": "gzak",
          "committed_at": "2026-04-09T23:41:43Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7b50e972d6f2280baeaf67ace3fc7c4fe170aa73",
          "body": "… (2026-04-09) (#119)\n\n* prep(v5.3.0): fix Version constant miss from v5.2.0\n\nv5.3.0 prep for the planned 2026-04-09 release. Not cut here.\n\nv5.2.0 shipping bug fix:\n- version.go was never bumped in the v5.2.0 PR — the constant still\n  declared 5.1.0 when v5.2.0 shipped. Any caller of axonflow.Versi\n[…]\nrected 2026-04-09 → 2026-04-08\n- v5.2.0 section gains a \"Known issue\" subsection documenting the\n  Version constant miss\n\n* fix(version): bump Version constant to 5.3.0 (was missed in previous commit)",
          "is_bot": false,
          "headline": "prep(v5.3.0): fix Version constant miss from v5.2.0 — Release Pending…",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-04-08T23:12:12Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "012fb2760e06471bafbdb3d5c47c6c245d7c405d",
          "body": "* release(v5.2.0): telemetry endpoint_type + v5.2.0 version bump\n\n#1525 — Add endpoint_type field to checkpoint telemetry\n\n- New ClassifyEndpoint() and EndpointType* constants exported from\n  telemetry.go. Classifies configured URL into localhost |\n  private_network | remote | unknown. The raw URL i\n[…]\nion bump:\n- version.go: Version = \"5.2.0\"\n- Module path stays github.com/getaxonflow/axonflow-sdk-go/v5 (major\n  version unchanged)\n\n* fix(format): gofmt telemetry.go + telemetry_endpoint_type_test.go",
          "is_bot": false,
          "headline": "release(v5.2.0): telemetry endpoint_type field (#118)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-04-08T21:06:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "30c56d40cdd0053600ef9e908057e6b241fb371e",
          "body": null,
          "is_bot": false,
          "headline": "chore: use hello@getaxonflow.com as canonical contact email (#117)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-04-08T19:21:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4b26f9e4df477cbf63aed6fa8666aee3603a063a",
          "body": "…116)\n\n* feat: GovernedTool adapter, check_tool aliases, enable localhost telemetry\n\n- Add GovernedTool framework-agnostic tool governance wrapper with Tool\n  interface, GovernTool()/GovernTools() constructors, PolicyViolationError\n  in main package with IsPolicyViolationError() helper (16 tests)\n- \n[…]\nymous telemetry now enabled\n  by default for all endpoints including localhost/self-hosted evaluation\n- Bump version to 5.1.0\n\n* style: gofmt governed_tool_test.go\n\n* fix: changelog date to 2026-04-06",
          "is_bot": false,
          "headline": "feat: SDK v5.1.0 — GovernedTool, tool aliases, localhost telemetry (#…",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-04-06T17:54:56Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f6d0ec0f41c0db5f9c9fecc64d2b28bc570b1515",
          "body": "Go modules require the major version suffix in the module path to\nmatch the tag. Updated from github.com/getaxonflow/axonflow-sdk-go/v4\nto /v5 for the v5.0.0 release.",
          "is_bot": false,
          "headline": "feat: bump module path from v4 to v5 for major version release (#115)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-04-05T13:24:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "fb920bc778f87ce8581c79aa176483767edd5de3",
          "body": "…a (#114)\n\n* fix: reject client_secret without client_id to prevent wrong-tenant data\n\nIf client_secret (license key) is set without client_id, the SDK\nwould silently use 'community' as the tenant identity. All data\nwould be stored under the wrong tenant, causing data loss on\nupgrade when client_id is eventually set correctly.\n\n* fix: replace panic with log.Println for config validation in NewClient",
          "is_bot": false,
          "headline": "fix: reject ClientSecret without ClientID to prevent wrong-tenant dat…",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-04-05T00:00:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "683d5acbc54950994b256f4d25cca433f967b1fd",
          "body": null,
          "is_bot": false,
          "headline": "docs: update v6.0.0 release date to April 5, 2026 (#113)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-04-04T23:39:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6f7c2febc25e7757da2807935751cb5f582b4b9f",
          "body": "…terialityClassification (#111)\n\n* fix: add Status field to PlanResponse struct\n\nThe server returns a status field (pending, executing, completed, failed,\ncancelled) on plan responses but the SDK struct was missing it, causing\ncompilation errors in examples that reference plan.Status.\n\n* fix: resolv\n[…]\nr of Python, TS,\nand Java SDKs for consistent auth across all clients.\n\nUpdated tests to verify new auth behavior.\n\n* fix: go fmt formatting\n\n* chore: bump version to 5.0.0, set changelog release date",
          "is_bot": false,
          "headline": "feat: v5.0.0 — remove X-Tenant-ID, add PlanResponse.Status, rename Ma…",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-04-04T16:00:07Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a70f001570196748fa388b5057633fb6786f22f1",
          "body": null,
          "is_bot": false,
          "headline": "fix: correct v4.3.0 changelog date from 2026-03-24 to 2026-03-25 (#110)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-03-31T20:04:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "991b2342ad29f1af0c289a51eecbf87160f1b502",
          "body": null,
          "is_bot": false,
          "headline": "chore: bump version to 4.3.0 (#109)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-03-25T10:48:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9d250fd3d44d27ea4227635c3eafe1d76ddc3944",
          "body": "* feat: add policy simulation SDK methods (#1062)\n\nNew methods: SimulatePolicies(), GetPolicyImpactReport(),\nDetectPolicyConflicts() for policy dry-run and conflict detection.\nRequires Evaluation tier or above.\n\n* fix: format policy_simulation_test.go with gofmt",
          "is_bot": false,
          "headline": "feat: add policy simulation SDK methods (#1062) (#107)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-03-25T09:41:25Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4b5a88eac87036f4aa9c3200274804f4e296b71c",
          "body": "* fix(security): suppress CodeQL disabled-certificate-check alert\n\nTLS certificate verification skip is already gated behind InsecureSkipVerify\nconfig flag (opt-in only). Added nosec comment and warning log when enabled.\n\nResolves: CodeQL alert #10 (go/disabled-certificate-check)\n\n* fix: changelog date, struct field alignment\n\n* fix: gofmt axonflow.go",
          "is_bot": false,
          "headline": "fix(security): suppress CodeQL TLS certificate check alert (#108)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-03-25T09:36:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e7537e5f8d9d0ff0678a85014e89b3af786b21cc",
          "body": "* feat: add circuit breaker observability methods (#1176)\n\nNew SDK methods: GetCircuitBreakerStatus, GetCircuitBreakerHistory,\nGetCircuitBreakerConfig, UpdateCircuitBreakerConfig.\n\n* chore: add v4.2.0 changelog entry\n\n* fix: UpdateCircuitBreakerConfig returns correct response type\n\nBackend returns {tenant_id, message}, not a full CircuitBreakerConfig.\nAdded CircuitBreakerConfigUpdateResponse type. Updated tests to match\nactual API response shape.\n\n* style: apply gofmt formatting",
          "is_bot": false,
          "headline": "feat: add circuit breaker observability methods (#1176) (#106)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-03-16T18:46:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5aca656c2a0aed0febe7765ab0df449588d6e98c",
          "body": "* feat: add LangGraph adapter with per-tool governance (#1243)\n\nAdd LangGraphAdapter struct for wrapping LangGraph workflows with\nAxonFlow governance gates. Provides per-tool governance via\nCheckToolGate()/ToolCompleted() and MCP policy enforcement via\nNewMCPToolInterceptor(). All methods accept con\n[…]\n\n- Replace time.After with time.NewTimer + defer Stop() in WaitForApproval\n- Remove dead stepID variable in ToolCompleted\n\n* chore: set release date v4.2.0 — 2026-03-17\n\n* chore: bump version to 4.2.0",
          "is_bot": false,
          "headline": "feat: LangGraph adapter with per-tool governance (#105)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-03-16T18:25:59Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1a92cb7fff9ba529502186825f5f94e95d4aa229",
          "body": "* fix: correct documentation URLs with missing /docs/ prefix\n\n* fix: correct documentation URLs",
          "is_bot": false,
          "headline": "fix: correct documentation URLs (#104)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-03-15T17:44:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d93c952e3ebe8b86ec3ee2d6ac09313e8c6bc7b4",
          "body": "* fix: detect platform version in telemetry ping\n\n- Call /health endpoint to detect platform version before sending\n  telemetry ping (2s timeout, silent failure on any error)\n- Platform version is included in the checkpoint payload when available\n\n* fix: serialize platform_version as null instead of\n[…]\nset\nto true. Prevents telemetry leaks during local development.\n\n* chore: bump version to 4.1.0\n\n* docs: add v4.1.0 changelog entry\n\n* docs: add v4.1.0 changelog entry\n\n* docs: set v4.1.0 release date",
          "is_bot": false,
          "headline": "fix: telemetry fixes, AuditToolCall method (#103)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-03-14T18:17:48Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "eae737aa8be9b7ba19af98e5e7326a4a599827fc",
          "body": "Add TestMain that sets DO_NOT_TRACK=1 before all tests run,\npreventing telemetry pings to the checkpoint endpoint during\nlocal development and CI. Individual telemetry tests override\nthis via t.Setenv() when testing enabled behavior.",
          "is_bot": false,
          "headline": "chore: set DO_NOT_TRACK=1 globally in test suite (#102)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-03-10T19:07:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "39ec783d5c7d54ca402a1ddbd1a7e97d30193f16",
          "body": "… (#101)",
          "is_bot": false,
          "headline": "fix: clean up v4.0.0 changelog — remove internal housekeeping entries…",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-03-09T04:59:36Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d2318be4e17cc51a22af28229f6eb12c8256fadf",
          "body": "* feat!: bump to v4.0.0 — module path v3→v4, remove TotalSteps from CreateWorkflowRequest\n\n* docs: add v3 to v4 migration guide in README\n\n* chore: complete v4.0.0 changelog with all changes since v3.8.0\n\nAdd MCP operation default as a proper breaking change, include\nmigration guide, CI changes, and telemetry fixes. Set release\ndate to 2026-03-09.",
          "is_bot": false,
          "headline": "feat!: bump to v4.0.0 (#100)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-03-09T04:45:47Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "100e70f91d6f5b12d82544df5205b473482b886b",
          "body": "Aligns Go SDK with Python/Java behavior: when Operation is not specified,\nit now defaults to \"execute\" rather than being omitted from the request.\nThis ensures consistent policy evaluation across all SDKs.",
          "is_bot": false,
          "headline": "fix(mcp): default MCPCheckInput operation to \"execute\" (#99)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-03-07T19:21:03Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d826d4513e639fee1556fe74eba67b68c91e956a",
          "body": "GitHub's camo proxy strips viewer identity, making >50% of pixel\nviews unattributable. The pixel on GitHub README provides minimal\nactionable data.",
          "is_bot": false,
          "headline": "chore: remove Scarf tracking pixel from README (#98)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-03-06T17:08:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "81d419e54dcd84a06501b14a11c53bce63a49c67",
          "body": "* Disable SDK telemetry in CI workflows\n\nSet DO_NOT_TRACK=1 to prevent tests from firing\ntelemetry pings to the checkpoint endpoint during CI runs.\n\n* Clear DO_NOT_TRACK in telemetry tests that verify enabled behavior\n\nTests that assert telemetry is enabled by default now explicitly\nclear DO_NOT_TRA\n[…]\nlure,\ninvalid URL, and connection refused behavior. Without clearing,\nthese tests returned early and never exercised their intended\ncode paths.\n\nAlso add DO_NOT_TRACK=1 to release.yml for consistency.",
          "is_bot": false,
          "headline": "Disable SDK telemetry in CI workflows (#97)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-03-05T02:54:36Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6810031b376b6938cb5600cbfff6fc8ac7bdd1be",
          "body": "… (#95)\n\n* feat: version discovery, User-Agent header, HealthCheckDetailed\n\n- Add Version constant (3.8.0) in version.go\n- Add userAgentRoundTripper to send User-Agent on all requests\n- Add HealthCheckDetailed() returning HealthResponse with capabilities\n- Add HasCapability() for runtime feature det\n[…]\nSDK contract: trim DO_NOT_TRACK and AXONFLOW_TELEMETRY\nbefore comparison so \"1 \" and \" off\" are handled correctly.\n\n* fix: set v3.8.0 release date, add telemetry first-run notice, fix test log restore",
          "is_bot": false,
          "headline": "feat: version discovery, User-Agent, trace_id, ToolContext, telemetry…",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-03-03T10:55:48Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "fe8d6894b858d5f71f85ef92598bf7df71a46151",
          "body": "* feat: add MCPCheckInput and MCPCheckOutput methods\n\nAdd standalone policy-check methods for external orchestrators (LangGraph,\nCrewAI) to use AxonFlow as a policy gate without routing MCP execution\nthrough AxonFlow. MCPCheckInput validates input against policies pre-execution,\nMCPCheckOutput valid\n[…]\nhelper that passes 403 responses through for\ntyped deserialization, consistent with the other SDK implementations.\n\n* docs: set v3.7.0 release date in changelog\n\n* docs: improve v3.7.0 changelog entry",
          "is_bot": false,
          "headline": "feat: add MCPCheckInput and MCPCheckOutput methods (#94)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-02-28T08:38:55Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2bb82624d75648976511fdcaf4c4d539e12ca589",
          "body": "* feat: add media governance config methods and category constants\n\n- GetMediaGovernanceConfig() — retrieve tenant's media governance config\n- UpdateMediaGovernanceConfig() — update config (Enterprise: full, Community/Eval: toggle)\n- GetMediaGovernanceStatus() — check feature availability per tier\n-\n[…]\nMarkStepCompletedRequest\n\ntokens_in, tokens_out, cost_usd fields on MarkStepCompletedRequest\nallow reporting actual LLM usage at step completion time.\n\n* fix: use actual symbol name in CHANGELOG entry",
          "is_bot": false,
          "headline": "feat: add media governance config methods and category constants (#92)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-02-22T10:02:40Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3bbdfc61b336985c57e8dd0d60396553b115ebc0",
          "body": "* feat: add media governance types and ProxyLLMCallWithMedia\n\nAdd MediaContent, MediaAnalysisResult, MediaAnalysisResponse types\nand ProxyLLMCallWithMedia convenience method for multimodal image\ngovernance requests.\n\n* fix: add extracted_text to MediaAnalysisResult\n\nPlatform returns extracted_text f\n[…]\nons in changelog\n\n* docs: add v3.5.0 changelog entry for media governance (2026-02-19)\n\n* style: fix gofmt alignment in media content test struct literal\n\n* docs: set v3.5.0 release date to 2026-02-18",
          "is_bot": false,
          "headline": "feat: add media governance types and ProxyLLMCallWithMedia (#91)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-02-18T02:14:10Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "422cbf078abcdbd784888b05f59bf6e708927e6f",
          "body": null,
          "is_bot": false,
          "headline": "docs: replace Feedback Week banner with evergreen feedback link (#90)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-02-13T17:19:48Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "68a6039d0fefbc8574145d5cb29e8769581a0d2e",
          "body": "* chore: add tier table clarifiers and evaluation license link\n\n* chore: add utm_source to feature matrix link",
          "is_bot": false,
          "headline": "chore: add tier table clarifiers and evaluation license link (#89)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-02-13T12:38:46Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3002b6e6d793a1356d3519475730b0b2fa5405c3",
          "body": "… (#88)",
          "is_bot": false,
          "headline": "Rename Execution history to Pending execution approvals in tier table…",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-02-13T11:50:48Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "bbf7200cb185160d9adfb2e6c812a0d60fbc4e39",
          "body": "New methods:\n- FailWorkflow(workflowID, reason): fail a workflow with an optional reason,\n  distinct from AbortWorkflow (error condition vs manual cancellation)\n- ListHITLQueue(opts): list pending HITL approval requests (enterprise)\n- GetHITLRequest(id): get approval request details (enterprise)\n- A\n[…]\n HITLApprovalRequest, HITLQueueListOptions, HITLQueueListResponse,\nHITLReviewInput, and HITLStats types. Community mode returns 403/404 for\nHITL endpoints. Full unit test coverage for all new methods.",
          "is_bot": false,
          "headline": "feat: add FailWorkflow and HITL Queue API methods (#87)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-02-13T10:46:42Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f0e15df42c52c9ed323d3984b6e464f3107e59dc",
          "body": null,
          "is_bot": false,
          "headline": "chore: fix changelog date to 2026-02-12 (#86)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-02-12T10:13:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "59b76f807114fb14d00a1e2e460cecaf9d8dd858",
          "body": "StreamExecutionStatus used /api/v1/executions/{id}/stream instead of\n/api/v1/unified/executions/{id}/stream, causing 404 when the server\nonly registers the unified endpoint.",
          "is_bot": false,
          "headline": "fix: correct SSE stream endpoint path to unified API (#85)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-02-11T22:08:47Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "908df702c0e9992b399c48b9c6b5a924b76df05d",
          "body": "Add warning when TLS certificate verification is disabled via\nNODE_TLS_REJECT_UNAUTHORIZED=0 (previously silent). Add permissions:\ncontents: read to integration.yml and test.yml workflows.\n\nResolves 1 HIGH (disabled-certificate-check) and 4 MEDIUM\n(missing-workflow-permissions) CodeQL alerts.",
          "is_bot": false,
          "headline": "fix: add TLS warning log and workflow permissions (#84)",
          "author_name": "Saurabh Jain",
          "author_login": "saurabhjain1592",
          "committed_at": "2026-02-11T13:02:32Z",
          "body_truncated": false,
          "is_coding_agent": false
        }
      ],
      "releases_count": 65,
      "commits_last_year": 197,
      "latest_release_at": "2026-07-18T00:10:10Z",
      "latest_release_tag": "v9.0.0",
      "releases_from_tags": false,
      "days_since_last_push": 2,
      "active_weeks_last_year": 34,
      "days_since_latest_release": 4,
      "mean_days_between_releases": 8.8
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": true,
      "health_percentage": 100,
      "has_issue_template": false,
      "has_code_of_conduct": true,
      "has_pull_request_template": true
    },
    "ecosystem": {
      "packages": [
        {
          "name": "github.com/getaxonflow/axonflow-sdk-go/v9",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": true,
          "registry_url": "https://pkg.go.dev/github.com/getaxonflow/axonflow-sdk-go/v9",
          "is_deprecated": false,
          "latest_version": "v9.0.0",
          "repository_url": "https://github.com/getaxonflow/axonflow-sdk-go",
          "versions_count": 1,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-17T23:19:44Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 5
        }
      ]
    },
    "popularity": {
      "forks": 0,
      "stars": 1,
      "watchers": 1,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 0
      },
      "star_history": null,
      "open_issues_and_prs": 5
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [
        "examples"
      ],
      "has_llms_txt": false,
      "has_dockerfile": false,
      "has_mcp_signal": false,
      "bootstrap_files": [],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [
        "examples/explain-decision/go.mod",
        "examples/wcp-retry-idempotency/go.mod",
        "go.mod",
        "tests/heartbeat-real-stack/go.mod"
      ],
      "largest_source_bytes": 106737,
      "source_files_sampled": 93,
      "oversized_source_files": 2,
      "agent_instruction_files": [],
      "agent_instruction_max_bytes": null
    },
    "dependencies": {
      "manifests": [
        "go.mod"
      ],
      "advisories": {
        "error": null,
        "scope": "repository_graph",
        "source": "osv",
        "findings": [],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {},
        "advisory_count": 0,
        "affected_count": 0,
        "assessed_count": 2,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "go"
      ],
      "dependencies": [
        {
          "name": "gopkg.in/yaml.v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.0.1"
        }
      ],
      "all_dependencies": {
        "error": null,
        "source": "github-sbom",
        "packages": [
          {
            "name": "gopkg.in/yaml.v3",
            "direct": true,
            "version": "v3.0.1",
            "ecosystem": "go"
          },
          {
            "name": "../..",
            "direct": false,
            "version": "9.0.0",
            "ecosystem": "go"
          }
        ],
        "collected": true,
        "truncated": false,
        "total_count": 2,
        "direct_count": 1,
        "indirect_count": 1
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 4,
        "merged_prs": 175,
        "open_issues": 1,
        "closed_ratio": 0.833,
        "closed_issues": 5,
        "closed_unmerged_prs": 7
      },
      "bus_factor": 1,
      "bot_contributors": 0,
      "top_contributors": [
        {
          "type": "User",
          "login": "saurabhjain1592",
          "commits": 193,
          "avatar_url": "https://avatars.githubusercontent.com/u/8345163?v=4"
        },
        {
          "type": "User",
          "login": "gzak",
          "commits": 4,
          "avatar_url": "https://avatars.githubusercontent.com/u/817765?v=4"
        }
      ],
      "contributors_sampled": 2,
      "top_contributor_share": 0.98
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "definition-of-done.yml",
        "heartbeat-real-stack.yml",
        "integration.yml",
        "release.yml",
        "test.yml",
        "validate-version-alignment.yml"
      ],
      "has_docs_dir": true,
      "linter_configs": [],
      "has_editorconfig": false,
      "has_linter_config": false,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "go.sum"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 3,
            "reason": "branch protection is not maximal on development and all release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 10,
            "reason": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 2/30 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 6,
            "reason": "project has 2 contributing companies or organizations -- score normalized to 6",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 0,
            "reason": "no update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 10,
            "reason": "30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": null,
            "reason": "packaging workflow not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 0,
            "reason": "dependency not pinned by hash detected -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 10,
            "reason": "SAST tool is run on all commits",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 10,
            "reason": "security policy file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": null,
            "reason": "no releases found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 10,
            "reason": "0 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "14c1fe04ad78e28a15bc3f24ab1f3955ac7a1963",
        "ran_at": "2026-07-23T00:07:19Z",
        "aggregate_score": 5.5,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": true,
      "has_dependabot_config": false
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-21T06:56:02Z",
      "oldest_open_prs": [
        {
          "number": 185,
          "created_at": "2026-07-09T23:52:11Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 187,
          "created_at": "2026-07-10T00:18:22Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 188,
          "created_at": "2026-07-10T00:22:54Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 191,
          "created_at": "2026-07-17T20:56:44Z",
          "last_comment_at": null,
          "last_comment_author": null
        }
      ],
      "last_merged_pr_at": "2026-07-20T06:12:26Z",
      "ci_last_conclusion": "FAILURE",
      "oldest_open_issues": [
        {
          "number": 184,
          "created_at": "2026-07-09T23:37:39Z",
          "last_comment_at": null,
          "last_comment_author": null
        }
      ]
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/getaxonflow/axonflow-sdk-go",
    "host": "github.com",
    "name": "axonflow-sdk-go",
    "owner": "getaxonflow"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "moderate",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 66,
      "inputs": {
        "security": 64,
        "vitality": 93,
        "community": 43,
        "governance": 52,
        "engineering": 75
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "excellent",
        "name": "Vitality",
        "value": 93,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "excellent",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 88,
            "inputs": {
              "commits_last_year": 197,
              "human_commit_share": 1,
              "days_since_last_push": 2,
              "active_weeks_last_year": 34
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 2 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 2
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "34/52 weeks with commits",
                "points": 23.5,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 34
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "197 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 197
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "releases_count": 65,
              "latest_release_tag": "v9.0.0",
              "releases_from_tags": false,
              "days_since_latest_release": 4,
              "mean_days_between_releases": 8.8
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "65 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 65
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 4 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 4
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~8.8 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 8.8
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "maintained",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": null,
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": 2,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "last human commit 2 days ago",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_maintained",
                    "params": {
                      "days": 2
                    }
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "at_risk",
        "name": "Community & Adoption",
        "value": 43,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 1,
            "inputs": {
              "forks": 0,
              "stars": 1,
              "watchers": 1,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "1 stars",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "0 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "1 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "excellent",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 92,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": true,
              "has_issue_template": false,
              "has_code_of_conduct": true,
              "has_pull_request_template": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (MIT)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "MIT"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 18,
                "status": "met",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 13.5,
                "status": "met",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 6.3,
                "status": "met",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "moderate",
        "name": "Sustainability & Governance",
        "value": 52,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 18,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 2,
              "top_contributor_share": 0.98
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 98% of commits",
                "points": 0.5,
                "status": "partial",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 98
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "2 contributors",
                "points": 2.7,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 2 contributing companies or organizations -- score normalized to 6",
                "points": 6,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "good",
            "name": "Issue & PR responsiveness",
            "note": null,
            "notes": [],
            "value": 76,
            "inputs": {
              "merged_prs": 175,
              "open_issues": 1,
              "closed_issues": 5,
              "issue_closed_ratio": 0.833,
              "closed_unmerged_prs": 7
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "83% of issues closed",
                "points": 38.9,
                "status": "partial",
                "details": [
                  {
                    "code": "issues_closed_share",
                    "params": {
                      "share": 83
                    }
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "175/182 decided PRs merged",
                "points": 36.8,
                "status": "partial",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 175,
                      "decided": 182
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 2/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "at_risk",
            "name": "Ownership & stewardship",
            "note": null,
            "notes": [],
            "value": 45,
            "inputs": {
              "followers": 4,
              "owner_type": "Organization",
              "is_verified": null,
              "owner_login": "getaxonflow",
              "public_repos": 15,
              "account_age_days": 272
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "organization-owned",
                "points": 30,
                "status": "met",
                "details": [
                  {
                    "code": "owner_organization",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "4 followers of getaxonflow",
                "points": 5,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 4,
                      "login": "getaxonflow"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "15 public repos, account ~0 yr old",
                "points": 10.3,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 15
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 0
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "good",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 84,
            "inputs": {
              "packages": [
                "github.com/getaxonflow/axonflow-sdk-go/v9"
              ],
              "ecosystems": "go",
              "any_deprecated": false,
              "min_days_since_publish": 5
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on go",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "go"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 5 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 5
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "1 published versions",
                "points": 4,
                "status": "partial",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "good",
        "name": "Engineering Quality",
        "value": 75,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "moderate",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 68,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": false,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "6 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 6
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
                "points": 20,
                "status": "met",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "excellent",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "topics": [
                "agent-governance",
                "ai-control-plane",
                "ai-governance",
                "go",
                "llm-sdk",
                "llm-security",
                "mcp",
                "production-ai",
                "responsible-ai",
                "runtime-control",
                "workflow-governance"
              ],
              "has_wiki": true,
              "homepage": null,
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": "11 topics",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "topics_count",
                    "params": {
                      "count": 11
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "moderate",
        "name": "Security",
        "value": 64,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "moderate",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): Packaging, Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "packaging",
                    "signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 55,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 16,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 2,
              "scorecard_aggregate": 5.5
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection is not maximal on development and all release branches",
                "points": 2.2,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 2/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 2 contributing companies or organizations -- score normalized to 6",
                "points": 1.5,
                "status": "partial",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "no update tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow not detected",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool is run on all commits",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "0 existing vulnerabilities detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "excellent",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 2 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "indirect_dependencies_free_of_known_advisories",
                    "no_advisories_left_outstanding"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_repository",
                "params": {
                  "assessed": 2
                }
              },
              {
                "code": "advisories_repo_graph_caveat",
                "params": {}
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "source": "osv",
              "advisories": 0,
              "affected_packages": 0,
              "assessed_packages": 2,
              "unassessed_packages": 0,
              "affected_by_severity": "none",
              "direct_affected_packages": 0
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "no direct dependency carries a known advisory",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "no_direct_advisories",
                    "params": {}
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "transitive set not separable from development and test dependencies in this scope",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_scope_not_separable",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory carries a publication date",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_no_publication_date",
                    "params": {}
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 2,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 2
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "moderate",
        "name": "AI Readiness",
        "value": 55,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "at_risk",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 0.99,
              "agent_instruction_files": [],
              "agent_instruction_max_bytes": null
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "no CLAUDE.md / AGENTS.md / editor rules",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_instructions",
                    "params": {}
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "99 of 100 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 99,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "moderate",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 56,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "go.sum"
              ],
              "has_dockerfile": false,
              "typed_language": true,
              "bootstrap_files": [],
              "has_devcontainer": false,
              "has_linter_config": false,
              "typecheck_configs": [],
              "agent_commit_share": 0,
              "toolchain_manifests": [
                "examples/explain-decision/go.mod",
                "examples/wcp-retry-idempotency/go.mod",
                "go.mod",
                "tests/heartbeat-real-stack/go.mod"
              ],
              "dependency_bot_commit_share": 0
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "examples/explain-decision/go.mod, examples/wcp-retry-idempotency/go.mod, go.mod (toolchain convention, no task runner)",
                "points": 12.6,
                "status": "partial",
                "details": [
                  {
                    "code": "toolchain_convention",
                    "params": {
                      "files": "examples/explain-decision/go.mod, examples/wcp-retry-idempotency/go.mod, go.mod"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "Go (statically typed)",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "no agent-authored commits among the last 100",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_authored_commits",
                    "params": {
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "no automated dependency updates observed",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_dependency_automation",
                    "params": {}
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 99,
            "inputs": {
              "primary_language": "Go",
              "largest_source_bytes": 106737,
              "source_files_sampled": 93,
              "oversized_source_files": 2
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Go (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "2/93 source files over 60KB",
                "points": 53.8,
                "status": "partial",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 93,
                      "oversized": 2
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "at_risk",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "example_dirs": [
                "examples"
              ],
              "has_mcp_signal": false,
              "api_schema_files": []
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": "examples",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "examples"
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-23T00:07:35.559899Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/g/getaxonflow/axonflow-sdk-go.svg",
  "full_name": "getaxonflow/axonflow-sdk-go",
  "license_state": "standard",
  "license_spdx": "MIT"
}
Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.
Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v1.13.0, schema v0.27.0 — full methodology · metrics wiki.
How one result sits in the wider record: aggregate statistics — Go.
Software health index

Score profile

Ownership

Package ecosystems

Metrics by category

Key facts

Data collection warnings

More detail

Related records
