Software health reportschema 0.27.0 · metrics 1.13.0 · 2026-07-29 00:25 UTC

hanzoai / vfs

S3-backed virtual block filesystem with PQ encryption — unlimited write storage for stateful services

GoCustom license★ 0 stars⑂ 0 forkssince May 2026View on GitHub ↗

hanzoai/vfs holds a health index of 34 out of 100, placing it in the At risk band. It scores highest on Vitality (69/100) and lowest on Community & Adoption (21/100). It was last updated today. A single contributor accounts for most of its recent work.

overall / 100

At risk

Software health index

Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At risk ceiling of 49. AI Readiness sits outside the overall score.

Excellent85-100Exemplary; meets essentially all checked criteria

Good70-84Healthy; minor gaps

Moderate50-69Acceptable with notable gaps; review recommended

At risk30-49Significant weaknesses; adoption warrants caution

Critical1-29Severe problems (abandoned, single-maintainer, no hygiene)

Score profile

Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.

High-Risk Jurisdiction Policy applies a 75% multiplier to weighted overall health and gives it an At risk ceiling of 49.

Ownership

Hanzo AIOrganization

37 followers159 public repossince Dec 2015

This repository is backed by an organization — shared, accountable stewardship that can outlive any single maintainer.

Package ecosystems

Registry	Package	Version	Downloads / mo	Versions	Last publish
Go	github.com/hanzoai/vfs	v0.6.6	-	17	8 days ago

Metrics by category

Vitality

Is the project alive — is code being written and are releases shipping?

69Moderate · 22% of overall

Development activity

59Moderate

How it's scored

36/36	Push recency — last push 0 days ago
7.6/36	Commit cadence — 11/52 weeks with commits
15.3/18	Commit volume — 50 commits in the last year
0/10	OpenSSF Scorecard: Maintained — project was created within the last 90 days. Please review its contents carefully

Inputs used

commits_last_year	50
human_commit_share	1
days_since_last_push	0
active_weeks_last_year	11

Release discipline

84Good

How it's scored

27/27	Ships releases — 1 releases published
36/36	Release recency — latest release 70 days ago
12.6/27	Release cadence — cadence unknown (single release)
0/10	OpenSSF Scorecard: Signed-Releases — no data

Inputs used

releases_count	1
latest_release_tag	v0.1.0
releases_from_tags	no
days_since_latest_release	70
mean_days_between_releases	—

Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.

Community & Adoption

Does the project have users, downloads, attention, and a welcoming setup for contributors?

21Critical · 18% of overall

Popularity & adoption

1Critical

How it's scored

0/60	Stars — 0 stars
0/25	Forks — 0 forks
0/15	Watchers — 0 watchers

Inputs used

forks	0
stars	0
watchers	0
growth_state	unverified
growth_factor_pct	100
growth_unverified_reason	no_history

Community health

44At risk

How it's scored

22.5/22.5	README
16.9/22.5	License — license file present, not a recognized license
0/18	CONTRIBUTING guide
0/13.5	Code of conduct
0/7.2	Issue template
0/6.3	PR template

Inputs used

has_readme	yes
has_license	yes
has_contributing	no
has_issue_template	no
has_code_of_conduct	no
has_pull_request_template	no

Sustainability & Governance

Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?

43At risk · 24% of overall

Maintainer resilience (bus factor)

20Critical

How it's scored

9/54	Bus factor — 1 contributor(s) cover half of all commits
0/22.5	Commit distribution — top contributor authored 100% of commits
1.4/13.5	Contributor breadth — 1 contributors
10/10	OpenSSF Scorecard: Contributors — project has 31 contributing companies or organizations

Inputs used

bus_factor	1
contributors_sampled	1
top_contributor_share	1

Issue & PR responsiveness

1Critical

How it's scored

0/46.8	Issue resolution — no issues or no data
0/38.3	PR acceptance — no decided pull requests or no data
0/15	OpenSSF Scorecard: Code-Review — Found 0/30 approved changesets -- score normalized to 0

Inputs used

merged_prs	0
open_issues	0
closed_issues	0
issue_closed_ratio	—
closed_unmerged_prs	0

Excluded from scoring (no data or not applicable): Issue resolution, PR acceptance. Remaining weights renormalized.

Ownership & stewardship

66Moderate

How it's scored

30/30	Ownership backing — organization-owned
0/20	Verified domain
11.4/25	Owner reach — 37 followers of hanzoai
25/25	Track record — 159 public repos, account ~10 yr old

Inputs used

followers	37
owner_type	Organization
is_verified	—
owner_login	hanzoai
public_repos	159
account_age_days	3,882

Package maintenance

100Excellent

How it's scored

25/25	Published & resolvable — 1 package(s) on go
35/35	Publish recency — latest publish 8 days ago
20/20	Version history — 17 published versions
20/20	Not deprecated — active, not deprecated or yanked

Inputs used

packages	github.com/hanzoai/vfs
ecosystems	go
any_deprecated	no
min_days_since_publish	8

Engineering Quality

Are baseline engineering and documentation practices in place?

54Moderate · 20% of overall

Engineering practices

30At risk

How it's scored

0/24	CI workflows
24/24	Tests present
0/16	Linter config
0/9.6	Pre-commit hooks
0/6.4	.editorconfig
0/20	OpenSSF Scorecard: CI-Tests — no data

Inputs used

has_ci	no
has_tests	yes
has_editorconfig	no
has_linter_config	no
has_precommit_config	no

Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.

Documentation

90Excellent

How it's scored

30/30	README
25/25	Documentation directory
15/15	Documentation / homepage site — https://hanzo.ai
10/10	Repository description
0/10	Topics
10/10	Wiki

Inputs used

topics	—
has_wiki	yes
homepage	https://hanzo.ai
has_readme	yes
has_docs_dir	yes
has_description	yes

Security

Are visible security and supply-chain practices strong, without unresolved high-risk jurisdiction exposure?

34At risk · 16% of overall

Security posture

18Critical

Jurisdiction risk alert

High-risk jurisdiction exposure detected

1 contributor organization profilesRussiaSecurity and overall rating: At risk ceiling

Based on self-published public profile locations. This governance signal does not determine nationality, citizenship, intent, sanctions status, or individual trustworthiness.

How jurisdiction exposure is assessed

How it's scored

7.5/7.5	Binary-Artifacts — no binaries found in the repo
0/7.5	Branch-Protection — branch protection not enabled on development/release branches
0/2.5	CI-Tests — no data
0/2.5	CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected
0/7.5	Code-Review — Found 0/30 approved changesets -- score normalized to 0
2.5/2.5	Contributors — project has 31 contributing companies or organizations
0/10	Dangerous-Workflow — no data
0/7.5	Dependency-Update-Tool — no update tool detected
0/5	Fuzzing — project is not fuzzed
2.2/2.5	License — license file detected
0/7.5	Maintained — project was created within the last 90 days. Please review its contents carefully
0/5	Packaging — no data
0/5	Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0
0/5	SAST — no SAST tool detected
5/5	Security-Policy — security policy file detected
0/7.5	Signed-Releases — no data
0/7.5	Token-Permissions — no data
0/7.5	Vulnerabilities — 10 existing vulnerabilities detected

Inputs used

source	openssf_scorecard
checks_evaluated	13
scorecard_version	v5.5.0
checks_inconclusive	5
scorecard_aggregate	2.4
high_risk_jurisdiction_cap	49
high_risk_jurisdiction_multiplier	75
security_posture_after_multiplier	18
security_posture_before_jurisdiction	24

Excluded from scoring (no data or not applicable): ci_tests, dangerous_workflow, packaging, signed_releases, token_permissions. Remaining weights renormalized. High-Risk Jurisdiction Policy applies a 75% multiplier and gives Security posture an At risk ceiling of 49.

Dependency advisories

100Excellent

How it's scored

35/35	Direct dependencies free of known advisories — no direct dependency carries a known advisory
0/25	Indirect dependencies free of known advisories — transitive set not separable from development and test dependencies in this scope
0/40	No advisories left outstanding — no advisory carries a publication date

Inputs used

source	osv
advisories	11
affected_packages	4
assessed_packages	35
unassessed_packages	0
affected_by_severity	moderate 1, unknown 3
direct_affected_packages	0

Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 35 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.

AI Readiness

How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score.

60Moderate · 0% of overall

Agent context & guidance

40At risk

How it's scored

0/45	Agent instructions — no CLAUDE.md / AGENTS.md / editor rules
0/15	Machine-readable docs (llms.txt)
40/40	Legible commit history — 49 of 50 human commits state their intent (structured subject or explanatory body)

Inputs used

has_llms_txt	no
legible_history_share	0.98
agent_instruction_files	—
agent_instruction_max_bytes	—

Verify loop (build / test / typecheck)

61Moderate

How it's scored

18/18	One-command bootstrap — Makefile
22/22	Automated tests
0/11	Lint / format config
11/11	Static type checking — Go (statically typed)
10/10	Reproducible environment — Dockerfile, lockfile
0/10	Demonstrated agent practice — no agent-authored commits among the last 50
0/8	Automated maintenance — no automated dependency updates observed
0/10	OpenSSF Scorecard: Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0

Inputs used

has_nix	no
has_tests	yes
lockfiles	go.sum
has_dockerfile	yes
typed_language	yes
bootstrap_files	Makefile
has_devcontainer	no
has_linter_config	no
typecheck_configs	—
agent_commit_share	0
toolchain_manifests	go.mod
dependency_bot_commit_share	0

Code legibility for models

100Excellent

How it's scored

45/45	Type-checkable code — Go (statically typed)
55/55	Manageable file sizes — 0/34 source files over 60KB

Inputs used

primary_language	Go
largest_source_bytes	19,162
source_files_sampled	34
oversized_source_files	0

Key facts

0GitHub stars

1contributors

50commits, last 12 months

0days since last push

1releases

1bus factor

0open issues

Gopackage ecosystems

More detail

OpenSSF Scorecard 2.4 / 10

2.4aggregate

Independent, tool-agnostic security assessment from the open-source OpenSSF Scorecard. Each check rewards a security practice, not a specific vendor's tool. Checks Scorecard could not determine are marked n/a and excluded from the security score (never counted as zero).Scorecard v5.5.0 · 2026-07-29 00:24 UTC

10	Binary-Artifacts	no binaries found in the repo
0	Branch-Protection	branch protection not enabled on development/release branches
n/a	CI-Tests	no pull request found
0	CII-Best-Practices	no effort to earn an OpenSSF best practices badge detected
0	Code-Review	Found 0/30 approved changesets -- score normalized to 0
10	Contributors	project has 31 contributing companies or organizations
n/a	Dangerous-Workflow	no workflows found
0	Dependency-Update-Tool	no update tool detected
0	Fuzzing	project is not fuzzed
9	License	license file detected
0	Maintained	project was created within the last 90 days. Please review its contents carefully
n/a	Packaging	packaging workflow not detected
0	Pinned-Dependencies	dependency not pinned by hash detected -- score normalized to 0
0	SAST	no SAST tool detected
10	Security-Policy	security policy file detected
n/a	Signed-Releases	no releases found
n/a	Token-Permissions	No tokens found
0	Vulnerabilities	10 existing vulnerabilities detected

Direct dependencies 7

Registry	Package	Version constraint	Manifest
Go	bazil.org/fuse	`v0.0.0-20230120002735-62a210ff1fd5`	go.mod
Go	github.com/hanzoai/sqlite	`v0.3.2`	go.mod
Go	github.com/hanzos3/go	`v1.0.0`	go.mod
Go	github.com/jacobsa/fuse	`v0.0.0-20260302145937-f1ba38d60fdf`	go.mod
Go	github.com/luxfi/age	`v1.6.0`	go.mod
Go	github.com/spf13/cobra	`v1.10.2`	go.mod
Go	github.com/zeebo/blake3	`v0.2.4`	go.mod

All dependencies 35

Full resolved dependency set from the GitHub dependency graph: 7 direct and 28 indirect (transitive) packages. The transitive closure is complete when the repository commits a lockfile.

Registry	Package	Version	Relation
Go	bazil.org/fuse	`v0.0.0-20230120002735-62a210ff1fd5`	direct
Go	github.com/hanzoai/sqlite	`v0.3.2`	direct
Go	github.com/hanzos3/go	`v1.0.0`	direct
Go	github.com/jacobsa/fuse	`v0.0.0-20260302145937-f1ba38d60fdf`	direct
Go	github.com/luxfi/age	`v1.6.0`	direct
Go	github.com/spf13/cobra	`v1.10.2`	direct
Go	github.com/zeebo/blake3	`v0.2.4`	direct
Go	filippo.io/hpke	`v0.4.0`	indirect
Go	github.com/davecgh/go-spew	`v1.1.1`	indirect
Go	github.com/dustin/go-humanize	`v1.0.1`	indirect
Go	github.com/go-ini/ini	`v1.67.0`	indirect
Go	github.com/google/uuid	`v1.6.0`	indirect
Go	github.com/hanzoai/csqlite	`v0.1.0`	indirect
Go	github.com/hanzoai/sqlcipher	`v0.1.0`	indirect
Go	github.com/inconshreveable/mousetrap	`v1.1.0`	indirect
Go	github.com/klauspost/compress	`v1.18.2`	indirect
Go	github.com/klauspost/cpuid/v2	`v2.3.0`	indirect
Go	github.com/klauspost/crc32	`v1.3.0`	indirect
Go	github.com/mattn/go-isatty	`v0.0.21`	indirect
Go	github.com/minio/crc64nvme	`v1.1.1`	indirect
Go	github.com/minio/md5-simd	`v1.1.2`	indirect
Go	github.com/ncruces/go-strftime	`v1.0.0`	indirect
Go	github.com/philhofer/fwd	`v1.2.0`	indirect
Go	github.com/pmezard/go-difflib	`v1.0.0`	indirect
Go	github.com/remyoudompheng/bigfft	`v0.0.0-20230129092748-24d4a6f8daec`	indirect
Go	github.com/rs/xid	`v1.6.0`	indirect
Go	github.com/spf13/pflag	`v1.0.10`	indirect
Go	github.com/tinylib/msgp	`v1.6.1`	indirect
Go	github.com/zeebo/assert	`v1.3.0`	indirect
Go	go.yaml.in/yaml/v3	`v3.0.4`	indirect
Go	golang.org/x/crypto	`v0.52.0`	indirect
Go	golang.org/x/net	`v0.54.0`	indirect
Go	golang.org/x/sys	`v0.46.0`	indirect
Go	golang.org/x/text	`v0.37.0`	indirect
Go	gopkg.in/yaml.v3	`v3.0.1`	indirect

Dependency advisories 4

This repository publishes no package the index resolves, so its own dependency graph was assessed — 35 packages, which also include development and test pins that never ship: 4 carry known advisories, of which 0 are direct.

Package	Version	Relation	Severity	Advisories	Fixed in
golang.org/x/net	`v0.54.0`	indirect	moderate	8	`0.56.0`
github.com/klauspost/compress	`v1.18.2`	indirect	unknown	1	`1.18.7`
golang.org/x/crypto	`v0.52.0`	indirect	unknown	1	—
golang.org/x/text	`v0.37.0`	indirect	unknown	1	`0.39.0`

An advisory means the version recorded in the dependency graph falls inside an advisory’s affected range. Reachability is not analysed, and the graph includes development and test pins — a finding may concern tooling rather than shipped software.

Raw JSON report machine-readable

{
  "data": {
    "repo": {
      "topics": [],
      "is_fork": false,
      "size_kb": 310,
      "has_wiki": true,
      "homepage": "https://hanzo.ai",
      "languages": {
        "Go": 194534,
        "ZAP": 2376,
        "Makefile": 1254,
        "Dockerfile": 680
      },
      "pushed_at": "2026-07-29T00:14:29Z",
      "created_at": "2026-05-08T17:52:45Z",
      "owner_type": "Organization",
      "updated_at": "2026-07-28T04:03:46Z",
      "description": "S3-backed virtual block filesystem with PQ encryption — unlimited write storage for stateful services",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": null,
      "default_branch": "main",
      "license_spdx_raw": "NOASSERTION",
      "primary_language": "Go",
      "significant_languages": [
        "Go"
      ]
    },
    "owner": {
      "blog": "https://hanzo.ai",
      "name": "Hanzo AI",
      "type": "Organization",
      "login": "hanzoai",
      "company": null,
      "location": "United States of America",
      "followers": 37,
      "avatar_url": "https://avatars.githubusercontent.com/u/16248274?v=4",
      "created_at": "2015-12-11T00:38:19Z",
      "is_verified": null,
      "public_repos": 159,
      "account_age_days": 3882
    },
    "license": {
      "state": "custom",
      "spdx_id": null,
      "raw_spdx": "NOASSERTION",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.1.0",
          "kind": "minor",
          "published_at": "2026-05-19T07:20:11Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "acdc44fb76beb25ecb5daeaf03d205a774d097b7",
          "body": "make check runs gofmt -s -w . in place, and the tree was not gofmt-clean, so\nevery invocation left 7 modified files behind and a reader could not tell their\nown edits from the formatter's. Purely mechanical: trailing-comment alignment\nand import ordering, no semantic change (git diff -w reduces this to three\nimport lines that only moved position).\n\nCo-authored-by: Hanzo Dev <dev@hanzo.ai>",
          "is_bot": false,
          "headline": "style: gofmt -s the tree so make check is idempotent",
          "author_name": "hanzo-dev",
          "author_login": null,
          "committed_at": "2026-07-28T04:03:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "936e5e53f95e376ab91bff085a26900486f2128c",
          "body": "…ires\n\ngo.mod declares `go 1.26.5` while the builder pinned golang:1.26.4. The golang\nimages set GOTOOLCHAIN=local, so the base can never fetch a newer toolchain to\nsatisfy the directive and the build dies immediately:\n\n    go: go.mod requires go >= 1.26.5 (running go 1.26.4; GOTOOLCHAIN=local)\n\nA r\n[…]\nine and golang:1.26.5-alpine are\nthe same sha256:0178a641).\n\nPatch bump only, image variant preserved, and the target tag verified to exist\nbefore the change.\n\nCo-authored-by: Hanzo Dev <dev@hanzo.ai>",
          "is_bot": false,
          "headline": "fix(docker): golang 1.26.4 -> 1.26.5, the version go.mod already requ…",
          "author_name": "z",
          "author_login": null,
          "committed_at": "2026-07-28T02:12:44Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4d47db27177cf8c9359021672f1b5a62ed83ece6",
          "body": "Co-authored-by: Hanzo Dev <dev@hanzo.ai>",
          "is_bot": false,
          "headline": "chore(go): bump go directive to 1.26.5",
          "author_name": "hanzo-dev",
          "author_login": null,
          "committed_at": "2026-07-27T23:09:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6c22092c9d78494050e339e99ce12a0dc5ccbfe2",
          "body": "vfs was the last service reaching S3 through github.com/aws/aws-sdk-go-v2 while\nthe rest of the fleet (vm, commerce, licensing, ai) already used the Hanzo\nStorage Go SDK. Both speak S3, so either works against our own storage — but a\nsecond client meant a second credential model, a second retry poli\n[…]\nis lazy, so a missing key surfaces on\nthe first read rather than on the call — backend.ErrNotFound is mapped in both\nplaces so callers still see one sentinel.\n\nCo-authored-by: Hanzo Dev <dev@hanzo.ai>",
          "is_bot": false,
          "headline": "s3: run on Hanzo Storage through hanzos3/go, not the AWS SDK",
          "author_name": "hanzo-dev",
          "author_login": null,
          "committed_at": "2026-07-27T19:20:32Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1d67f85c04a3ad5d5aa32046004ca54cf166ab32",
          "body": "Superseded: the Hanzo GitHub App pushes a webhook, so the forge tracks GitHub\nwithout a per-repo workflow. This file called git.hanzo.ai/api/v1/.../mirror-sync\n— a Gitea API for a system we no longer drive — and would sit inert in every repo.\n\nOne mechanism, in one place, instead of ~350 copies of a cron.",
          "is_bot": false,
          "headline": "ci: drop the Gitea mirror-sync nudge",
          "author_name": "hanzo-dev",
          "author_login": null,
          "committed_at": "2026-07-27T17:46:25Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "bb326b07e6a97ad99c9123feee99b086f5676447",
          "body": "git.hanzo.ai mirrors this repo by PULL on a ~10-minute interval, and arcd runs\nCI/CD there — so every push waited out that interval before anything built.\nThis asks Gitea to pull HEAD immediately.\n\nLatency only: the repo already mirrors via the App webhook, so a missing\nHANZO_GIT_TOKEN or a failed curl is non-fatal and never fails the push.\nIdempotent (mirror-sync just pulls HEAD) and concurrency-coalesced.",
          "is_bot": false,
          "headline": "ci: nudge git.hanzo.ai to pull on push",
          "author_name": "hanzo-dev",
          "author_login": null,
          "committed_at": "2026-07-27T15:47:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "af3fac61a492207d95e7a292b8fec7a3b3e10c7b",
          "body": "This workflow ran on a self-hosted actions-runner-controller pool. ARC is\ndecommissioned: CI executes inside git.hanzo.ai (Gitea Actions, .hanzo/workflows)\nand delivery is cd.hanzo.ai reconciling the reviewed image pin in\nhanzoai/universe. GitHub is a mirror and runs nothing.\n\nRemoved rather than repointed — there is no GitHub-side pool to move to, and\nleaving it would keep ARC load-bearing.",
          "is_bot": false,
          "headline": "ci: remove GitHub CI — native git.hanzo.ai + cd.hanzo.ai only",
          "author_name": "Hanzo Dev",
          "author_login": null,
          "committed_at": "2026-07-27T15:24:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "55c1afff2c46e2d2015fe2b9d0a9c7f3ba770f7d",
          "body": "Panic-driven denial of service in the AWS SDK for Go v2 EventStream decoder:\n\n    aws/protocol/eventstream  v1.7.5  -> v1.7.8   (patched in 1.7.8)\n    service/s3                v1.96.2 -> v1.97.3  (patched in 1.97.3)\n\nThis repo is an S3-backed block filesystem, so the S3 client is on the hot\npath ra\n[…]\nt latest, so the change carries the fix and\nnothing else; go get pulled the usual transitive companions along at\npatch level within v1.x.\n\nVerified: go build ./... exit 0, go test ./... 4 ok / 0 fail.",
          "is_bot": false,
          "headline": "fix(deps): patch the AWS SDK EventStream DoS",
          "author_name": "zeekay",
          "author_login": "zeekay",
          "committed_at": "2026-07-26T10:51:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "97596b837a4954d8632305d8d701ced9d1f357b4",
          "body": "Restore time is dominated by GetBlock (backend.Get -> blake3 verify -> age\ndecrypt -> cache), which zapdb's ChunkReader drives strictly sequentially.\nMeasures that path against a bounded parallel prefetch so the core-scaling\nheadroom is measured rather than assumed.\n\nWarm-up deliberately leaves files in the OS page cache: the cost under test\nis CPU-bound crypto+verify, not disk seek.",
          "is_bot": false,
          "headline": "test(vfs): benchmark the restore inner loop",
          "author_name": "zeekay",
          "author_login": "zeekay",
          "committed_at": "2026-07-26T08:46:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c5754209c584dcb8e13f3ccbbc4031c759464a94",
          "body": null,
          "is_bot": false,
          "headline": "merge(fenced-store): consolidate onto main",
          "author_name": "Hanzo Dev",
          "author_login": null,
          "committed_at": "2026-07-22T00:19:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ae359909c3e4409e26811226f68a2ce465078fea",
          "body": "…ut of the graph\n\nThe v0.3.x internal-engine sqlite drops the modernc.org dependency; with\nv0.6.5's replica routing this leaves zero modernc modules in the graph.\nComments updated to match.",
          "is_bot": false,
          "headline": "build(sqlite): bump hanzoai/sqlite v0.2.4 -> v0.3.2 — modernc fully o…",
          "author_name": "Hanzo AI",
          "author_login": null,
          "committed_at": "2026-07-20T03:21:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "467c279522ba8ba17a1c199b21fea496d67e8c0f",
          "body": "… import (#7)\n\n* fix(sqlite): use hanzoai/sqlite (the one driver), drop direct modernc import\n\n* fix(sqlite): use hanzoai/sqlite (the one driver), drop direct modernc import\n\n---------\n\nCo-authored-by: Hanzo AI <ai@hanzo.ai>",
          "is_bot": false,
          "headline": "fix(sqlite): use hanzoai/sqlite (the one driver), drop direct modernc…",
          "author_name": "Hanzo Dev",
          "author_login": null,
          "committed_at": "2026-07-10T09:22:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "15b713992050a13dd68b85ed209195939d707496",
          "body": "…-write (#6)\n\n* replica: extract single-writer election to hanzoai/ha\n\nElection (Owner/IsOwner/Replicas/Member) was storage-agnostic pure Go with\nzero vfs-internal callers — it lived here only historically. It is now its\nown coordination primitive at github.com/hanzoai/ha so any singleton (cron,\nque\n[…]\nth\nthe S3-client owner. Tests: deposed-fenced, same-round re-ship, handoff\nlock-out, carry-forward-no-loss, and concurrent race proofs (20x race-stable).\n\n---------\n\nCo-authored-by: hanzo <z@hanzo.ai>",
          "is_bot": false,
          "headline": "replica: round-fenced writes (FencedStore) — close split-brain double…",
          "author_name": "Hanzo Dev",
          "author_login": null,
          "committed_at": "2026-07-09T20:07:24Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e43cc3348aad320808398efa1ea1f5ae9a11ee32",
          "body": "…-write (v0.6.3)\n\nElection (hanzoai/ha) is coordination-free, so two replicas with divergent\nmembership views can each elect themselves the single writer for one org, and\nthe object store's unconditional Put ('overwriting is allowed') lets both\nclobber the mirror. FencedStore closes this at the stor\n[…]\ntionalStore seam; concrete minio store lives with\nthe S3-client owner. Tests: deposed-fenced, same-round re-ship, handoff\nlock-out, carry-forward-no-loss, and concurrent race proofs (20x race-stable).",
          "is_bot": false,
          "headline": "replica: round-fenced writes (FencedStore) — close split-brain double…",
          "author_name": "Hanzo Dev",
          "author_login": null,
          "committed_at": "2026-07-09T17:08:44Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6cfcc195067f012a5ffb5f691203bd3c1ba88b83",
          "body": "* replica: extract single-writer election to hanzoai/ha\n\nElection (Owner/IsOwner/Replicas/Member) was storage-agnostic pure Go with\nzero vfs-internal callers — it lived here only historically. It is now its\nown coordination primitive at github.com/hanzoai/ha so any singleton (cron,\nqueue drain, bill\n[…]\nge for the concurrent replicator/ship loops).\nUnrelated to the ha extraction but folded in so this PR lands green rather\nthan override a known-bad check.\n\n---------\n\nCo-authored-by: hanzo <z@hanzo.ai>",
          "is_bot": false,
          "headline": "replica: extract single-writer election to hanzoai/ha (#5)",
          "author_name": "Hanzo Dev",
          "author_login": null,
          "committed_at": "2026-07-09T06:23:59Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "06708b3f142237be5ab28ce3d00c5c12fd3514a5",
          "body": "go test -race requires cgo, but the self-hosted hanzo-build-linux-amd64\nrunner has no C compiler and defaulted CGO_ENABLED=0 (vfs is CGO-free in\nproduction), so both race steps failed — first with 'go: -race requires\ncgo', then 'C compiler gcc not found'. Every main run has been red on this\nfor many\n[…]\now the race detector\nactually runs (real coverage for the concurrent replicator/ship loops).\nUnrelated to the ha extraction but folded in so this PR lands green rather\nthan override a known-bad check.",
          "is_bot": false,
          "headline": "ci: enable cgo for the -race steps (pre-existing red)",
          "author_name": "hanzo",
          "author_login": null,
          "committed_at": "2026-07-09T06:22:44Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "576dc6217efb788924a3f52fd3ba1a9a296a6734",
          "body": "Election (Owner/IsOwner/Replicas/Member) was storage-agnostic pure Go with\nzero vfs-internal callers — it lived here only historically. It is now its\nown coordination primitive at github.com/hanzoai/ha so any singleton (cron,\nqueue drain, billing sweep) gets exactly-once WITHOUT importing a SQLite\nl\n[…]\ncloud/internal/org) migrate to hanzoai/ha in lockstep;\nthey pin vfs v0.6.2 so this main-only removal does not disturb them until\nthey bump. Removes owner.go + its two election tests; doc points at ha.",
          "is_bot": false,
          "headline": "replica: extract single-writer election to hanzoai/ha",
          "author_name": "hanzo",
          "author_login": null,
          "committed_at": "2026-07-09T05:55:08Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1dcfeb37694f0190d618b223bf2cd005e7bfd1e6",
          "body": "… + HRW election",
          "is_bot": false,
          "headline": "test(replica): benchmarks for snapshot/backup + push-pull replication…",
          "author_name": "Hanzo Dev",
          "author_login": null,
          "committed_at": "2026-07-05T17:39:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8f6422b4e4eae4a41d327b006e3b80fac43b72e8",
          "body": "…ses (cloud dedup)",
          "is_bot": false,
          "headline": "feat(replica): export Version — the ONE content-hash any Store impl u…",
          "author_name": "Hanzo Dev",
          "author_login": null,
          "committed_at": "2026-07-05T07:40:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a2d3a87d046053a30cef56dd7b0960f3e8cdbd84",
          "body": "…imitive for any SQLite user\n\nxorm/GORM services can't share a handle with SQLiteDB (Restore swaps the file). Expose\nSnapshotFile(path) (transient read handle, VACUUM INTO) + RestoreFile(path,data) (atomic\nswap) so a service using its OWN engine adopts HA: RestoreFile before opening, SnapshotFile\nin the push loop. SQLiteDB now wraps these (one and one way). Tests still green.",
          "is_bot": false,
          "headline": "feat(replica): handle-less SnapshotFile/RestoreFile — the adoption pr…",
          "author_name": "Hanzo Dev",
          "author_login": null,
          "committed_at": "2026-07-05T05:18:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2b3830f4a22409bd7c894df190edf90e02bc66f2",
          "body": "Completes the shared HA-SQLite lib: NewBackendStore(be) adapts any vfs backend.Backend\n(file locally, s3/SeaweedFS in prod) to the Replicator Store, with a cheap content-version\nsidecar (<key>.ver) so a reader answers Version() without fetching the whole DB. So a\nservice wires HA in one line: NewReplicator(key, NewBackendStore(be), OpenSQLite(path)).\nTest: full owner->vfs-backend->reader path over the real file backend (SQLite rows\nsurvive push/pull, incl. updates + the version-skip).",
          "is_bot": false,
          "headline": "feat(replica): BackendStore adapter — the ready Store over vfs backend",
          "author_name": "Hanzo Dev",
          "author_login": null,
          "committed_at": "2026-07-05T05:13:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "bcc689fe130aefa96f5180c50d5bbab17bfaa54e",
          "body": "…P-0107)\n\nThe ONE importable durability library — promoted from cloud/internal/org (proven,\nbut internal + unimportable + only a memDB test) into hanzoai/vfs so EVERY service\nadopts the same code, never re-invents HA:\n- Replicator: per-org SQLite <-> vfs object store, whole-object WAL-checkpointed\n \n[…]\nder Push/Pull cycle + redundant-pull skip, HRW\ndeterminism/exclusivity/spread. Adoption contract (hydrate-on-open, single-writer\ngate, post-commit ship) documented for visor/iam/commerce/base rollout.",
          "is_bot": false,
          "headline": "feat(replica): shared HA-SQLite substrate for every Hanzo service (HI…",
          "author_name": "Hanzo Dev",
          "author_login": null,
          "committed_at": "2026-07-05T04:53:23Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4a82f281c3bc215dddb16158c4c04587c4f595a4",
          "body": "…@v1.6.0) + build green\n\nCo-authored-by: Hanzo Dev <dev@hanzo.ai>",
          "is_bot": false,
          "headline": "fix(deps): repair vanished pins / go.sum drift ( core-bump@latest age…",
          "author_name": "zeekay",
          "author_login": "zeekay",
          "committed_at": "2026-06-30T21:35:23Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "14dae3ea1b1f05fba853633e63e05b47efb67630",
          "body": null,
          "is_bot": false,
          "headline": "docs(brand): add hero banner",
          "author_name": "z",
          "author_login": "zeekay",
          "committed_at": "2026-06-29T03:15:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "df7c60896bba96b7df4a6b189a87162376ebe2de",
          "body": null,
          "is_bot": false,
          "headline": "chore(brand): dynamic hero banner",
          "author_name": "z",
          "author_login": "zeekay",
          "committed_at": "2026-06-29T03:15:23Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f9fd4b95bd0002cd7b31b15afd0d6a6e4c9490ca",
          "body": "… GitHub-hosted (#4)\n\nCo-authored-by: zeekay <z@hanzo.ai>",
          "is_bot": false,
          "headline": "ci: run on self-hosted ARC pool (hanzo-build-linux-amd64/deploy), not…",
          "author_name": "Hanzo Dev",
          "author_login": null,
          "committed_at": "2026-06-20T03:39:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ee33a6b1da1f1fe8b5e625f76b4da1cf8333c1d5",
          "body": "…ance.go\n\nThese instance-lifecycle accessors lived in the cloud-coupled mount.go (removed\nin v0.4.2). They are vfs-library surface, not a cloud concern — relocated here so\nthe standalone daemon, tests, and embedders keep the API while vfs stays\ncloud-free. Fixes the v0.4.2 API regression.",
          "is_bot": false,
          "headline": "vfs: restore Version/Instance/SetInstance/Shutdown in cloud-free inst…",
          "author_name": "zeekay",
          "author_login": "zeekay",
          "committed_at": "2026-06-12T03:03:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ea13fb13be8a7bb23daf9c964a766f7b9f9550ab",
          "body": "… to cloud/{mounts,cmd}/vfs\n\nvfs is OSS and stands alone as a pure block-filesystem library; the private\ncloud aggregator imports vfs, never the reverse. mount.go (build-tagged but\nstill forcing the module require), its test, and cmd/vfsd relocated to cloud.\nGOWORK=off go build/test ./... green; hanzoai/cloud no longer in the graph.",
          "is_bot": false,
          "headline": "vfs: decouple from hanzoai/cloud — HIP-0106 mount adapter + vfsd move…",
          "author_name": "zeekay",
          "author_login": "zeekay",
          "committed_at": "2026-06-12T02:52:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d9ea0d5b088b70b281738ba7791df9a7c1fbc3c2",
          "body": null,
          "is_bot": false,
          "headline": "docs: drop onyxd from the VFS consumer example list",
          "author_name": "zeekay",
          "author_login": "zeekay",
          "committed_at": "2026-06-11T04:52:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f33e8dbcc404bbdee66a3c7d3b472bf0eed9fd30",
          "body": "- Replace /USDL coin fixtures in sqlite_test.go and\n  pkg/mount/fuse_sqlite_test.go with USDC/USDT/BTC/ETH (generic\n  finance instruments)\n  path in LLM.md K8s sidecar pattern with generic 'tenant-bd' /\n  's3://tenant-vfs/'\n\nTests pass.",
          "is_bot": false,
          "headline": "chore: scrub  /  references from VFS test fixtures and docs",
          "author_name": "zeekay",
          "author_login": "zeekay",
          "committed_at": "2026-06-10T19:15:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a53837c0b88adc5f3667b0b61dbace6cddf67d45",
          "body": "Workspace-wide sync. luxfi/node already shipped on 1.26.4 in v1.30.6\n(commit 121aca1fa9); this is the cross-repo catch-up.",
          "is_bot": false,
          "headline": "deps: bump Go to 1.26.4 across go.mod, Dockerfiles, GH Actions",
          "author_name": "Hanzo AI",
          "author_login": null,
          "committed_at": "2026-06-07T19:13:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d0c43d3fba2d1d4525ad85a100390f99d30557d4",
          "body": "* vfs: gate Mount() + cmd/vfsd behind cloud_mount build tag\n\nThe Mount(), SetInstance(), Shutdown() HTTP-server surface drags in\nhanzoai/cloud + hanzoai/zip. Downstream services that consume the\ncore block + FS API (vfs.VFS, vfs.FS, vfs.File, NewCrypto) directly\n—  ATS shard layer, KMS, BD — don't n\n[…]\n.\n\n* chore: bump go to 1.26.4\n\nPicks up upstream security fixes for crypto/x509, mime, net/textproto,\ncrypto/fips140. No dependency bumps — only the toolchain directive.\n\ngo test -race ./... is green.",
          "is_bot": false,
          "headline": "vfs: gate Mount() behind cloud_mount build tag + Go 1.26.4 (#3)",
          "author_name": "Hanzo Dev",
          "author_login": null,
          "committed_at": "2026-06-07T14:51:11Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "015b2657d2d1334789f3c98c864d54cb7011d1c2",
          "body": "…lit)\n\nThree new primitives, all brand-neutral:\n\n  BlockTimeWorkload(blockTime, avgBlockBytes, monthsRetention,\n                    readAmp, objectBytes) -> Workload\n      Generic chain-style workload constructor parameterised by\n      block time so a single sweep covers 1ms..1s with one call.\n\n  Ti\n[…]\ns\n  TestTiered_24h_Hot_R2_Cold             — tiering math sanity\n  TestCluster_DedupKeepsWriterCostFlat   — 1w vs 11w cost identical\n  TestCluster_ReadersScaleGetCost        — 1, 11, 100, 1000 readers",
          "is_bot": false,
          "headline": "cost: add Tiered (hot SSD + cold archive) + Cluster (writer/reader sp…",
          "author_name": "Hanzo AI",
          "author_login": null,
          "committed_at": "2026-06-03T16:28:48Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ce9ea9a54a8baf269d3d8856d957930035ed4eec",
          "body": "Adds pkg/cost with a brand-neutral pricing model:\n\n  Workload { StorageGB, PutsPerMonth, GetsPerMonth, EgressGBPerMonth }\n  Catalog: aws-s3-{standard,ia,glacier-instant}, cloudflare-r2,\n           do-spaces, gcs-{standard,coldline}, k8s-pvc-block\n  EstimateFor, CompareBackends, Report, FromBenchmark\n[…]\npackage contains no application-specific defaults. Validator\narchive shapes, sqlite snapshot pipelines, indexer workloads etc.\ncompose Workload themselves in their own repos; cost stays the\nprimitive.",
          "is_bot": false,
          "headline": "cost: workload-neutral pricing primitive + vfs-cost CLI",
          "author_name": "Hanzo AI",
          "author_login": null,
          "committed_at": "2026-06-03T06:06:40Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "92d6b92e3d7b8550e554233226400098fbc0f88a",
          "body": "Adds five Go tests covering the four code-level concerns that gate\nusing VFS as the durable store for stateful services like luxd /\nzapdb:\n\n  TestCrashRecovery_Synced_Persists                   (#1)\n  TestCrashRecovery_UnsyncedWriteIsLost_NotCorrupted  (#1)\n  TestCompaction_SustainedWrite           \n[…]\ny — bootstrap timing needs\na real cluster + S3 backend to measure honestly, not a Go test.\n#7 ditto — the procedure is straightforward (vfsd export → tar →\nPVC → restore) but execution is operational.",
          "is_bot": false,
          "headline": "test+docs: production-readiness for VFS-backed stateful workloads",
          "author_name": "Hanzo AI",
          "author_login": null,
          "committed_at": "2026-06-03T05:05:19Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e581710f57eb8716a32517c226474be456974298",
          "body": "Switch from gcr.io/distroless/static:nonroot to FROM scratch. The\nstatic Go binary gets CA certs, tzdata, /etc/passwd and /etc/group\n(nonroot uid/gid 65532) copied from the build stage.",
          "is_bot": false,
          "headline": "dockerfile: scratch runtime, drop gcr.io",
          "author_name": "Hanzo AI",
          "author_login": null,
          "committed_at": "2026-06-02T10:40:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ab0d042fe2c9c1d8325075ca132f5258262366b8",
          "body": null,
          "is_bot": false,
          "headline": "merge: feat/no-local-replace",
          "author_name": "Hanzo AI",
          "author_login": null,
          "committed_at": "2026-06-01T23:27:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b804b0c7e572da235ad1537e9bedfc1baae61396",
          "body": null,
          "is_bot": false,
          "headline": "merge: feat/cloud-mount",
          "author_name": "Hanzo AI",
          "author_login": null,
          "committed_at": "2026-06-01T23:27:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f9b2aa530e029f1905ab816b50c642e494f737d9",
          "body": "The `=> ../cloud` and `=> ../zip` replace directives were a parallel-dev\nhack. Cloud is now published at v0.1.0 (HIP-0106 unified binary) and\nzip at v0.2.0 (circuit-breaker primitive + multi-App isolation).\nResolve from GOPROXY — no local-dir pins remain.",
          "is_bot": false,
          "headline": "deps: drop local replace, pin cloud v0.1.0 + zip v0.2.0",
          "author_name": "Hanzo AI",
          "author_login": null,
          "committed_at": "2026-05-19T19:17:47Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b0d1536f2109fb59e55349e163ad2d3ef46f5f90",
          "body": "* docs: canonical README opening per Hanzo OSS taxonomy\n\n* docs: add canonical SECURITY.md",
          "is_bot": false,
          "headline": "docs: canonical README opening + SECURITY.md (#2)",
          "author_name": "Hanzo Dev",
          "author_login": null,
          "committed_at": "2026-05-19T06:53:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6c3cfe975127fc5e67712832647d4229943743fb",
          "body": "* feat: cloud Mount() per HIP-0106\n\nAdds pkg/vfs.Mount(*zip.App, cloud.Deps) error so the unified Hanzo\nCloud binary can blank-import and register VFS alongside every\nother Hanzo subsystem.\n\nVFS has no public HTTP surface today — it's an S3-backed virtual\nblock filesystem driven through FUSE/CLI/sid\n[…]\n/pkg/vfs/ nesting). Standalone shim moved\nto cmd/vfs/ where applicable.\n\nPer Hanzo Go-stdlib pattern: repo IS the package.\n\n* refactor: flatten import path — github.com/hanzoai/cloud (drop /pkg/cloud)",
          "is_bot": false,
          "headline": "feat: cloud Mount() per HIP-0106 (#1)",
          "author_name": "Hanzo Dev",
          "author_login": null,
          "committed_at": "2026-05-19T06:37:45Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a183d986687c7f4c0374c1f2a3e0828e19ab153f",
          "body": "…loud)",
          "is_bot": false,
          "headline": "refactor: flatten import path — github.com/hanzoai/cloud (drop /pkg/c…",
          "author_name": "Hanzo AI",
          "author_login": null,
          "committed_at": "2026-05-19T06:05:33Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f54c815cb891f87f3461a402c73a2004155913eb",
          "body": "Subsystem code lives in package vfs at repo root. Importers now use\n`github.com/hanzoai/vfs` (no /pkg/vfs/ nesting). Standalone shim moved\nto cmd/vfs/ where applicable.\n\nPer Hanzo Go-stdlib pattern: repo IS the package.",
          "is_bot": false,
          "headline": "refactor: collapse pkg/vfs/ → root for clean import path",
          "author_name": "Hanzo AI",
          "author_login": null,
          "committed_at": "2026-05-19T05:32:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "23a68a0710cf58989764b198ce5ad9dc6004d4d9",
          "body": "Adds pkg/vfs.Mount(*zip.App, cloud.Deps) error so the unified Hanzo\nCloud binary can blank-import and register VFS alongside every\nother Hanzo subsystem.\n\nVFS has no public HTTP surface today — it's an S3-backed virtual\nblock filesystem driven through FUSE/CLI/sidecar. Mount() exposes\nliveness/readi\n[…]\n + Block ZAP interface; full multi-block\nFile surface lands in follow-up PRs.\n\nTests:\n- pkg/vfs: TestMount_HealthReadyz + TestMount_PutGetRoundtrip green\n- existing TestRoundTrip + TestStats unchanged",
          "is_bot": false,
          "headline": "feat: cloud Mount() per HIP-0106",
          "author_name": "Hanzo AI",
          "author_login": null,
          "committed_at": "2026-05-19T04:55:00Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9b34500a498b0afdfcf2ab13925bb4133009dc79",
          "body": null,
          "is_bot": false,
          "headline": "go.mod: bump go directive to 1.26.3 (security advisory)",
          "author_name": "Hanzo AI",
          "author_login": null,
          "committed_at": "2026-05-13T04:27:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c9e57245fa857c48542a739f42fde2dcd38528b6",
          "body": "…macOS\n\nbazil.org/fuse dropped macOS support (commit 65cc252+). 0.3.0\nshipped Linux-only. This drop adds a parallel pkg/mount/fuse_darwin.go\nusing github.com/jacobsa/fuse, which still supports both macFUSE\n(kext) and fuse-t (userspace, no kext, SIP-friendly).\n\nSame Mount(*vfs.FS, mountpoint) signatu\n[…]\n → 100 rows survived umount+remount, integrity_check=ok\n\nReal FUSE mount, real SQLite opening test.db directly on the\nmountpoint, 100 INSERTs, unmount, remount, PRAGMA integrity_check.\nZero copy step.",
          "is_bot": false,
          "headline": "0.3.1: macOS FUSE via github.com/jacobsa/fuse — SQLite e2e passes on …",
          "author_name": "Hanzo Dev",
          "author_login": null,
          "committed_at": "2026-05-08T19:37:30Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "fb226d728150dab98d3e660e8443726b7408acd4",
          "body": null,
          "is_bot": false,
          "headline": "ci: bump Go to 1.25 (modernc/sqlite + bazil/fuse require it)",
          "author_name": "Hanzo Dev",
          "author_login": null,
          "committed_at": "2026-05-08T18:46:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "63345001917e6c6d18f5fc6348449a28eabf564c",
          "body": "The mount layer is no longer a stub. With `-tags fuse` on Linux,\nSQLite (and any POSIX consumer) opens files directly on the\nmountpoint — no intermediate copy. Default builds stay\ndependency-light: bazil.org/fuse + bazil.org/fuse/fs are gated\nbehind the build tag.\n\nWhat's new\n----------\n- pkg/mount/\n[…]\nevs use the in-process API + the SQLite\n  byte-roundtrip test in pkg/vfs/sqlite_test.go (already shipped).\n- Local NVMe disk cache (write-back tier) lands in 0.4.0; today the\n  cache is in-memory LRU.",
          "is_bot": false,
          "headline": "0.3.0: bazil.org/fuse mount + SQLite-on-FUSE e2e test (linux)",
          "author_name": "Hanzo Dev",
          "author_login": null,
          "committed_at": "2026-05-08T18:46:16Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2380df121699c0a621fa33b38f9907912b944de6",
          "body": "Adds the byte-addressed File API and a multi-file FS over the block\nVFS — the layer SQLite (and any other POSIX consumer) needs. FUSE\nmount lands in 0.3.0; until then the API is in-process Go.\n\nWhat's new\n----------\n- pkg/vfs/fs.go — FS with inode tree, directory ops (Mkdir, Create,\n  Lookup, ReadDi\n[…]\n.0: gcs + azureblob backends.\n- 0.6.0: K8s sidecar mode + Helm chart.\n- 1.0.0: chunked uploads, multipart resume, GC for orphan blocks\n  via a refcount map at metadata/refs.zap.age, Prom/OTel metrics.",
          "is_bot": false,
          "headline": "0.2.0: multi-block files + FS layer + SQLite roundtrip proven",
          "author_name": "Hanzo Dev",
          "author_login": null,
          "committed_at": "2026-05-08T18:37:17Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "837e5bac961a8724d540b7178f37e180e3e1c217",
          "body": "…rypto)\n\nPhase 0.1.0 — production-shaped scaffold for the S3-backed virtual block\nfilesystem. Stateful services (IAM, BD, ATS, TA, KMS, onyxd, lqd\nsnapshots) get unlimited disk via S3 with PQ-encrypted blocks; the\nhot tier is a configurable LRU cache. Companion to hanzo/replicate\n(WAL streaming) — `\n[…]\n cache layer\n- 0.3.0: gcs + azureblob backends\n- 0.4.0: K8s sidecar mode + Helm chart\n- 0.5.0: WASI guest mode\n- 1.0.0: chunked uploads, multipart resume, GC for orphan blocks,\n  metrics + SLO targets",
          "is_bot": false,
          "headline": "initial: vfs scaffold (block layer + file:// + s3 backends + age PQ c…",
          "author_name": "Hanzo Dev",
          "author_login": null,
          "committed_at": "2026-05-08T17:59:05Z",
          "body_truncated": true,
          "is_coding_agent": false
        }
      ],
      "releases_count": 1,
      "commits_last_year": 50,
      "latest_release_at": "2026-05-19T07:20:11Z",
      "latest_release_tag": "v0.1.0",
      "releases_from_tags": false,
      "days_since_last_push": 0,
      "active_weeks_last_year": 11,
      "days_since_latest_release": 70,
      "mean_days_between_releases": null
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": false,
      "health_percentage": 50,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "github.com/hanzoai/vfs",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": true,
          "registry_url": "https://pkg.go.dev/github.com/hanzoai/vfs",
          "is_deprecated": false,
          "latest_version": "v0.6.6",
          "repository_url": "https://github.com/hanzoai/vfs",
          "versions_count": 17,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-20T03:21:14Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 8
        }
      ]
    },
    "popularity": {
      "forks": 0,
      "stars": 0,
      "watchers": 0,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 0
      },
      "star_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_stars": 0,
        "collected_at": null
      },
      "open_issues_and_prs": 0
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [],
      "has_llms_txt": false,
      "has_dockerfile": true,
      "has_mcp_signal": false,
      "bootstrap_files": [
        "Makefile"
      ],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [
        "go.mod"
      ],
      "largest_source_bytes": 19162,
      "source_files_sampled": 34,
      "oversized_source_files": 0,
      "agent_instruction_files": [],
      "agent_instruction_max_bytes": null
    },
    "dependencies": {
      "manifests": [
        "go.mod"
      ],
      "advisories": {
        "error": null,
        "scope": "repository_graph",
        "source": "osv",
        "findings": [
          {
            "name": "golang.org/x/net",
            "direct": false,
            "version": "v0.54.0",
            "severity": "moderate",
            "ecosystem": "go",
            "cvss_score": 6.5,
            "advisory_ids": [
              "GHSA-5cv4-jp36-h3mw",
              "GO-2026-5025",
              "GO-2026-5026",
              "GO-2026-5027",
              "GO-2026-5028",
              "GO-2026-5029",
              "GO-2026-5030",
              "GO-2026-5942"
            ],
            "fixed_version": "0.56.0",
            "advisory_count": 8,
            "oldest_advisory_days": 67
          },
          {
            "name": "github.com/klauspost/compress",
            "direct": false,
            "version": "v1.18.2",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5841"
            ],
            "fixed_version": "1.18.7",
            "advisory_count": 1,
            "oldest_advisory_days": 1
          },
          {
            "name": "golang.org/x/crypto",
            "direct": false,
            "version": "v0.52.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5932"
            ],
            "fixed_version": null,
            "advisory_count": 1,
            "oldest_advisory_days": 21
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.37.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5970"
            ],
            "fixed_version": "0.39.0",
            "advisory_count": 1,
            "oldest_advisory_days": 14
          }
        ],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {
          "unknown": 3,
          "moderate": 1
        },
        "advisory_count": 11,
        "affected_count": 4,
        "assessed_count": 35,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "go"
      ],
      "dependencies": [
        {
          "name": "bazil.org/fuse",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20230120002735-62a210ff1fd5"
        },
        {
          "name": "github.com/hanzoai/sqlite",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.3.2"
        },
        {
          "name": "github.com/hanzos3/go",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.0"
        },
        {
          "name": "github.com/jacobsa/fuse",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20260302145937-f1ba38d60fdf"
        },
        {
          "name": "github.com/luxfi/age",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.6.0"
        },
        {
          "name": "github.com/spf13/cobra",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.10.2"
        },
        {
          "name": "github.com/zeebo/blake3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.2.4"
        }
      ],
      "all_dependencies": {
        "error": null,
        "source": "github-sbom",
        "packages": [
          {
            "name": "bazil.org/fuse",
            "direct": true,
            "version": "v0.0.0-20230120002735-62a210ff1fd5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hanzoai/sqlite",
            "direct": true,
            "version": "v0.3.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hanzos3/go",
            "direct": true,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jacobsa/fuse",
            "direct": true,
            "version": "v0.0.0-20260302145937-f1ba38d60fdf",
            "ecosystem": "go"
          },
          {
            "name": "github.com/luxfi/age",
            "direct": true,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/cobra",
            "direct": true,
            "version": "v1.10.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/zeebo/blake3",
            "direct": true,
            "version": "v0.2.4",
            "ecosystem": "go"
          },
          {
            "name": "filippo.io/hpke",
            "direct": false,
            "version": "v0.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/davecgh/go-spew",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/dustin/go-humanize",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-ini/ini",
            "direct": false,
            "version": "v1.67.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/uuid",
            "direct": false,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hanzoai/csqlite",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hanzoai/sqlcipher",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/inconshreveable/mousetrap",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/klauspost/compress",
            "direct": false,
            "version": "v1.18.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/klauspost/cpuid/v2",
            "direct": false,
            "version": "v2.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/klauspost/crc32",
            "direct": false,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-isatty",
            "direct": false,
            "version": "v0.0.21",
            "ecosystem": "go"
          },
          {
            "name": "github.com/minio/crc64nvme",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/minio/md5-simd",
            "direct": false,
            "version": "v1.1.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/ncruces/go-strftime",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/philhofer/fwd",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pmezard/go-difflib",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/remyoudompheng/bigfft",
            "direct": false,
            "version": "v0.0.0-20230129092748-24d4a6f8daec",
            "ecosystem": "go"
          },
          {
            "name": "github.com/rs/xid",
            "direct": false,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/pflag",
            "direct": false,
            "version": "v1.0.10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tinylib/msgp",
            "direct": false,
            "version": "v1.6.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/zeebo/assert",
            "direct": false,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "go.yaml.in/yaml/v3",
            "direct": false,
            "version": "v3.0.4",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/crypto",
            "direct": false,
            "version": "v0.52.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/net",
            "direct": false,
            "version": "v0.54.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sys",
            "direct": false,
            "version": "v0.46.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.37.0",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/yaml.v3",
            "direct": false,
            "version": "v3.0.1",
            "ecosystem": "go"
          }
        ],
        "collected": true,
        "truncated": false,
        "total_count": 35,
        "direct_count": 7,
        "indirect_count": 28
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 0,
        "open_issues": 0,
        "closed_ratio": null,
        "closed_issues": 0,
        "closed_unmerged_prs": 0
      },
      "bus_factor": 1,
      "bot_contributors": 0,
      "top_contributors": [
        {
          "type": "User",
          "login": "zeekay",
          "commits": 9,
          "avatar_url": "https://avatars.githubusercontent.com/u/285707?v=4"
        }
      ],
      "contributors_sampled": 1,
      "top_contributor_share": 1
    },
    "quality_signals": {
      "has_ci": false,
      "has_tests": true,
      "ci_workflows": [],
      "has_docs_dir": true,
      "linter_configs": [],
      "has_editorconfig": false,
      "has_linter_config": false,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "go.sum"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": null,
            "reason": "no pull request found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/30 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 10,
            "reason": "project has 31 contributing companies or organizations",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": null,
            "reason": "no workflows found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 0,
            "reason": "no update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 9,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 0,
            "reason": "project was created within the last 90 days. Please review its contents carefully",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": null,
            "reason": "packaging workflow not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 0,
            "reason": "dependency not pinned by hash detected -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "no SAST tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 10,
            "reason": "security policy file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": null,
            "reason": "no releases found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": null,
            "reason": "No tokens found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 0,
            "reason": "10 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "acdc44fb76beb25ecb5daeaf03d205a774d097b7",
        "ran_at": "2026-07-29T00:24:59Z",
        "aggregate_score": 2.4,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": true,
      "has_dependabot_config": false
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-28T04:03:12Z",
      "oldest_open_prs": [],
      "last_merged_pr_at": null,
      "ci_last_conclusion": null,
      "oldest_open_issues": []
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/hanzoai/vfs",
    "host": "github.com",
    "name": "vfs",
    "owner": "hanzoai"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "at_risk",
      "name": "Overall health",
      "note": "High-Risk Jurisdiction Policy applies a 75% multiplier to weighted overall health and gives it an At risk ceiling of 49.",
      "notes": [
        {
          "code": "jurisdiction_overall_adjustment",
          "params": {
            "cap": 49,
            "pct": 75
          }
        }
      ],
      "value": 34,
      "inputs": {
        "security": 34,
        "vitality": 69,
        "community": 21,
        "governance": 43,
        "engineering": 54,
        "high_risk_jurisdiction_cap": 49,
        "high_risk_jurisdiction_multiplier": 75,
        "weighted_overall_before_jurisdiction": 46,
        "overall_after_jurisdiction_multiplier": 34
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "moderate",
        "name": "Vitality",
        "value": 69,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "moderate",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 59,
            "inputs": {
              "commits_last_year": 50,
              "human_commit_share": 1,
              "days_since_last_push": 0,
              "active_weeks_last_year": 11
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 0 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 0
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "11/52 weeks with commits",
                "points": 7.6,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 11
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "50 commits in the last year",
                "points": 15.3,
                "status": "partial",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 50
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "good",
            "name": "Release discipline",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 84,
            "inputs": {
              "releases_count": 1,
              "latest_release_tag": "v0.1.0",
              "releases_from_tags": false,
              "days_since_latest_release": 70,
              "mean_days_between_releases": null
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "1 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 70 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 70
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "cadence unknown (single release)",
                "points": 12.6,
                "status": "partial",
                "details": [
                  {
                    "code": "release_cadence_unknown",
                    "params": {}
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "critical",
        "name": "Community & Adoption",
        "value": 21,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 1,
            "inputs": {
              "forks": 0,
              "stars": 0,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "0 stars",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "0 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "at_risk",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 44,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": false,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file present, not a recognized license",
                "points": 16.9,
                "status": "partial",
                "details": [
                  {
                    "code": "license_custom",
                    "params": {}
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "at_risk",
        "name": "Sustainability & Governance",
        "value": 43,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 20,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 1,
              "top_contributor_share": 1
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 100% of commits",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 100
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "1 contributors",
                "points": 1.4,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 31 contributing companies or organizations",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "critical",
            "name": "Issue & PR responsiveness",
            "note": "Excluded from scoring (no data or not applicable): Issue resolution, PR acceptance. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "issue_resolution",
                    "pr_acceptance"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 1,
            "inputs": {
              "merged_prs": 0,
              "open_issues": 0,
              "closed_issues": 0,
              "issue_closed_ratio": null,
              "closed_unmerged_prs": 0
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "no issues or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_issues_or_data",
                    "params": {}
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "no decided pull requests or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_decided_prs_or_data",
                    "params": {}
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "moderate",
            "name": "Ownership & stewardship",
            "note": null,
            "notes": [],
            "value": 66,
            "inputs": {
              "followers": 37,
              "owner_type": "Organization",
              "is_verified": null,
              "owner_login": "hanzoai",
              "public_repos": 159,
              "account_age_days": 3882
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "organization-owned",
                "points": 30,
                "status": "met",
                "details": [
                  {
                    "code": "owner_organization",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "37 followers of hanzoai",
                "points": 11.4,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 37,
                      "login": "hanzoai"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "159 public repos, account ~10 yr old",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 159
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 10
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "github.com/hanzoai/vfs"
              ],
              "ecosystems": "go",
              "any_deprecated": false,
              "min_days_since_publish": 8
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on go",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "go"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 8 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 8
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "17 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 17
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "moderate",
        "name": "Engineering Quality",
        "value": 54,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "at_risk",
            "name": "Engineering practices",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_ci_tests"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 30,
            "inputs": {
              "has_ci": false,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": false,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "excellent",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 90,
            "inputs": {
              "topics": [],
              "has_wiki": true,
              "homepage": "https://hanzo.ai",
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": "https://hanzo.ai",
                "points": 15,
                "status": "met",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "at_risk",
        "name": "Security",
        "value": 34,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "critical",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): CI-Tests, Dangerous-Workflow, Packaging, Signed-Releases, Token-Permissions. Remaining weights renormalized. High-Risk Jurisdiction Policy applies a 75% multiplier to Security posture and gives it an At risk ceiling of 49.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "ci_tests",
                    "dangerous_workflow",
                    "packaging",
                    "signed_releases",
                    "token_permissions"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "jurisdiction_posture_adjustment",
                "params": {
                  "cap": 49,
                  "pct": 75
                }
              }
            ],
            "value": 18,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 13,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 5,
              "scorecard_aggregate": 2.4,
              "high_risk_jurisdiction_cap": 49,
              "high_risk_jurisdiction_multiplier": 75,
              "security_posture_after_multiplier": 18,
              "security_posture_before_jurisdiction": 24
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 31 contributing companies or organizations",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no workflows found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "no update tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.2,
                "status": "partial",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow not detected",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "no SAST tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "No tokens found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "10 existing vulnerabilities detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "excellent",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 35 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "indirect_dependencies_free_of_known_advisories",
                    "no_advisories_left_outstanding"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_repository",
                "params": {
                  "assessed": 35
                }
              },
              {
                "code": "advisories_repo_graph_caveat",
                "params": {}
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "source": "osv",
              "advisories": 11,
              "affected_packages": 4,
              "assessed_packages": 35,
              "unassessed_packages": 0,
              "affected_by_severity": "moderate 1, unknown 3",
              "direct_affected_packages": 0
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "no direct dependency carries a known advisory",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "no_direct_advisories",
                    "params": {}
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "transitive set not separable from development and test dependencies in this scope",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_scope_not_separable",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory carries a publication date",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_no_publication_date",
                    "params": {}
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 35,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "good",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 75,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": true,
              "exposures": [
                {
                  "role": "contributor_organization",
                  "count": 1,
                  "country": "Russia"
                }
              ],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 20
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "Russia: contributor_organization (1)",
                "points": 75,
                "status": "partial",
                "details": [
                  {
                    "code": "jurisdiction_exposure",
                    "params": {
                      "role": "contributor_organization",
                      "count": 1,
                      "country": "Russia"
                    }
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "moderate",
        "name": "AI Readiness",
        "value": 60,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "at_risk",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 0.98,
              "agent_instruction_files": [],
              "agent_instruction_max_bytes": null
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "no CLAUDE.md / AGENTS.md / editor rules",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_instructions",
                    "params": {}
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "49 of 50 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 49,
                      "sampled": 50
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "moderate",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 61,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "go.sum"
              ],
              "has_dockerfile": true,
              "typed_language": true,
              "bootstrap_files": [
                "Makefile"
              ],
              "has_devcontainer": false,
              "has_linter_config": false,
              "typecheck_configs": [],
              "agent_commit_share": 0,
              "toolchain_manifests": [
                "go.mod"
              ],
              "dependency_bot_commit_share": 0
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "Makefile",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Makefile"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "Go (statically typed)",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "Dockerfile, lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Dockerfile, lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "no agent-authored commits among the last 50",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_authored_commits",
                    "params": {
                      "sampled": 50
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "no automated dependency updates observed",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_dependency_automation",
                    "params": {}
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "Go",
              "largest_source_bytes": 19162,
              "source_files_sampled": 34,
              "oversized_source_files": 0
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Go (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "0/34 source files over 60KB",
                "points": 55,
                "status": "met",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 34,
                      "oversized": 0
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [],
  "report_type": "repository",
  "generated_at": "2026-07-29T00:25:03.641896Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/h/hanzoai/vfs.svg",
  "full_name": "hanzoai/vfs",
  "license_state": "custom",
  "license_spdx": null
}

Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.

Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v1.13.0, schema v0.27.0 — full methodology · metrics wiki.

How one result sits in the wider record: aggregate statistics — Go.

Software health index

Score profile

Ownership

Package ecosystems

Metrics by category

Key facts

More detail

Related records