rossoctl / cortex

When each star and fork was added, collected from GitHub and bucketed by day. Cumulative growth sits directly above the daily additions it is made of, so the two read against each other: steady organic accretion looks nothing like an abrupt, short-lived burst. Where that difference is measurable, it is reported as growth authenticity.

Full resolved dependency set from the GitHub dependency graph: 21 direct and 143 indirect (transitive) packages. The transitive closure is complete when the repository commits a lockfile.

This repository publishes no package the index resolves, so its own dependency graph was assessed — 156 packages, which also include development and test pins that never ship: 3 carry known advisories, of which 1 are direct. 8 could not be assessed — no resolved version, an unsupported ecosystem, or beyond the reported package list.

An advisory means the version recorded in the dependency graph falls inside an advisory’s affected range. Reachability is not analysed, and the graph includes development and test pins — a finding may concern tooling rather than shipped software.

{
  "data": {
    "repo": {
      "topics": [],
      "is_fork": false,
      "size_kb": 85381,
      "has_wiki": true,
      "homepage": null,
      "languages": {
        "Go": 2467801,
        "Shell": 158813,
        "Python": 341043,
        "Makefile": 80727,
        "Dockerfile": 17491
      },
      "pushed_at": "2026-07-29T23:24:59Z",
      "created_at": "2025-10-11T14:53:37Z",
      "owner_type": "Organization",
      "updated_at": "2026-07-29T23:25:03Z",
      "description": "Repository for kagenti extensions projects",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "Apache-2.0",
      "default_branch": "main",
      "license_spdx_raw": "Apache-2.0",
      "primary_language": "Go",
      "significant_languages": [
        "Go",
        "Python"
      ]
    },
    "owner": {
      "blog": "https://rossoctl.github.io/.github/",
      "name": "Rossoctl",
      "type": "Organization",
      "login": "rossoctl",
      "company": null,
      "location": "United States of America",
      "followers": 68,
      "avatar_url": "https://avatars.githubusercontent.com/u/204348357?v=4",
      "created_at": "2025-03-21T12:43:49Z",
      "is_verified": null,
      "public_repos": 21,
      "account_age_days": 495
    },
    "license": {
      "state": "standard",
      "spdx_id": "Apache-2.0",
      "raw_spdx": "Apache-2.0",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.7.0-alpha.1",
          "kind": "prerelease",
          "published_at": "2026-07-29T20:36:47Z"
        },
        {
          "tag": "v0.6.0-alpha.12",
          "kind": "prerelease",
          "published_at": "2026-07-22T17:10:06Z"
        },
        {
          "tag": "v0.6.0-alpha.4",
          "kind": "prerelease",
          "published_at": "2026-05-23T12:14:27Z"
        },
        {
          "tag": "v0.5.0-rc.3",
          "kind": "prerelease",
          "published_at": "2026-05-13T14:35:08Z"
        },
        {
          "tag": "v0.5.0-alpha.2",
          "kind": "prerelease",
          "published_at": "2026-04-16T11:42:50Z"
        },
        {
          "tag": "v0.4.0-alpha.12",
          "kind": "prerelease",
          "published_at": "2026-04-09T15:33:42Z"
        },
        {
          "tag": "v0.4.0-alpha.13",
          "kind": "prerelease",
          "published_at": "2026-04-09T18:25:09Z"
        },
        {
          "tag": "v0.4.0-alpha.11",
          "kind": "prerelease",
          "published_at": "2026-04-02T01:50:32Z"
        },
        {
          "tag": "v0.4.0-alpha.10",
          "kind": "prerelease",
          "published_at": "2026-03-30T18:21:22Z"
        },
        {
          "tag": "v0.4.0-alpha.9",
          "kind": "prerelease",
          "published_at": "2026-03-18T14:32:48Z"
        },
        {
          "tag": "v0.4.0-alpha.8",
          "kind": "prerelease",
          "published_at": "2026-03-16T20:52:26Z"
        },
        {
          "tag": "v0.4.0-alpha.7",
          "kind": "prerelease",
          "published_at": "2026-03-11T02:16:35Z"
        },
        {
          "tag": "v0.4.0-alpha.6",
          "kind": "prerelease",
          "published_at": "2026-03-06T19:03:37Z"
        },
        {
          "tag": "v0.4.0-alpha.5",
          "kind": "prerelease",
          "published_at": "2026-02-25T15:51:10Z"
        },
        {
          "tag": "v0.4.0-alpha.4",
          "kind": "prerelease",
          "published_at": "2026-02-24T01:06:18Z"
        },
        {
          "tag": "v0.4.0-alpha.3",
          "kind": "prerelease",
          "published_at": "2026-02-12T14:50:55Z"
        },
        {
          "tag": "v0.4.0-alpha.2",
          "kind": "prerelease",
          "published_at": "2026-02-06T21:25:51Z"
        },
        {
          "tag": "v0.4.0-alpha.1",
          "kind": "prerelease",
          "published_at": "2026-02-03T18:37:01Z"
        },
        {
          "tag": "v0.3.1",
          "kind": "patch",
          "published_at": "2026-01-30T18:07:21Z"
        },
        {
          "tag": "v0.3.0",
          "kind": "minor",
          "published_at": "2026-01-29T20:54:23Z"
        },
        {
          "tag": "v0.1.0-alpha.9",
          "kind": "prerelease",
          "published_at": "2025-12-19T20:36:43Z"
        },
        {
          "tag": "v0.1.0-alpha.8",
          "kind": "prerelease",
          "published_at": "2025-12-19T20:06:48Z"
        },
        {
          "tag": "v0.1.0-alpha.7",
          "kind": "prerelease",
          "published_at": "2025-12-19T16:33:48Z"
        },
        {
          "tag": "v0.1.0-alpha.6",
          "kind": "prerelease",
          "published_at": "2025-11-20T21:28:48Z"
        },
        {
          "tag": "v0.1.0-alpha.5",
          "kind": "prerelease",
          "published_at": "2025-11-20T18:11:25Z"
        },
        {
          "tag": "v0.1.0-alpha.4",
          "kind": "prerelease",
          "published_at": "2025-11-20T17:42:50Z"
        },
        {
          "tag": "v0.1.0-alpha.3",
          "kind": "prerelease",
          "published_at": "2025-11-19T23:04:13Z"
        },
        {
          "tag": "v0.1.0-alpha.2",
          "kind": "prerelease",
          "published_at": "2025-11-19T21:53:15Z"
        },
        {
          "tag": "v0.1.0-alpha.1",
          "kind": "prerelease",
          "published_at": "2025-11-19T20:54:54Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "4e01283271ae11c90821c85e293b47be9cdf3a06",
          "body": "Feat: one-line installer that downloads and starts the local demo",
          "is_bot": false,
          "headline": "Merge pull request #718 from huang195/feat/demo-installer",
          "author_name": "Hai Huang",
          "author_login": "huang195",
          "committed_at": "2026-07-29T23:24:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d7923d07661b8695a74c0e3674e1b7a32ede4aa8",
          "body": "Add authbridge/install-demo.sh and make it the quickstart headline, so the\nlocal demo is a single command instead of a manual Releases-page download:\n\n  curl -fsSL https://raw.githubusercontent.com/rossoctl/cortex/main/authbridge/install-demo.sh | sh\n\nThe script (POSIX sh) detects OS/arch, resolves \n[…]\ntarts the demo on\nloopback (forward proxy :8081 + session API :9094; no transparent listener).\n\nAssisted-By: Claude (Anthropic AI) <noreply@anthropic.com>\nSigned-off-by: Hai Huang <huang195@gmail.com>",
          "is_bot": false,
          "headline": "Feat: one-line installer that downloads and starts the local demo",
          "author_name": "Hai Huang",
          "author_login": "huang195",
          "committed_at": "2026-07-29T23:20:26Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "86c52d1cd491963a0bb4cac33da0a55b762598e3",
          "body": "Feat: one-command local quickstart (--demo) + Cortex README",
          "is_bot": false,
          "headline": "Merge pull request #716 from huang195/docs/root-readme-quickstart",
          "author_name": "Hai Huang",
          "author_login": "huang195",
          "committed_at": "2026-07-29T20:29:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c4f799b19b756e9e77953d5252e1a5cf276b4136",
          "body": "Add `authbridge-proxy --demo`: a built-in demo config (forward-only\nproxy + TLS bridge with an auto-generated CA + the LLM/MCP/A2A parsers). No\nabsolute path is baked in — the config is written to demo.yaml inside\nca_dir (default ./cortex-ca relative to the cwd; override with --ca-dir), next\nto the \n[…]\ne + generate_ca (ca_dir), and the ordered\nparser set inference-parser, mcp-parser, a2a-parser.\n\nAssisted-By: Claude (Anthropic AI) <noreply@anthropic.com>\nSigned-off-by: Hai Huang <huang195@gmail.com>",
          "is_bot": false,
          "headline": "Feat: one-command local quickstart (--demo) + Cortex README",
          "author_name": "Hai Huang",
          "author_login": "huang195",
          "committed_at": "2026-07-29T20:10:06Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1ceb2846016a85b6f61cf05f271b399f136da3cf",
          "body": "Feat: Publish prebuilt abctl and authbridge-proxy release binaries",
          "is_bot": false,
          "headline": "Merge pull request #715 from huang195/feat/release-binaries",
          "author_name": "Hai Huang",
          "author_login": "huang195",
          "committed_at": "2026-07-29T18:29:48Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9a97ad4448ab56adca714bfe63ba332b29fd979f",
          "body": "Docs: Fix broken links",
          "is_bot": false,
          "headline": "Merge pull request #717 from esnible/fix-links",
          "author_name": "Hai Huang",
          "author_login": "huang195",
          "committed_at": "2026-07-29T17:39:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4b6f62fe6e7e0ed4acd785901fcf00144cb8cafb",
          "body": "Signed-off-by: Ed Snible <snible@us.ibm.com>",
          "is_bot": false,
          "headline": "Fix broken links",
          "author_name": "Ed Snible",
          "author_login": "esnible",
          "committed_at": "2026-07-29T17:26:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c8016066d36bf3bdf79e8339aebbfb33b4afbae2",
          "body": "Update cmd/abctl/README.md and the weather-agent abctl demo to lead with\ndownloading a prebuilt abctl from the Releases page (linking the new\n\"Download prebuilt binaries\" section in authbridge/README.md), keeping\nbuild-from-source as an alternative. Follows the release-binaries workflow\nadded in this PR.\n\nAssisted-By: Claude (Anthropic AI) <noreply@anthropic.com>\nSigned-off-by: Hai Huang <huang195@gmail.com>",
          "is_bot": false,
          "headline": "Docs: point abctl instructions at prebuilt release binaries",
          "author_name": "Hai Huang",
          "author_login": "huang195",
          "committed_at": "2026-07-29T15:47:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f655601a2281319b1d57513547812810a6b0dd1d",
          "body": "New users had to `go build` abctl and authbridge-proxy locally. Both are\npure-Go (CGO_ENABLED=0, no cgo), so ship prebuilt binaries on each v* tag.\n\nAdd .github/workflows/release-binaries.yaml: on a v* tag, cross-compile\nboth binaries for linux+darwin × amd64+arm64 (GOWORK=off CGO_ENABLED=0,\neach cm\n[…]\non prints the injected\ntag; linux binaries are `statically linked` (file); gofmt/go vet clean.\n\nAssisted-By: Claude (Anthropic AI) <noreply@anthropic.com>\nSigned-off-by: Hai Huang <huang195@gmail.com>",
          "is_bot": false,
          "headline": "Feat: Publish prebuilt abctl and authbridge-proxy release binaries",
          "author_name": "Hai Huang",
          "author_login": "huang195",
          "committed_at": "2026-07-29T15:18:53Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "afc23217eabb77ce13618862779c5f563795694d",
          "body": "Feat: Select active proxies via listener.roles",
          "is_bot": false,
          "headline": "Merge pull request #709 from huang195/feat/proxy-roles",
          "author_name": "Hai Huang",
          "author_login": "huang195",
          "committed_at": "2026-07-28T19:29:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ad1bf3ee3a040323aa8fceb4c897b71564ffe357",
          "body": "Feat: Auto-generate the tls_bridge CA when generate_ca is set",
          "is_bot": false,
          "headline": "Merge pull request #707 from huang195/feat/tls-bridge-generate-ca",
          "author_name": "Hai Huang",
          "author_login": "huang195",
          "committed_at": "2026-07-28T18:06:03Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e6d4853743e1c6e744ad1ed4a0ce6839ec779a70",
          "body": "Running authbridge-proxy standalone as a forward proxy with tls_bridge\nrequired minting a signing CA by hand (openssl) into ca_dir: main.go\nalways loaded tls.crt/tls.key via NewFileSource and fatally exited when\nthey were absent.\n\nAdd tls_bridge.generate_ca (default false). When true AND the ca_dir \n[…]\nof incomplete sets (orphaned key, orphaned cert, missing ca.crt);\nmissing parent dirs created.\n\nAssisted-By: Claude (Anthropic AI) <noreply@anthropic.com>\nSigned-off-by: Hai Huang <huang195@gmail.com>",
          "is_bot": false,
          "headline": "Feat: auto-generate the tls_bridge CA when generate_ca is set",
          "author_name": "Hai Huang",
          "author_login": "huang195",
          "committed_at": "2026-07-28T18:01:51Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a5b099d2d5d771e0109de81337b01f56169c53e9",
          "body": "proxy-sidecar mode always started BOTH the reverse proxy (:8080, inbound)\nand the forward proxy (:8081, outbound), and validation unconditionally\nrequired reverse_proxy_backend. That forces standalone/laptop egress-only\ndeployments to set a dummy backend and move the reverse proxy off its\ncolliding \n[…]\ny binds\n:8081 (+:8082,:9094) and never :8080; reverse-only without a backend\nfails validation.\n\nAssisted-By: Claude (Anthropic AI) <noreply@anthropic.com>\nSigned-off-by: Hai Huang <huang195@gmail.com>",
          "is_bot": false,
          "headline": "Feat: select active proxies via listener.roles (forward/reverse/both)",
          "author_name": "Hai Huang",
          "author_login": "huang195",
          "committed_at": "2026-07-28T17:34:39Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3568d6937ed0e1a9e68be05c95de6d136e7b5314",
          "body": "Fix: mcp-parser observes notification acks instead of skipping",
          "is_bot": false,
          "headline": "Merge pull request #706 from huang195/fix/mcp-notification-ack-observe",
          "author_name": "Hai Huang",
          "author_login": "huang195",
          "committed_at": "2026-07-28T14:55:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "137bebdee5c5ccb226a255047b5ebffe0c547072",
          "body": "…sions-2026-07-28\n\ndocs: Fix broken install.md links in authbridge demos (5 files)",
          "is_bot": false,
          "headline": "Merge pull request #705 from clawgenti/fix/broken-links-kagenti-exten…",
          "author_name": "Hai Huang",
          "author_login": "huang195",
          "committed_at": "2026-07-28T14:20:30Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d1a9ada91b13ba4b1d244b504d3171677e39afb2",
          "body": "A JSON-RPC notification (e.g. notifications/initialized) carries no\nrequest id, so per the MCP Streamable HTTP spec the transport acks it\nwith an empty HTTP 202 and there is no response object to parse.\nmcp-parser recorded a Skip for that empty response, which abctl renders\nas \"— —\" — reading as if \n[…]\nn ack → observe, request-with-id empty body → skip,\nfor both the buffered and streaming paths.\n\nAssisted-By: Claude (Anthropic AI) <noreply@anthropic.com>\nSigned-off-by: Hai Huang <huang195@gmail.com>",
          "is_bot": false,
          "headline": "Fix: mcp-parser observes notification acks instead of skipping",
          "author_name": "Hai Huang",
          "author_login": "huang195",
          "committed_at": "2026-07-28T13:39:20Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4292d42865862812251c2fb0d1f034fbe24d29e5",
          "body": "Update rossoctl install.md path: the docs directory was reorganized\nand docs/install.md moved to docs/getting-started/install.md.\n\nAutomated fix by OpenClaw Link Health Fixer (2026-07-28).\nFixes #698, #697, #696, #695, #694\n\nSigned-off-by: Gloire Rubambiza <gloire@ibm.com>",
          "is_bot": false,
          "headline": "docs: Fix broken internal links in authbridge demos",
          "author_name": "Gloire Rubambiza",
          "author_login": "rubambiza",
          "committed_at": "2026-07-28T12:08:20Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1dfd69115020285eb1376bd14c555d71ae7365f7",
          "body": "Fix: scope a2a/mcp parsers to their own JSON-RPC method namespace",
          "is_bot": false,
          "headline": "Merge pull request #700 from huang195/fix/a2a-parser-empty-method-guard",
          "author_name": "Hai Huang",
          "author_login": "huang195",
          "committed_at": "2026-07-28T00:47:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f3452845169e384d91ddf0df62f96861661f6b84",
          "body": "a2a-parser and mcp-parser both parse JSON-RPC 2.0 request bodies, and\neach claimed a request whenever the body carried a non-empty \"method\".\nBut A2A and MCP both ride JSON-RPC 2.0 over HTTP, so \"method is\nnon-empty\" cannot tell them apart:\n\n  - a2a-parser attached an A2AExtension + a \"matched_\" obse\n[…]\n extension or recording an\ninvocation, and Classification() reports unclassified in that case.\n\nAssisted-By: Claude (Anthropic AI) <noreply@anthropic.com>\nSigned-off-by: Hai Huang <huang195@gmail.com>",
          "is_bot": false,
          "headline": "Fix: scope a2a/mcp parsers to their own JSON-RPC method namespace",
          "author_name": "Hai Huang",
          "author_login": "huang195",
          "committed_at": "2026-07-27T23:51:21Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "0f8653005d4521e31ccd0a08a2f39dfa57d63904",
          "body": "* Log messages to help with invalid startup options\n\nSigned-off-by: Ed Snible <snible@us.ibm.com>",
          "is_bot": false,
          "headline": "Feat: Log messages to help with invalid startup options (#699)",
          "author_name": "Ed Snible",
          "author_login": "esnible",
          "committed_at": "2026-07-27T23:10:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "afa1396e6815ba83159912bded6eb5f6e39fa3a5",
          "body": "Fix: duplicate build-args key in Build-Publish workflow",
          "is_bot": false,
          "headline": "Merge pull request #693 from rossoctl/fix/build-args-duplicate-key",
          "author_name": "Mariusz Sabath",
          "author_login": "mrsabath",
          "committed_at": "2026-07-21T16:40:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cff6df5bd6a346ff8ab09e13dce7e5e10d56aee2",
          "body": "The 'Build and push' step declared 'build-args:' twice, which is\ninvalid YAML (duplicate mapping key) and fails the whole workflow with\n'This run likely failed because of a workflow file issue'. As a result\nno cortex images publish, which in turn breaks the operator E2E that\npulls ghcr.io/rossoctl/c\n[…]\nd CPEX_FFI_* args used by\nauthbridge-cpex) into a single multiline build-args value. Only one\nimage sets each source, so concatenating them is safe.\n\nSigned-off-by: Mariusz Sabath <mrsabath@gmail.com>",
          "is_bot": false,
          "headline": "🐛 Fix duplicate build-args key in Build-Publish workflow",
          "author_name": "Mariusz Sabath",
          "author_login": "mrsabath",
          "committed_at": "2026-07-21T16:09:13Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "48fb3c767572ac4a70643bca181d290ab15de035",
          "body": "Refactor: Rename rossocortex → cortex (fix module paths)",
          "is_bot": false,
          "headline": "Merge pull request #680 from Ibrahim2595/fix/rossocortex-to-cortex",
          "author_name": "Mariusz Sabath",
          "author_login": "mrsabath",
          "committed_at": "2026-07-20T19:23:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c4df748ef26a6bff7f8f528921cc62673efb9d01",
          "body": "context-guru's module path was renamed (rossoctl/context-guru#10, commit\n8fc7c7b36563). This branch pinned the pre-rename commit\nv0.0.0-20260713113308-b624f2c3d8c2 whose go.mod still declared\ngithub.com/kagenti/context-guru, breaking `go build`/`go mod verify` with a\nmodule-path mismatch (the Go CI \n[…]\nlean of kagenti and rossocortex.\n\nRelated to rossoctl/rossoctl#1972\n\nAssisted-By: Claude Opus 4.8 <noreply@anthropic.com>\nSigned-off-by: IBRAHIM IBRAHIM <66755652+Ibrahim2595@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Fix: bump context-guru to post-rename commit + regenerate go.sum",
          "author_name": "IBRAHIM IBRAHIM",
          "author_login": "Ibrahim2595",
          "committed_at": "2026-07-20T19:15:38Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5f34d2a628dd42886a80fb9c32d263cc952183e1",
          "body": "…ortex\n\nFollow-up to the Rossoctl rename (#678 merged the kagenti→rossoctl content but not\nthe later rossocortex→cortex change). The repo is now rossoctl/cortex, yet its 8\nGo modules still declared github.com/rossoctl/rossocortex/... — a module-path\nmismatch that breaks `go get`/imports of github.co\n[…]\npublished; real go.sum checksums regenerate then.\n\nRelated to #1972\n\nAssisted-By: Claude Opus 4.8 <noreply@anthropic.com>\nSigned-off-by: IBRAHIM IBRAHIM <66755652+Ibrahim2595@users.noreply.github.com>",
          "is_bot": false,
          "headline": "⚠️ Rename rossocortex → cortex — fix module paths to match rossoctl/c…",
          "author_name": "IBRAHIM IBRAHIM",
          "author_login": "Ibrahim2595",
          "committed_at": "2026-07-20T17:43:14Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "dadd52f22e18ed79cddd7d0dedc4a0a83ae29cd0",
          "body": "⚠️ Rename Kagenti → Rossoctl across kagenti-extensions (→ rossocortex)",
          "is_bot": false,
          "headline": "Merge pull request #678 from Ibrahim2595/rename/kagenti-to-rossoctl",
          "author_name": "Mariusz Sabath",
          "author_login": "mrsabath",
          "committed_at": "2026-07-20T17:24:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "28718735bd9fa3b59012981965cb8ed41b7d788c",
          "body": "The context-guru dependency was renamed github.com/kagenti/context-guru →\ngithub.com/rossoctl/context-guru, but the go.sum `h1:` and `/go.mod h1:` hashes\nwere carried over byte-identical by the string replace. Go's `/go.mod` hash is\ncomputed over the go.mod contents, whose `module` line must become\n\n[…]\nthe org move.\n\nAddresses review feedback on #678.\n\nRelated to #1972\n\nAssisted-By: Claude Opus 4.8 <noreply@anthropic.com>\nSigned-off-by: IBRAHIM IBRAHIM <66755652+Ibrahim2595@users.noreply.github.com>",
          "is_bot": false,
          "headline": "🐛 Remove non-validating context-guru go.sum placeholders",
          "author_name": "IBRAHIM IBRAHIM",
          "author_login": "Ibrahim2595",
          "committed_at": "2026-07-20T14:16:14Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e774166ff7be87620a25d5bc41b05fab5ea60cf8",
          "body": "Full content rename Kagenti → Rossoctl. Repo renamed kagenti-extensions →\nrossocortex; all 1582 case-insensitive `kagenti` references updated; grep is clean.\n\nChanges:\n- Brand / prose / comments: Kagenti → Rossoctl\n- Go modules (8): github.com/kagenti/kagenti-extensions/... →\n  github.com/rossoctl/r\n[…]\named +\n  republished and `go mod tidy` is re-run.\n\nRelated to #1972\n\nAssisted-By: Claude Opus 4.8 <noreply@anthropic.com>\nSigned-off-by: IBRAHIM IBRAHIM <66755652+Ibrahim2595@users.noreply.github.com>",
          "is_bot": false,
          "headline": "⚠️ Rename Kagenti → Rossoctl across kagenti-extensions (→ rossocortex)",
          "author_name": "IBRAHIM IBRAHIM",
          "author_login": "Ibrahim2595",
          "committed_at": "2026-07-19T04:33:02Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "80fa04a3054d5d2a0b498fef9292ff31b19df921",
          "body": "Feat: Add CPEX plugin",
          "is_bot": false,
          "headline": "Merge pull request #493 from araujof/feat/cpex_plugin",
          "author_name": "Hai Huang",
          "author_login": "huang195",
          "committed_at": "2026-07-18T14:53:52Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "821160feb6326e5ff0745a90b6fd9c7c98e8089e",
          "body": "…cal APL syntax\n\nBumps the CPEX dependency from v0.2.0-alpha.2 to v0.2.2:\n  * CPEX_FFI_VERSION -> v0.2.2 (FFI ABI unchanged, still 2)\n  * github.com/contextforge-org/cpex/go/cpex v0.2.2 in authlib + the\n    authbridge-cpex module (go.mod/go.sum)\n\nv0.2.1 renamed the APL authz/authn config keys (break\n[…]\n policy cleanly, all 9\ndemo scenarios pass with identical authorization outcomes.\n\nAssisted-By: Claude (Anthropic AI) <noreply@anthropic.com>\nSigned-off-by: Frederico Araujo <frederico.araujo@ibm.com>",
          "is_bot": false,
          "headline": "build(cpex): bump CPEX to v0.2.2 and migrate hr demo policy to canoni…",
          "author_name": "Frederico Araujo",
          "author_login": "araujof",
          "committed_at": "2026-07-18T01:31:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "26740cf64e8b5715d395fd5ae735f29f3d41cfad",
          "body": "litellm 1.83.10 (the previous pin) is flagged by two newer advisories that\nfail the PR dependency-review gate (fail-on-severity: moderate):\n\n  * GHSA-4xpc-pv4p-pm3w — authentication bypass via Host header injection\n    (critical; vulnerable < 1.84.0)\n  * GHSA-qrc4-49gv-mv9m — internal_user can creat\n[…]\nlitellm advisory), consistent with the file's lowest-safe-release pin\nconvention.\n\nAssisted-By: Claude (Anthropic AI) <noreply@anthropic.com>\nSigned-off-by: Frederico Araujo <frederico.araujo@ibm.com>",
          "is_bot": false,
          "headline": "fix(cpex): bump litellm to 1.84.0 to clear dependency-review vulns",
          "author_name": "Frederico Araujo",
          "author_login": "araujof",
          "committed_at": "2026-07-17T21:28:25Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d68cdc741e0c01dfe8dac4e580f58cce445bb586",
          "body": "Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>\n\n# Conflicts:\n#\tCLAUDE.md\n#\tauthbridge/CLAUDE.md\n#\tauthbridge/authlib/go.mod\n#\tauthbridge/authlib/go.sum\n#\tauthbridge/cmd/authbridge-envoy/go.mod\n#\tauthbridge/cmd/authbridge-lite/go.mod\n#\tauthbridge/cmd/authbridge-proxy/go.mod\n#\tauthbridge/go.work",
          "is_bot": false,
          "headline": "Merge remote-tracking branch 'origin/main' into feat/cpex_plugin",
          "author_name": "Frederico Araujo",
          "author_login": "araujof",
          "committed_at": "2026-07-17T21:24:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "df01b1b20a6a89258011819ee8d3f00516af7de6",
          "body": "Docs: Add AIAC specification documents",
          "is_bot": false,
          "headline": "Merge pull request #661 from s-and-p-team/aiac-specs",
          "author_name": "oblinder",
          "author_login": "oblinder",
          "committed_at": "2026-07-16T13:28:52Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "de7084ba0a4a02611a8bc2d63d0e17a418a57bcb",
          "body": "Signed-off-by: Oleg Blinder <olegb@il.ibm.com>\n(cherry picked from commit 65b97adc29abc40b44c96159a808a01d3ed80461)",
          "is_bot": false,
          "headline": "docs: fix dangling issue link and gh-issues/ naming inconsistency",
          "author_name": "Oleg Blinder",
          "author_login": "oblinder",
          "committed_at": "2026-07-16T13:25:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e8502c9748c79a4c98e6acfc90d6c38d2f649585",
          "body": "Signed-off-by: Oleg Blinder <olegb@il.ibm.com>\n(cherry picked from commit 35fea8e9a69d20661d8a8038444b5931d9419b31)",
          "is_bot": false,
          "headline": "docs: fix Policy Store import to use explicit submodule path",
          "author_name": "Oleg Blinder",
          "author_login": "oblinder",
          "committed_at": "2026-07-16T13:25:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "87fbe004c4bbf2cdc38687da3f8efa64c5f48209",
          "body": "(cherry picked from commit d7d5d3fa762c5a95bbce0af2604f1b48cc58dbcb)\nSigned-off-by: Oleg Blinder <oblinder@gmail.com>",
          "is_bot": false,
          "headline": "docs: fix deprecated PDP policy library import path in OPA writer doc",
          "author_name": "Oleg Blinder",
          "author_login": "oblinder",
          "committed_at": "2026-07-16T13:25:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2e69d3d53cfef5e65e8afbe8d04caa628ba3f1be",
          "body": "(cherry picked from commit a511c6fd40d4821f09e87c2b2041f0ac4fd29013)\nSigned-off-by: Oleg Blinder <oblinder@gmail.com>",
          "is_bot": false,
          "headline": "docs: fix PDP Policy Writer service name inconsistency",
          "author_name": "Oleg Blinder",
          "author_login": "oblinder",
          "committed_at": "2026-07-16T13:25:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4e563acabf67477a3d06572b07ee0d69f3a3f422",
          "body": "OPA is the PDP and returns an allow/deny decision or entitlements; it\ndoes not mint OAuth tokens. Token issuance under RFC 8693 is Keycloak's\nrole as authorization server, initiated by AuthBridge as PEP.\n\nSigned-off-by: Oleg Blinder <olegb@il.ibm.com>\n(cherry picked from commit 2c8df4d97de89573558e60789b25cde955ab79f1)",
          "is_bot": false,
          "headline": "docs: fix OPA/token-issuance conflation in architecture summary and PRD",
          "author_name": "Oleg Blinder",
          "author_login": "oblinder",
          "committed_at": "2026-07-16T13:25:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2f9731f15fa02ae65feda9121c787825a783e07e",
          "body": "(cherry picked from commit dac6b0811d43628edd0d57747ce4259d27f83245)\nSigned-off-by: Oleg Blinder <oblinder@gmail.com>",
          "is_bot": false,
          "headline": "docs: fix broken heading anchor and relative link depth",
          "author_name": "Oleg Blinder",
          "author_login": "oblinder",
          "committed_at": "2026-07-16T13:25:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "81914bdb113bcfc9fd471ccba804d3bb3ddf0358",
          "body": "(cherry picked from commit 634c42d788e9e2c7e5fad7aa18dc146fb9897210)\nSigned-off-by: Oleg Blinder <oblinder@gmail.com>",
          "is_bot": false,
          "headline": "docs: fix component naming inconsistency (IdP Configuration Service)",
          "author_name": "Oleg Blinder",
          "author_login": "oblinder",
          "committed_at": "2026-07-16T13:25:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "39bca8e2c421307be7ed3b1e3bd1533f1b2526fc",
          "body": "…equisites\n\n§7 Deployment:\n- Add protocol.kagenti.io/a2a label requirement on both Deployment metadata.labels\n  and pod template; explain it gates AgentCardSyncReconciler.shouldSyncWorkload()\n  (operator stamps kagenti.io/type=agent but not the protocol label)\n- Replace single Service port 8080→8000\n[…]\nlways takes Ports[0])\n\n§8 Verification step 8: add AgentCard CR auto-creation check\n\nSigned-off-by: Oleg Blinder <olegb@il.ibm.com>\n(cherry picked from commit dd5691b0c08a78c07898e4ee5b96b2dcbd147cab)",
          "is_bot": false,
          "headline": "docs(demo): update github-agent spec for AgentCard auto-creation prer…",
          "author_name": "Oleg Blinder",
          "author_login": "oblinder",
          "committed_at": "2026-07-16T13:25:41Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4d5619c875c96a8d3201ad7c2e0e838b836743e6",
          "body": "Import the AIAC PRD and per-component specs under aiac/docs/specs/ as the basis for the upstream contribution.\n\nAssisted-By: Claude (Anthropic AI) <noreply@anthropic.com>\nSigned-off-by: Oleg Blinder <olegb@il.ibm.com>\n(cherry picked from commit a81869a862b75cb4404b89131f010e1761e6d101)",
          "is_bot": false,
          "headline": "Docs: Add AIAC specification documents",
          "author_name": "Oleg Blinder",
          "author_login": "oblinder",
          "committed_at": "2026-07-16T13:25:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1da84e281d67d208ed1844085bcac1f94cc3e21f",
          "body": "Fix: Forward-proxy streams SSE responses without a StreamingResponder",
          "is_bot": false,
          "headline": "Merge pull request #675 from huang195/fix/forwardproxy-sse-passthrough",
          "author_name": "Hai Huang",
          "author_login": "huang195",
          "committed_at": "2026-07-16T12:07:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f8a34c7d6833c25a0e280fe5b7f41a6d9553b5b5",
          "body": "build(deps): Bump opa to 1.18.2 and pin oras-go to patched 2.6.2",
          "is_bot": false,
          "headline": "Merge pull request #674 from pdettori/build/bump-opa-oras-640",
          "author_name": "Hai Huang",
          "author_login": "huang195",
          "committed_at": "2026-07-16T12:06:48Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e2314be6681ec805b63d40fcf26ce398c6230b13",
          "body": "A plugin that declares ReadsBody but is not a StreamingResponder falls\ninto streamPassthrough, where its OnResponse runs against an empty\npctx.ResponseBody (the stream is forwarded unbuffered to avoid the #642\ntimeout). Emit a slog.Warn -- mirroring the existing WritesBody fallback\n-- so the misconf\n[…]\ntim, OnResponse sees an empty body, and the warning\nfires.\n\nAddresses review feedback on #675.\n\nAssisted-By: Claude (Anthropic AI) <noreply@anthropic.com>\nSigned-off-by: Hai Huang <huang195@gmail.com>",
          "is_bot": false,
          "headline": "fix: warn when a ReadsBody plugin lands in SSE passthrough",
          "author_name": "Hai Huang",
          "author_login": "huang195",
          "committed_at": "2026-07-16T12:00:01Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ee2f0ee7e37cbfa8af9296f734af757f5ba4fdd9",
          "body": "Bundles Dependabot's opa 1.4.2 -> 1.18.2 bump (#640) with an explicit\noras.land/oras-go/v2 v2.6.2 pin to avoid the high-severity transitive\nadvisory GHSA-fxhp-mv3v-67qp (oras-go tar hardlink extraction escape),\nwhich opa 1.18.2 otherwise pulls in via oras-go 2.6.1 and which fails\nthe Dependency Revi\n[…]\nesolves to 2.6.2 in all\nmodules with no residual 2.5.0/2.6.1.\n\nSupersedes and closes #640.\n\nAssisted-By: Claude (Anthropic AI) <noreply@anthropic.com>\nSigned-off-by: Paolo Dettori <dettori@us.ibm.com>",
          "is_bot": false,
          "headline": "build(deps): Bump opa to 1.18.2 and pin oras-go to patched 2.6.2",
          "author_name": "Paolo Dettori",
          "author_login": "pdettori",
          "committed_at": "2026-07-16T02:14:06Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e2395a536cc13cdb5794348c9c0038c8b074642f",
          "body": "streamPassthrough previously skipped RunResponse (matching\nhandleStreamingResponse), which silently bypassed header/status response\ngates on SSE responses — e.g. opa's response-phase deny and\nlitellm-budgettrack's cost accounting would not run for a streamed\nresponse.\n\nRun RunResponse before the fir\n[…]\n, and a non-denying header-level OnResponse still runs while the\nstream is delivered verbatim.\n\nAssisted-By: Claude (Anthropic AI) <noreply@anthropic.com>\nSigned-off-by: Hai Huang <huang195@gmail.com>",
          "is_bot": false,
          "headline": "Fix: run response-phase pipeline before SSE passthrough streaming",
          "author_name": "Hai Huang",
          "author_login": "huang195",
          "committed_at": "2026-07-16T01:19:12Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ec2fb7e3e6ed48a70a6bdadbf95348ff48253718",
          "body": "The forward proxy only took its flushing SSE path (handleStreamingResponse)\nwhen a StreamingResponder plugin was configured. A plain pipeline (e.g. just\ntoken-exchange) fell through to an unflushed io.Copy, so intermittent SSE\nevents from an MCP server never reached the agent until the upstream clos\n[…]\ns\ndelivered before the upstream closes and that event:/id:/data: survive\nverbatim.\n\nFixes #642\n\nAssisted-By: Claude (Anthropic AI) <noreply@anthropic.com>\nSigned-off-by: Hai Huang <huang195@gmail.com>",
          "is_bot": false,
          "headline": "Fix: forward-proxy streams SSE responses without a StreamingResponder",
          "author_name": "Hai Huang",
          "author_login": "huang195",
          "committed_at": "2026-07-16T00:55:44Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "10d15752e1b04394069c258c9f811d80f50ee386",
          "body": "build(deps): Bump authlib deps and tidy dependent modules",
          "is_bot": false,
          "headline": "Merge pull request #673 from kagenti/build/bundle-authlib-deps",
          "author_name": "Hai Huang",
          "author_login": "huang195",
          "committed_at": "2026-07-16T00:16:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ae1f7e48b0de1095d187842c5dd233b1719aa0ba",
          "body": "Bundles Dependabot PRs #638, #639, #670, #541 into a single update:\n\n- github.com/lestrrat-go/jwx/v2 2.1.6 -> 2.1.7 (#638)\n- google.golang.org/grpc 1.81.1 -> 1.82.0 (#639)\n- golang.org/x/net 0.56.0 -> 0.57.0 (#670)\n- github.com/spiffe/go-spiffe/v2 2.6.0 -> 2.8.1 (#541)\n\nThe authbridge-envoy and auth\n[…]\npdates to go.mod needed; go mod tidy').\nThis bundle runs go mod tidy in all three modules.\n\nAssisted-By: Claude (Anthropic AI) <noreply@anthropic.com>\nSigned-off-by: Paolo Dettori <dettori@us.ibm.com>",
          "is_bot": false,
          "headline": "build(deps): Bump authlib deps and tidy dependent modules",
          "author_name": "Paolo Dettori",
          "author_login": "pdettori",
          "committed_at": "2026-07-15T23:08:37Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6f75bc95ce05aaebd1142b3f4da2a52adbddbf5c",
          "body": "…1.3.5\n\nbuild(deps): Bump langchain-openai from 1.3.4 to 1.3.5",
          "is_bot": false,
          "headline": "Merge pull request #669 from kagenti/dependabot/pip/langchain-openai-…",
          "author_name": "Paolo Dettori",
          "author_login": "pdettori",
          "committed_at": "2026-07-15T23:06:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e48e2691d718546b5bcb3fa13949fcf780b3aaab",
          "body": "build(deps): Bump langgraph from 1.2.5 to 1.2.9",
          "is_bot": false,
          "headline": "Merge pull request #667 from kagenti/dependabot/pip/langgraph-1.2.9",
          "author_name": "Paolo Dettori",
          "author_login": "pdettori",
          "committed_at": "2026-07-15T23:06:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a0bdcd27b57316e2e70bf67ce11068b3ddc6af08",
          "body": "…/cmd/authbridge-envoy/google.golang.org/grpc-1.82.0\n\nbuild(deps): Bump google.golang.org/grpc from 1.81.1 to 1.82.0 in /authbridge/cmd/authbridge-envoy",
          "is_bot": false,
          "headline": "Merge pull request #637 from kagenti/dependabot/go_modules/authbridge…",
          "author_name": "Paolo Dettori",
          "author_login": "pdettori",
          "committed_at": "2026-07-15T23:06:05Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a1b9ec236f4c4e5b2399dcf5cb95aaf1699738d3",
          "body": "…/codeql-action/autobuild-4.37.0\n\nbuild(deps): Bump github/codeql-action/init, autobuild, analyze from 4.36.3 to 4.37.0",
          "is_bot": false,
          "headline": "Merge pull request #666 from kagenti/dependabot/github_actions/github…",
          "author_name": "Evaline Ju",
          "author_login": "evaline-ju",
          "committed_at": "2026-07-15T19:23:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "05182fdde98f24d56eaf7f9891c7077f7e1909de",
          "body": "…/codeql-action/upload-sarif-4.37.0\n\nbuild(deps): Bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.0",
          "is_bot": false,
          "headline": "Merge pull request #662 from kagenti/dependabot/github_actions/github…",
          "author_name": "Evaline Ju",
          "author_login": "evaline-ju",
          "committed_at": "2026-07-15T19:22:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f580db679290b4971c6e1758d529d33eec2c3221",
          "body": "…lowups\n\nFix: Address context-guru plugin review feedback (#660)",
          "is_bot": false,
          "headline": "Merge pull request #672 from OsherElhadad/fix/context-guru-review-fol…",
          "author_name": "Hai Huang",
          "author_login": "huang195",
          "committed_at": "2026-07-15T17:55:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5b7f89ff19b7b3cc996a91d5c5e2201ce1ee45f1",
          "body": "Follow-up to the merged context-guru plugin (#660), addressing the\nnon-blocking review comments from @mrsabath and @huang195.\n\nPlugin (authlib/plugins/contextguru):\n- OnRequest now skips compaction when there is no session identity\n  instead of falling back to an empty (\"\") engine-store key, which\n \n[…]\ns generated demo Dockerfile.\n\nAssisted-By: Claude (Anthropic AI) <noreply@anthropic.com>\nSigned-off-by: Osher-Elhadad <Osher.Elhadad@ibm.com>\nAssisted-By: Claude (Anthropic AI) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Fix: Address context-guru plugin review feedback (#660)",
          "author_name": "Osher-Elhadad",
          "author_login": null,
          "committed_at": "2026-07-15T15:39:38Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "cb7f5eb2c7caac6a6768551a6ab4708ba2055079",
          "body": "Signed-off-by: Evaline Ju <69598118+evaline-ju@users.noreply.github.com>",
          "is_bot": false,
          "headline": ":arrow_up: Bump codeql init and analyze from 4.36.3 to 4.37.0",
          "author_name": "Evaline Ju",
          "author_login": "evaline-ju",
          "committed_at": "2026-07-14T15:33:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "468386ddeb9dbdaee68270c668dda10b0e2a519f",
          "body": "…s/setup-python-6.3.0\n\nbuild(deps): Bump actions/setup-python from 6.2.0 to 6.3.0",
          "is_bot": false,
          "headline": "Merge pull request #663 from kagenti/dependabot/github_actions/action…",
          "author_name": "Evaline Ju",
          "author_login": "evaline-ju",
          "committed_at": "2026-07-14T15:30:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "97522f8fa25ac6060ede4cff6652a190819430fa",
          "body": "…/metadata-action-6.2.0\n\nbuild(deps): Bump docker/metadata-action from 6.1.0 to 6.2.0",
          "is_bot": false,
          "headline": "Merge pull request #664 from kagenti/dependabot/github_actions/docker…",
          "author_name": "Evaline Ju",
          "author_login": "evaline-ju",
          "committed_at": "2026-07-14T15:30:05Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d192968258a4b27feeee2b2f31fa2a2eb7be1552",
          "body": "…/setup-qemu-action-4.2.0\n\nbuild(deps): Bump docker/setup-qemu-action from 4.1.0 to 4.2.0",
          "is_bot": false,
          "headline": "Merge pull request #665 from kagenti/dependabot/github_actions/docker…",
          "author_name": "Evaline Ju",
          "author_login": "evaline-ju",
          "committed_at": "2026-07-14T15:26:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d2453e3e35e475d05362eaa1ac60802ee9d0e43b",
          "body": "Bumps [langchain-openai](https://github.com/langchain-ai/langchain) from 1.3.4 to 1.3.5.\n- [Release notes](https://github.com/langchain-ai/langchain/releases)\n- [Commits](https://github.com/langchain-ai/langchain/compare/langchain-openai==1.3.4...langchain-openai==1.3.5)\n\n---\nupdated-dependencies:\n- dependency-name: langchain-openai\n  dependency-version: 1.3.5\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): Bump langchain-openai from 1.3.4 to 1.3.5",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-14T05:38:20Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "350c59901771a612b9a2940e8a9d91d2c2b974c1",
          "body": "Bumps [langgraph](https://github.com/langchain-ai/langgraph) from 1.2.5 to 1.2.9.\n- [Release notes](https://github.com/langchain-ai/langgraph/releases)\n- [Commits](https://github.com/langchain-ai/langgraph/compare/1.2.5...1.2.9)\n\n---\nupdated-dependencies:\n- dependency-name: langgraph\n  dependency-version: 1.2.9\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): Bump langgraph from 1.2.5 to 1.2.9",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-14T05:38:08Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7150c780fc6eadd72a7d9d4615f43c581fe66fe9",
          "body": null,
          "is_bot": false,
          "headline": "Merge pull request #668 from kagenti/dependabot/pip/langchain-core-1.4.9",
          "author_name": "Evaline Ju",
          "author_login": "evaline-ju",
          "committed_at": "2026-07-14T05:36:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ba42597046887b939366699349e2c24cb0d5570e",
          "body": "Bumps [langchain-core](https://github.com/langchain-ai/langchain) from 1.4.8 to 1.4.9.\n- [Release notes](https://github.com/langchain-ai/langchain/releases)\n- [Commits](https://github.com/langchain-ai/langchain/compare/langchain-core==1.4.8...langchain-core==1.4.9)\n\n---\nupdated-dependencies:\n- dependency-name: langchain-core\n  dependency-version: 1.4.9\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): Bump langchain-core from 1.4.8 to 1.4.9",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-13T23:14:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f7e22f7c42cb280e707b1151ed1a80095cfae5de",
          "body": "Bumps [github/codeql-action/autobuild](https://github.com/github/codeql-action) from 4.36.3 to 4.37.0.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action\n[…]\nme: github/codeql-action/autobuild\n  dependency-version: 4.37.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): Bump github/codeql-action/autobuild from 4.36.3 to 4.37.0",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-13T23:14:19Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a5aae841310047d3dfa8e60d77efe213aa472a76",
          "body": "Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 4.1.0 to 4.2.0.\n- [Release notes](https://github.com/docker/setup-qemu-action/releases)\n- [Commits](https://github.com/docker/setup-qemu-action/compare/06116385d9baf250c9f4dcb4858b16962ea869c3...96fe6ef7f33517b61c61be\n[…]\nency-name: docker/setup-qemu-action\n  dependency-version: 4.2.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): Bump docker/setup-qemu-action from 4.1.0 to 4.2.0",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-13T23:14:09Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3bca67aab395f6f036f23a8875e62b22ab8f7bc0",
          "body": "Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 6.1.0 to 6.2.0.\n- [Release notes](https://github.com/docker/metadata-action/releases)\n- [Commits](https://github.com/docker/metadata-action/compare/80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9...dc802804100637a589fabce1cb79ff\n[…]\nndency-name: docker/metadata-action\n  dependency-version: 6.2.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): Bump docker/metadata-action from 6.1.0 to 6.2.0",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-13T23:14:07Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "305b8b2f12e495a09067bc9e11f1506a9663b136",
          "body": "Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.2.0 to 6.3.0.\n- [Release notes](https://github.com/actions/setup-python/releases)\n- [Commits](https://github.com/actions/setup-python/compare/a309ff8b426b58ec0e2a45f0f869d46889d02405...ece7cb06caefa5fff74198d8649806c4678c61\n[…]\npendency-name: actions/setup-python\n  dependency-version: 6.3.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): Bump actions/setup-python from 6.2.0 to 6.3.0",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-13T23:14:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "563405c00ef26d99086633967999239c88229724",
          "body": "Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.36.2 to 4.37.0.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-act\n[…]\n github/codeql-action/upload-sarif\n  dependency-version: 4.37.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): Bump github/codeql-action/upload-sarif",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-13T23:14:00Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b5c165c08501e30d7d9ed845d1fb38384fee0130",
          "body": "Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.81.1 to 1.82.0.\n- [Release notes](https://github.com/grpc/grpc-go/releases)\n- [Commits](https://github.com/grpc/grpc-go/compare/v1.81.1...v1.82.0)\n\n---\nupdated-dependencies:\n- dependency-name: google.golang.org/grpc\n  dependency-version: 1.82.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): Bump google.golang.org/grpc",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-13T19:10:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f5e147f0d8f44428c095ff5686482953db365685",
          "body": "Feat: context-guru context-engineering plugin + demo",
          "is_bot": false,
          "headline": "Merge pull request #660 from OsherElhadad/feat/context-guru-plugin",
          "author_name": "Hai Huang",
          "author_login": "huang195",
          "committed_at": "2026-07-13T19:08:32Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9c131eebf8f216364f05de2e27c7a73ae826b559",
          "body": "Feat: add static-inject AuthBridge plugin for static credential injection",
          "is_bot": false,
          "headline": "Merge pull request #655 from pdettori/feat/static-inject-plugin",
          "author_name": "Paolo Dettori",
          "author_login": "pdettori",
          "committed_at": "2026-07-13T18:42:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "adf5d2afc8ef2332eae4b2be02cdeecd1e6f6a0a",
          "body": "ReadCredentialFile trims a whitespace-only secret file to \"\" and returns\nok, and an inline mapping value may be \"\". The OnRequest guard only\nchecked !ok, so an empty credential was forwarded as \"Bearer \" (or an\nempty raw header) instead of denying. Add a value == \"\" guard alongside\n!ok and lock it i\n[…]\ng and a\nwhitespace-only secret file.\n\nAddresses review feedback from @huang195 on PR #655.\n\nAssisted-By: Claude (Anthropic AI) <noreply@anthropic.com>\nSigned-off-by: Paolo Dettori <dettori@us.ibm.com>",
          "is_bot": false,
          "headline": "fix: fail closed on empty resolved credential in static-inject",
          "author_name": "Paolo Dettori",
          "author_login": "pdettori",
          "committed_at": "2026-07-13T17:37:14Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "13d806275b58c9874874a344e3ed977041664db9",
          "body": "Add inject_header config option to staticInjectConfig so credentials\ncan be written to a header other than Authorization (e.g. x-api-key\nfor direct api.anthropic.com auth). Default remains 'Authorization',\npreserving byte-identical legacy behavior (Bearer scheme, Authorization\nnot deleted). Any othe\n[…]\n the inbound Authorization header so a stale\nplaceholder bearer never reaches the backend.\n\nAssisted-By: Claude (Anthropic AI) <noreply@anthropic.com>\nSigned-off-by: Paolo Dettori <dettori@us.ibm.com>",
          "is_bot": false,
          "headline": "feat: static-inject configurable inject_header for x-api-key",
          "author_name": "Paolo Dettori",
          "author_login": "pdettori",
          "committed_at": "2026-07-13T17:37:14Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "201ecb71955989a7c7e96924561a9d8d92e5313f",
          "body": "…t, wantErr asserts)\n\nAssisted-By: Claude (Anthropic AI) <noreply@anthropic.com>\nSigned-off-by: Paolo Dettori <dettori@us.ibm.com>",
          "is_bot": false,
          "headline": "test: strengthen static-inject tests (unsafe-value deny, atomic-commi…",
          "author_name": "Paolo Dettori",
          "author_login": "pdettori",
          "committed_at": "2026-07-13T17:37:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2bc3ba8472b788ed6069d62c6bbe8d8c1613ecf8",
          "body": "…tion\n\nAssisted-By: Claude (Anthropic AI) <noreply@anthropic.com>\nSigned-off-by: Paolo Dettori <dettori@us.ibm.com>",
          "is_bot": false,
          "headline": "feat: add static-inject AuthBridge plugin for static credential injec…",
          "author_name": "Paolo Dettori",
          "author_login": "pdettori",
          "committed_at": "2026-07-13T17:37:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "aeeac627a6a8e08657ae44a5f4ad3b359bde8b06",
          "body": "Add context-guru as an in-process AuthBridge outbound plugin that compacts an\nagent's LLM request context (tool outputs) before it is forwarded upstream, plus\na runnable end-to-end demo on Kagenti.\n\n- authlib/plugins/contextguru: OnRequest compaction via apply.BodyWithModel +\n  SetBody; slog logging\n[…]\nockerfile\nbuilders moved to golang:1.26-alpine (digest-pinned).\n\nRelates to #659, #641.\n\nAssisted-By: Claude (Anthropic AI) <noreply@anthropic.com>\nSigned-off-by: Osher-Elhadad <Osher.Elhadad@ibm.com>",
          "is_bot": false,
          "headline": "Feat: context-guru context-engineering plugin + demo",
          "author_name": "Osher-Elhadad",
          "author_login": null,
          "committed_at": "2026-07-13T16:02:20Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d17993f509e34e6926044626f1de5c0c36c02d89",
          "body": "…e-fidelity\n\nFix reverse-proxy SSE/streaming fidelity (event: lines, gzip, header propagation, Host)",
          "is_bot": false,
          "headline": "Merge pull request #657 from pdettori/fix/authbridge-reverse-proxy-ss…",
          "author_name": "Paolo Dettori",
          "author_login": "pdettori",
          "committed_at": "2026-07-13T15:42:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "fe2ad3bf481343f38973ee9c8a8220627d9f2cd5",
          "body": "…elines\n\nThe Director stripped the client's Accept-Encoding on every request, but\nplaintext is only required when a plugin actually inspects the response\nbody — a StreamingResponder (SSE re-framing) or any ReadsBody/WritesBody\nplugin (buffered read into pctx.ResponseBody). For a pure pass-through\npr\n[…]\nroxy_PreservesAcceptEncoding_PassThrough asserting an empty\npipeline preserves the header.\n\nAssisted-By: Claude (Anthropic AI) <noreply@anthropic.com>\nSigned-off-by: Paolo Dettori <dettori@us.ibm.com>",
          "is_bot": false,
          "headline": "fix: scope reverse-proxy Accept-Encoding strip to body-inspecting pip…",
          "author_name": "Paolo Dettori",
          "author_login": "pdettori",
          "committed_at": "2026-07-13T15:36:31Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3c86aac3b665fb24a5783ee68b9dbfa6ea272686",
          "body": "…oxy streaming\n\nAssisted-By: Claude (Anthropic AI) <noreply@anthropic.com>\nSigned-off-by: Paolo Dettori <dettori@us.ibm.com>",
          "is_bot": false,
          "headline": "fix: preserve SSE event: line and strip Accept-Encoding in reverse-pr…",
          "author_name": "Paolo Dettori",
          "author_login": "pdettori",
          "committed_at": "2026-07-11T18:14:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0cd7379dd69286e1138738911de5a48d32eff3c0",
          "body": "The reverse proxy only propagated an Authorization mutation from the\ninbound pipeline's pctx.Headers back onto the forwarded request. A\nplugin like static-inject that sets x-api-key and deletes Authorization\nhad the x-api-key addition silently dropped and the deleted Authorization\nstill forwarded, s\n[…]\non-mint regression test\n(TestInboundPropagation_RewrittenAuthReachesBackend) still passes.\n\nAssisted-By: Claude (Anthropic AI) <noreply@anthropic.com>\nSigned-off-by: Paolo Dettori <dettori@us.ibm.com>",
          "is_bot": false,
          "headline": "fix: reverse proxy forwards all inbound header mutations to backend",
          "author_name": "Paolo Dettori",
          "author_login": "pdettori",
          "committed_at": "2026-07-11T18:14:21Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "37ccfdd0f691a5bbee58a05a9c5cd913be17b88f",
          "body": "The default httputil.SingleHostReverseProxy Director rewrites the\noutbound URL scheme/host/path but deliberately leaves req.Host as the\ninbound caller's Host (e.g. authbridge-ab1:8080). Cloudflare-fronted\nbackends like api.anthropic.com validate Host against the request\nline and reject the mismatch,\n[…]\nting Director to set req.Host to the backend target's\nhost after the default rewrite runs.\n\nAssisted-By: Claude (Anthropic AI) <noreply@anthropic.com>\nSigned-off-by: Paolo Dettori <dettori@us.ibm.com>",
          "is_bot": false,
          "headline": "fix: rewrite outbound Host header in reverse-proxy Director",
          "author_name": "Paolo Dettori",
          "author_login": "pdettori",
          "committed_at": "2026-07-11T18:14:21Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "78311683b9c0545275d95159e3db46a6b7cadea6",
          "body": "Feat: litellm-budget-track plugin for daily spend enforcement",
          "is_bot": false,
          "headline": "Merge pull request #654 from aslom/litellm_budgettrack_plugin",
          "author_name": "Hai Huang",
          "author_login": "huang195",
          "committed_at": "2026-07-10T13:55:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4258df820e8f2183668309fdf1417bb5dcc77dc1",
          "body": "Describes the AuthBridge inbound pipeline plugin that enforces daily\nspending budgets by reading x-litellm-response-cost headers from\nLiteLLM upstream responses. Used by RossoCortex for per-agent budget\nenforcement on CONNECT-tunneled traffic.\n\nRelates to kagenti/kagenti#2177\n\nAssisted-By: Claude (Anthropic AI) <noreply@anthropic.com>\nSigned-off-by: Aleksander Slominski <aslom@us.ibm.com>",
          "is_bot": false,
          "headline": "Feat: litellm-budget-track plugin for daily spend enforcement",
          "author_name": "Aleksander Slominski",
          "author_login": "aslom",
          "committed_at": "2026-07-09T18:49:25Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5a6fa44ed35f201c810ba86f11986488863d2b2a",
          "body": "…1.3.3\n\nbuild(deps): Bump langchain-openai from 1.3.2 to 1.3.4",
          "is_bot": false,
          "headline": "Merge pull request #538 from kagenti/dependabot/pip/langchain-openai-…",
          "author_name": "Evaline Ju",
          "author_login": "evaline-ju",
          "committed_at": "2026-07-09T16:44:05Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5198922e92682771e26d11b7c0ac2d69b9671da9",
          "body": "Bumps [langchain-openai](https://github.com/langchain-ai/langchain) from 1.3.2 to 1.3.4.\n- [Release notes](https://github.com/langchain-ai/langchain/releases)\n- [Commits](https://github.com/langchain-ai/langchain/compare/langchain-openai==1.3.2...langchain-openai==1.3.4)\n\n---\nupdated-dependencies:\n- dependency-name: langchain-openai\n  dependency-version: 1.3.3\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): Bump langchain-openai from 1.3.2 to 1.3.4",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-09T16:36:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2b9972985541de6f0918d961a5c5eda1b42d457c",
          "body": "…-1.2.2\n\nbuild(deps): Update python-dotenv requirement from >=1 to >=1.2.2",
          "is_bot": false,
          "headline": "Merge pull request #540 from kagenti/dependabot/pip/python-dotenv-gte…",
          "author_name": "Evaline Ju",
          "author_login": "evaline-ju",
          "committed_at": "2026-07-09T16:35:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5c5b92c9b2be88f4f86657957cc3c82374799f41",
          "body": "build(deps): Bump langchain-core from 1.4.7 to 1.4.8",
          "is_bot": false,
          "headline": "Merge pull request #537 from kagenti/dependabot/pip/langchain-core-1.4.8",
          "author_name": "Evaline Ju",
          "author_login": "evaline-ju",
          "committed_at": "2026-07-09T16:34:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e56d00983c1c0422ec4970af4acb69ba4636e5ef",
          "body": "Docs: Quote curl command so that link is not rendered",
          "is_bot": false,
          "headline": "Merge pull request #649 from esnible/quote-curl-command",
          "author_name": "Ed Snible",
          "author_login": "esnible",
          "committed_at": "2026-07-09T15:24:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f7a99ad319c9754450d8062261c01958a6a7588c",
          "body": "Signed-off-by: Ed Snible <snible@us.ibm.com>",
          "is_bot": false,
          "headline": "Quote curl command so that link is not rendered",
          "author_name": "Ed Snible",
          "author_login": "esnible",
          "committed_at": "2026-07-09T13:20:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2e0fd6a71a1543d9e2b555f4b9bfc61c71f128c0",
          "body": "…s/setup-go-6.5.0\n\nbuild(deps): Bump actions/setup-go from 6.4.0 to 6.5.0",
          "is_bot": false,
          "headline": "Merge pull request #632 from kagenti/dependabot/github_actions/action…",
          "author_name": "Evaline Ju",
          "author_login": "evaline-ju",
          "committed_at": "2026-07-07T16:07:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e9e176bfccf7f654867ab89fabd33298aa143d76",
          "body": "…/codeql-action/analyze-4.36.3\n\nbuild(deps): Bump github/codeql-action/analyze from 4.36.2 to 4.36.3",
          "is_bot": false,
          "headline": "Merge pull request #636 from kagenti/dependabot/github_actions/github…",
          "author_name": "Evaline Ju",
          "author_login": "evaline-ju",
          "committed_at": "2026-07-07T16:05:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4f11805bab37d5008d8a31ff9b624dd872429d82",
          "body": "…lis/spellcheck-github-actions-0.63.0\n\nbuild(deps): Bump rojopolis/spellcheck-github-actions from 0.62.0 to 0.63.0",
          "is_bot": false,
          "headline": "Merge pull request #631 from kagenti/dependabot/github_actions/rojopo…",
          "author_name": "Evaline Ju",
          "author_login": "evaline-ju",
          "committed_at": "2026-07-07T15:36:23Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "07ca8977cd38d490e7f4228b6b436d6af91f00d1",
          "body": "Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.36.2 to 4.36.3.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/comp\n[…]\ncy-name: github/codeql-action/init\n  dependency-version: 4.36.3\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): Bump github/codeql-action/init from 4.36.2 to 4.36.3",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-07T15:33:50Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "af3da6cb5d9a7e827029888e3a6fcd7261a1f995",
          "body": "Bumps [github/codeql-action/autobuild](https://github.com/github/codeql-action) from 4.36.2 to 4.36.3.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action\n[…]\nme: github/codeql-action/autobuild\n  dependency-version: 4.36.3\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): Bump github/codeql-action/autobuild from 4.36.2 to 4.36.3",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-07T15:33:43Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "0bfab37b5b678818a0a946ebdfa5d224de78dadb",
          "body": "Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.36.2 to 4.36.3.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/c\n[…]\nname: github/codeql-action/analyze\n  dependency-version: 4.36.3\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): Bump github/codeql-action/analyze from 4.36.2 to 4.36.3",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-06T23:14:43Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c330bbdfb79dfc532ccde9c3b43d9c94537c2da5",
          "body": "Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.4.0 to 6.5.0.\n- [Release notes](https://github.com/actions/setup-go/releases)\n- [Commits](https://github.com/actions/setup-go/compare/4a3601121dd01d1626a1e23e37211e3254c1c06c...924ae3a1cded613372ab5595356fb5720e22ba16)\n\n---\nupdated\n[…]\n- dependency-name: actions/setup-go\n  dependency-version: 6.5.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): Bump actions/setup-go from 6.4.0 to 6.5.0",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-06T23:14:16Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "332ec5e295063b7db97d92d651298512c371b53a",
          "body": "Bumps [rojopolis/spellcheck-github-actions](https://github.com/rojopolis/spellcheck-github-actions) from 0.62.0 to 0.63.0.\n- [Release notes](https://github.com/rojopolis/spellcheck-github-actions/releases)\n- [Changelog](https://github.com/rojopolis/spellcheck-github-actions/blob/master/CHANGELOG.md)\n[…]\nojopolis/spellcheck-github-actions\n  dependency-version: 0.63.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "build(deps): Bump rojopolis/spellcheck-github-actions",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-06T23:14:11Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "622ec72d4cc43dada82bb5e8d9237c9880354695",
          "body": "…xy-init/library/alpine-3.24\n\nbuild(deps): Bump library/alpine from 3.23 to 3.24 in /authbridge/proxy-init",
          "is_bot": false,
          "headline": "Merge pull request #517 from kagenti/dependabot/docker/authbridge/pro…",
          "author_name": "Evaline Ju",
          "author_login": "evaline-ju",
          "committed_at": "2026-07-02T21:00:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        }
      ],
      "releases_count": 29,
      "commits_last_year": 1599,
      "latest_release_at": "2026-07-29T20:36:47Z",
      "latest_release_tag": "v0.7.0-alpha.1",
      "releases_from_tags": false,
      "days_since_last_push": 0,
      "active_weeks_last_year": 39,
      "days_since_latest_release": 0,
      "mean_days_between_releases": 14.8
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": true,
      "health_percentage": 87,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": true
    },
    "ecosystem": {
      "packages": [
        {
          "name": "github.com/rossoctl/cortex",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": true,
          "registry_url": "https://pkg.go.dev/github.com/rossoctl/cortex",
          "is_deprecated": false,
          "latest_version": "v0.3.1",
          "repository_url": "https://github.com/rossoctl/cortex",
          "versions_count": 57,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-01-30T17:55:28Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 180
        }
      ]
    },
    "popularity": {
      "forks": 40,
      "stars": 10,
      "watchers": 2,
      "fork_history": {
        "days": [
          {
            "date": "2025-10-11",
            "count": 1
          },
          {
            "date": "2025-11-04",
            "count": 1
          },
          {
            "date": "2025-12-03",
            "count": 1
          },
          {
            "date": "2025-12-04",
            "count": 1
          },
          {
            "date": "2025-12-06",
            "count": 1
          },
          {
            "date": "2025-12-10",
            "count": 1
          },
          {
            "date": "2025-12-16",
            "count": 1
          },
          {
            "date": "2025-12-19",
            "count": 1
          },
          {
            "date": "2026-02-04",
            "count": 1
          },
          {
            "date": "2026-02-06",
            "count": 1
          },
          {
            "date": "2026-02-12",
            "count": 1
          },
          {
            "date": "2026-02-13",
            "count": 1
          },
          {
            "date": "2026-02-18",
            "count": 1
          },
          {
            "date": "2026-02-22",
            "count": 1
          },
          {
            "date": "2026-03-01",
            "count": 1
          },
          {
            "date": "2026-03-04",
            "count": 1
          },
          {
            "date": "2026-03-11",
            "count": 1
          },
          {
            "date": "2026-03-18",
            "count": 1
          },
          {
            "date": "2026-03-21",
            "count": 1
          },
          {
            "date": "2026-03-24",
            "count": 1
          },
          {
            "date": "2026-04-03",
            "count": 1
          },
          {
            "date": "2026-04-19",
            "count": 1
          },
          {
            "date": "2026-04-24",
            "count": 1
          },
          {
            "date": "2026-04-25",
            "count": 1
          },
          {
            "date": "2026-04-27",
            "count": 1
          },
          {
            "date": "2026-05-06",
            "count": 1
          },
          {
            "date": "2026-05-12",
            "count": 1
          },
          {
            "date": "2026-05-28",
            "count": 1
          },
          {
            "date": "2026-06-02",
            "count": 1
          },
          {
            "date": "2026-06-03",
            "count": 1
          },
          {
            "date": "2026-06-04",
            "count": 1
          },
          {
            "date": "2026-06-05",
            "count": 1
          },
          {
            "date": "2026-06-12",
            "count": 1
          },
          {
            "date": "2026-06-17",
            "count": 1
          },
          {
            "date": "2026-06-22",
            "count": 1
          },
          {
            "date": "2026-07-01",
            "count": 1
          },
          {
            "date": "2026-07-16",
            "count": 1
          },
          {
            "date": "2026-07-19",
            "count": 1
          },
          {
            "date": "2026-07-28",
            "count": 2
          }
        ],
        "complete": true,
        "collected": 40,
        "total_forks": 40
      },
      "star_history": null,
      "open_issues_and_prs": 54
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [
        "demos"
      ],
      "has_llms_txt": false,
      "has_dockerfile": true,
      "has_mcp_signal": false,
      "bootstrap_files": [
        "Makefile",
        "authbridge/demos/echo/Makefile",
        "authbridge/demos/finance-sparc/Makefile",
        "authbridge/demos/github-issue/aiac/Makefile",
        "authbridge/demos/github-issue/rbac/Makefile",
        "authbridge/demos/hr-cpex/Makefile",
        "authbridge/demos/ibac/Makefile",
        "authbridge/demos/mtls/Makefile",
        "authbridge/proxy-init/Makefile",
        "authbridge/sparc-service/deploy/Makefile"
      ],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [
        "authbridge/authlib/go.mod",
        "authbridge/cmd/abctl/go.mod",
        "authbridge/cmd/authbridge-cpex/go.mod",
        "authbridge/cmd/authbridge-envoy/go.mod",
        "authbridge/cmd/authbridge-proxy/go.mod",
        "authbridge/demos/echo/go.mod",
        "authbridge/demos/finance-sparc/go.mod",
        "authbridge/demos/ibac/go.mod"
      ],
      "largest_source_bytes": 60889,
      "source_files_sampled": 355,
      "oversized_source_files": 1,
      "agent_instruction_files": [
        "CLAUDE.md",
        "authbridge/CLAUDE.md"
      ],
      "agent_instruction_max_bytes": 46101
    },
    "dependencies": {
      "manifests": [
        "authbridge/requirements.txt",
        "pyproject.toml"
      ],
      "advisories": {
        "error": null,
        "scope": "repository_graph",
        "source": "osv",
        "findings": [
          {
            "name": "google.golang.org/grpc",
            "direct": true,
            "version": "v1.82.0",
            "severity": "critical",
            "ecosystem": "go",
            "cvss_score": 9.1,
            "advisory_ids": [
              "GHSA-hrxh-6v49-42gf",
              "GO-2026-6061"
            ],
            "fixed_version": "1.82.1",
            "advisory_count": 2,
            "oldest_advisory_days": 8
          },
          {
            "name": "github.com/klauspost/compress",
            "direct": false,
            "version": "v1.18.6",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5841"
            ],
            "fixed_version": "1.18.7",
            "advisory_count": 1,
            "oldest_advisory_days": 2
          },
          {
            "name": "golang.org/x/crypto",
            "direct": false,
            "version": "v0.54.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5932"
            ],
            "fixed_version": null,
            "advisory_count": 1,
            "oldest_advisory_days": 22
          }
        ],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {
          "unknown": 2,
          "critical": 1
        },
        "advisory_count": 4,
        "affected_count": 3,
        "assessed_count": 156,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 8,
        "direct_affected_count": 1
      },
      "ecosystems": [
        "pypi"
      ],
      "dependencies": [
        {
          "name": "github.com/contextforge-org/cpex/go/cpex",
          "manifest": "authbridge/authlib/go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.2.2"
        },
        {
          "name": "github.com/envoyproxy/go-control-plane/envoy",
          "manifest": "authbridge/authlib/go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.37.0"
        },
        {
          "name": "github.com/fsnotify/fsnotify",
          "manifest": "authbridge/authlib/go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.10.1"
        },
        {
          "name": "github.com/gobwas/glob",
          "manifest": "authbridge/authlib/go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.2.3"
        },
        {
          "name": "github.com/lestrrat-go/jwx/v2",
          "manifest": "authbridge/authlib/go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.1.7"
        },
        {
          "name": "github.com/maximhq/bifrost/core",
          "manifest": "authbridge/authlib/go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.7.0"
        },
        {
          "name": "github.com/open-policy-agent/opa",
          "manifest": "authbridge/authlib/go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.18.2"
        },
        {
          "name": "github.com/rossoctl/context-guru",
          "manifest": "authbridge/authlib/go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20260720181432-8fc7c7b36563"
        },
        {
          "name": "github.com/spiffe/go-spiffe/v2",
          "manifest": "authbridge/authlib/go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.8.1"
        },
        {
          "name": "golang.org/x/net",
          "manifest": "authbridge/authlib/go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.57.0"
        },
        {
          "name": "golang.org/x/sys",
          "manifest": "authbridge/authlib/go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.47.0"
        },
        {
          "name": "google.golang.org/genproto/googleapis/rpc",
          "manifest": "authbridge/authlib/go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20260526163538-3dc84a4a5aaa"
        },
        {
          "name": "google.golang.org/grpc",
          "manifest": "authbridge/authlib/go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.82.0"
        },
        {
          "name": "gopkg.in/yaml.v3",
          "manifest": "authbridge/authlib/go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.0.1"
        },
        {
          "name": "agent-lifecycle-toolkit",
          "manifest": "authbridge/sparc-service/pyproject.toml",
          "ecosystem": "pypi",
          "version_constraint": "==0.10.1"
        },
        {
          "name": "fastapi",
          "manifest": "authbridge/sparc-service/pyproject.toml",
          "ecosystem": "pypi",
          "version_constraint": ">=0.110"
        },
        {
          "name": "uvicorn",
          "manifest": "authbridge/sparc-service/pyproject.toml",
          "ecosystem": "pypi",
          "version_constraint": ">=0.27"
        },
        {
          "name": "pydantic",
          "manifest": "authbridge/sparc-service/pyproject.toml",
          "ecosystem": "pypi",
          "version_constraint": ">=2"
        }
      ],
      "all_dependencies": {
        "error": null,
        "source": "github-sbom",
        "packages": [
          {
            "name": "github.com/contextforge-org/cpex/go/cpex",
            "direct": true,
            "version": "v0.2.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/envoyproxy/go-control-plane/envoy",
            "direct": true,
            "version": "v1.37.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/fsnotify/fsnotify",
            "direct": true,
            "version": "v1.10.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/gobwas/glob",
            "direct": true,
            "version": "v0.2.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/lestrrat-go/jwx/v2",
            "direct": true,
            "version": "v2.1.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/maximhq/bifrost/core",
            "direct": true,
            "version": "v1.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/open-policy-agent/opa",
            "direct": true,
            "version": "v1.18.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/rossoctl/context-guru",
            "direct": true,
            "version": "v0.0.0-20260720181432-8fc7c7b36563",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spiffe/go-spiffe/v2",
            "direct": true,
            "version": "v2.8.1",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/net",
            "direct": true,
            "version": "v0.57.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sys",
            "direct": true,
            "version": "v0.47.0",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/genproto/googleapis/rpc",
            "direct": true,
            "version": "v0.0.0-20260526163538-3dc84a4a5aaa",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/grpc",
            "direct": true,
            "version": "v1.82.0",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/yaml.v3",
            "direct": true,
            "version": "v3.0.1",
            "ecosystem": "go"
          },
          {
            "name": "agent-lifecycle-toolkit",
            "direct": true,
            "version": "0.10.1",
            "ecosystem": "pypi"
          },
          {
            "name": "fastapi",
            "direct": true,
            "version": null,
            "ecosystem": "pypi"
          },
          {
            "name": "fastapi",
            "direct": true,
            "version": "0.136.3",
            "ecosystem": "pypi"
          },
          {
            "name": "pydantic",
            "direct": true,
            "version": null,
            "ecosystem": "pypi"
          },
          {
            "name": "pydantic",
            "direct": true,
            "version": "2.13.4",
            "ecosystem": "pypi"
          },
          {
            "name": "uvicorn",
            "direct": true,
            "version": null,
            "ecosystem": "pypi"
          },
          {
            "name": "uvicorn",
            "direct": true,
            "version": "0.32.0",
            "ecosystem": "pypi"
          },
          {
            "name": "github.com/agnivade/levenshtein",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/alexaandru/go-sitter-forest/c",
            "direct": false,
            "version": "v1.9.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/alexaandru/go-sitter-forest/c_sharp",
            "direct": false,
            "version": "v1.9.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/alexaandru/go-sitter-forest/cpp",
            "direct": false,
            "version": "v1.9.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/alexaandru/go-sitter-forest/go",
            "direct": false,
            "version": "v1.9.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/alexaandru/go-sitter-forest/java",
            "direct": false,
            "version": "v1.9.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/alexaandru/go-sitter-forest/javascript",
            "direct": false,
            "version": "v1.9.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/alexaandru/go-sitter-forest/kotlin",
            "direct": false,
            "version": "v1.9.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/alexaandru/go-sitter-forest/php",
            "direct": false,
            "version": "v1.9.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/alexaandru/go-sitter-forest/python",
            "direct": false,
            "version": "v1.9.10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/alexaandru/go-sitter-forest/ruby",
            "direct": false,
            "version": "v1.9.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/alexaandru/go-sitter-forest/rust",
            "direct": false,
            "version": "v1.9.13",
            "ecosystem": "go"
          },
          {
            "name": "github.com/alexaandru/go-sitter-forest/scala",
            "direct": false,
            "version": "v1.9.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/alexaandru/go-sitter-forest/swift",
            "direct": false,
            "version": "v1.9.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/alexaandru/go-sitter-forest/tsx",
            "direct": false,
            "version": "v1.9.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/alexaandru/go-sitter-forest/typescript",
            "direct": false,
            "version": "v1.9.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/andybalholm/brotli",
            "direct": false,
            "version": "v1.2.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/atotto/clipboard",
            "direct": false,
            "version": "v0.1.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/aymanbagabas/go-osc52/v2",
            "direct": false,
            "version": "v2.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bahlo/generic-list-go",
            "direct": false,
            "version": "v0.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/beorn7/perks",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/buger/jsonparser",
            "direct": false,
            "version": "v1.1.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bytecodealliance/wasmtime-go/v44",
            "direct": false,
            "version": "v44.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bytedance/gopkg",
            "direct": false,
            "version": "v0.1.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bytedance/sonic",
            "direct": false,
            "version": "v1.15.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/bytedance/sonic/loader",
            "direct": false,
            "version": "v0.5.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cespare/xxhash/v2",
            "direct": false,
            "version": "v2.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/bubbles",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/bubbletea",
            "direct": false,
            "version": "v1.3.10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/colorprofile",
            "direct": false,
            "version": "v0.4.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/lipgloss",
            "direct": false,
            "version": "v1.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/x/ansi",
            "direct": false,
            "version": "v0.11.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/x/cellbuf",
            "direct": false,
            "version": "v0.0.15",
            "ecosystem": "go"
          },
          {
            "name": "github.com/charmbracelet/x/term",
            "direct": false,
            "version": "v0.2.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/clipperhouse/displaywidth",
            "direct": false,
            "version": "v0.11.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/clipperhouse/uax29/v2",
            "direct": false,
            "version": "v2.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cloudwego/base64x",
            "direct": false,
            "version": "v0.1.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cncf/xds/go",
            "direct": false,
            "version": "v0.0.0-20260202195803-dba9d589def2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/davecgh/go-spew",
            "direct": false,
            "version": "v1.1.2-0.20180830191138-d8f796af33cc",
            "ecosystem": "go"
          },
          {
            "name": "github.com/decred/dcrd/dcrec/secp256k1/v4",
            "direct": false,
            "version": "v4.4.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/dlclark/regexp2",
            "direct": false,
            "version": "v1.11.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/envoyproxy/protoc-gen-validate",
            "direct": false,
            "version": "v1.3.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/erikgeiser/coninput",
            "direct": false,
            "version": "v0.0.0-20211004153227-1c3628e74d0f",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-jose/go-jose/v4",
            "direct": false,
            "version": "v4.1.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-logr/logr",
            "direct": false,
            "version": "v1.4.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-logr/stdr",
            "direct": false,
            "version": "v1.2.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/goccy/go-json",
            "direct": false,
            "version": "v0.10.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/uuid",
            "direct": false,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/hashicorp/golang-lru/v2",
            "direct": false,
            "version": "v2.0.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/huandu/go-clone",
            "direct": false,
            "version": "v1.7.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/huandu/go-sqlbuilder",
            "direct": false,
            "version": "v1.41.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/huandu/xstrings",
            "direct": false,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/invopop/jsonschema",
            "direct": false,
            "version": "v0.13.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/klauspost/compress",
            "direct": false,
            "version": "v1.18.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/klauspost/cpuid/v2",
            "direct": false,
            "version": "v2.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/kr/pretty",
            "direct": false,
            "version": "v0.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/lestrrat-go/blackmagic",
            "direct": false,
            "version": "v1.0.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/lestrrat-go/dsig",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/lestrrat-go/dsig-secp256k1",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/lestrrat-go/httpcc",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/lestrrat-go/httprc",
            "direct": false,
            "version": "v1.0.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/lestrrat-go/httprc/v3",
            "direct": false,
            "version": "v3.0.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/lestrrat-go/iter",
            "direct": false,
            "version": "v1.0.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/lestrrat-go/jwx/v3",
            "direct": false,
            "version": "v3.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/lestrrat-go/option",
            "direct": false,
            "version": "v1.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/lestrrat-go/option/v2",
            "direct": false,
            "version": "v2.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/lucasb-eyer/go-colorful",
            "direct": false,
            "version": "v1.4.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mailru/easyjson",
            "direct": false,
            "version": "v0.9.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mark3labs/mcp-go",
            "direct": false,
            "version": "v0.43.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-isatty",
            "direct": false,
            "version": "v0.0.20",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-localereader",
            "direct": false,
            "version": "v0.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-pointer",
            "direct": false,
            "version": "v0.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-runewidth",
            "direct": false,
            "version": "v0.0.23",
            "ecosystem": "go"
          },
          {
            "name": "github.com/microsoft/go-winio",
            "direct": false,
            "version": "v0.6.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/muesli/ansi",
            "direct": false,
            "version": "v0.0.0-20230316100256-276c6243b2f6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/muesli/cancelreader",
            "direct": false,
            "version": "v0.2.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/muesli/termenv",
            "direct": false,
            "version": "v0.16.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/munnerz/goautoneg",
            "direct": false,
            "version": "v0.0.0-20191010083416-a7dc8b61c822",
            "ecosystem": "go"
          },
          {
            "name": "github.com/opencontainers/go-digest",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/opencontainers/image-spec",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/planetscale/vtprotobuf",
            "direct": false,
            "version": "v0.6.1-0.20240319094008-0393e58bdf10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/pmezard/go-difflib",
            "direct": false,
            "version": "v1.0.1-0.20181226105442-5d4384ee4fb2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/prometheus/client_golang",
            "direct": false,
            "version": "v1.23.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/prometheus/client_model",
            "direct": false,
            "version": "v0.6.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/prometheus/common",
            "direct": false,
            "version": "v0.67.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/prometheus/procfs",
            "direct": false,
            "version": "v0.20.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/rcrowley/go-metrics",
            "direct": false,
            "version": "v0.0.0-20250401214520-65e299d6c5c9",
            "ecosystem": "go"
          },
          {
            "name": "github.com/rivo/uniseg",
            "direct": false,
            "version": "v0.4.7",
            "ecosystem": "go"
          },
          {
            "name": "github.com/rogpeppe/go-internal",
            "direct": false,
            "version": "v1.15.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/segmentio/asm",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/sirupsen/logrus",
            "direct": false,
            "version": "v1.9.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/spf13/cast",
            "direct": false,
            "version": "v1.10.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tchap/go-patricia/v2",
            "direct": false,
            "version": "v2.3.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tidwall/gjson",
            "direct": false,
            "version": "v1.18.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tidwall/match",
            "direct": false,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tidwall/pretty",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tidwall/sjson",
            "direct": false,
            "version": "v1.2.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tiktoken-go/tokenizer",
            "direct": false,
            "version": "v0.7.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tree-sitter/go-tree-sitter",
            "direct": false,
            "version": "v0.25.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/twitchyliquid64/golang-asm",
            "direct": false,
            "version": "v0.15.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/valyala/bytebufferpool",
            "direct": false,
            "version": "v1.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/valyala/fasthttp",
            "direct": false,
            "version": "v1.71.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/valyala/fastjson",
            "direct": false,
            "version": "v1.6.10",
            "ecosystem": "go"
          },
          {
            "name": "github.com/vektah/gqlparser/v2",
            "direct": false,
            "version": "v2.5.34",
            "ecosystem": "go"
          },
          {
            "name": "github.com/vmihailenco/msgpack/v5",
            "direct": false,
            "version": "v5.4.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/vmihailenco/tagparser/v2",
            "direct": false,
            "version": "v2.0.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/wk8/go-ordered-map/v2",
            "direct": false,
            "version": "v2.1.8",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xeipuuv/gojsonpointer",
            "direct": false,
            "version": "v0.0.0-20190905194746-02993c407bfb",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xeipuuv/gojsonreference",
            "direct": false,
            "version": "v0.0.0-20180127040603-bd5ef7bd5415",
            "ecosystem": "go"
          },
          {
            "name": "github.com/xo/terminfo",
            "direct": false,
            "version": "v0.0.0-20220910002029-abceb7e1c41e",
            "ecosystem": "go"
          },
          {
            "name": "github.com/yashtewari/glob-intersection",
            "direct": false,
            "version": "v0.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/yosida95/uritemplate/v3",
            "direct": false,
            "version": "v3.0.2",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/auto/sdk",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/metric",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/sdk",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/sdk/metric",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.opentelemetry.io/otel/trace",
            "direct": false,
            "version": "v1.44.0",
            "ecosystem": "go"
          },
          {
            "name": "go.starlark.net",
            "direct": false,
            "version": "v0.0.0-20260708150628-5395d018f003",
            "ecosystem": "go"
          },
          {
            "name": "go.yaml.in/yaml/v2",
            "direct": false,
            "version": "v2.4.4",
            "ecosystem": "go"
          },
          {
            "name": "go.yaml.in/yaml/v3",
            "direct": false,
            "version": "v3.0.4",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/arch",
            "direct": false,
            "version": "v0.23.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/crypto",
            "direct": false,
            "version": "v0.54.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sync",
            "direct": false,
            "version": "v0.22.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.40.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/time",
            "direct": false,
            "version": "v0.15.0",
            "ecosystem": "go"
          },
          {
            "name": "google.golang.org/protobuf",
            "direct": false,
            "version": "v1.36.12-0.20260120151049-f2248ac996af",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/check.v1",
            "direct": false,
            "version": "v1.0.0-20201130134442-10cb98267c6c",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/ini.v1",
            "direct": false,
            "version": "v1.67.3",
            "ecosystem": "go"
          },
          {
            "name": "oras.land/oras-go/v2",
            "direct": false,
            "version": "v2.6.2",
            "ecosystem": "go"
          },
          {
            "name": "sigs.k8s.io/yaml",
            "direct": false,
            "version": "v1.6.0",
            "ecosystem": "go"
          },
          {
            "name": "a2a-sdk",
            "direct": false,
            "version": "0.3.7",
            "ecosystem": "pypi"
          },
          {
            "name": "httpx",
            "direct": false,
            "version": null,
            "ecosystem": "pypi"
          },
          {
            "name": "httpx",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "pypi"
          },
          {
            "name": "langchain-core",
            "direct": false,
            "version": "1.4.9",
            "ecosystem": "pypi"
          },
          {
            "name": "langchain-openai",
            "direct": false,
            "version": "1.3.5",
            "ecosystem": "pypi"
          },
          {
            "name": "langgraph",
            "direct": false,
            "version": "1.2.9",
            "ecosystem": "pypi"
          },
          {
            "name": "litellm",
            "direct": false,
            "version": "1.84.0",
            "ecosystem": "pypi"
          },
          {
            "name": "pytest",
            "direct": false,
            "version": null,
            "ecosystem": "pypi"
          },
          {
            "name": "python-dotenv",
            "direct": false,
            "version": null,
            "ecosystem": "pypi"
          },
          {
            "name": "python-keycloak",
            "direct": false,
            "version": null,
            "ecosystem": "pypi"
          },
          {
            "name": "pyyaml",
            "direct": false,
            "version": null,
            "ecosystem": "pypi"
          },
          {
            "name": "rich",
            "direct": false,
            "version": "13.7.0",
            "ecosystem": "pypi"
          }
        ],
        "collected": true,
        "truncated": false,
        "total_count": 164,
        "direct_count": 21,
        "indirect_count": 143
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 18,
        "merged_prs": 359,
        "open_issues": 36,
        "closed_ratio": 0.858,
        "closed_issues": 218,
        "closed_unmerged_prs": 87
      },
      "bus_factor": 2,
      "bot_contributors": 1,
      "top_contributors": [
        {
          "type": "User",
          "login": "huang195",
          "commits": 690,
          "avatar_url": "https://avatars.githubusercontent.com/u/8008677?v=4"
        },
        {
          "type": "User",
          "login": "mrsabath",
          "commits": 310,
          "avatar_url": "https://avatars.githubusercontent.com/u/6954688?v=4"
        },
        {
          "type": "User",
          "login": "pdettori",
          "commits": 133,
          "avatar_url": "https://avatars.githubusercontent.com/u/6678093?v=4"
        },
        {
          "type": "User",
          "login": "cwiklik",
          "commits": 105,
          "avatar_url": "https://avatars.githubusercontent.com/u/6466066?v=4"
        },
        {
          "type": "User",
          "login": "Alan-Cha",
          "commits": 42,
          "avatar_url": "https://avatars.githubusercontent.com/u/14318081?v=4"
        },
        {
          "type": "User",
          "login": "usize",
          "commits": 34,
          "avatar_url": "https://avatars.githubusercontent.com/u/39788015?v=4"
        },
        {
          "type": "User",
          "login": "esnible",
          "commits": 31,
          "avatar_url": "https://avatars.githubusercontent.com/u/3237651?v=4"
        },
        {
          "type": "User",
          "login": "evaline-ju",
          "commits": 24,
          "avatar_url": "https://avatars.githubusercontent.com/u/69598118?v=4"
        },
        {
          "type": "User",
          "login": "maia-iyer",
          "commits": 24,
          "avatar_url": "https://avatars.githubusercontent.com/u/30640956?v=4"
        },
        {
          "type": "User",
          "login": "araujof",
          "commits": 21,
          "avatar_url": "https://avatars.githubusercontent.com/u/5344262?v=4"
        }
      ],
      "contributors_sampled": 23,
      "top_contributor_share": 0.455
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "build.yaml",
        "ci.yaml",
        "pr-verifier.yml",
        "project.yml",
        "release-binaries.yaml",
        "scorecard.yaml",
        "security-scans.yaml",
        "self-assign.yml",
        "spellcheck_action.yml",
        "stale.yaml"
      ],
      "has_docs_dir": true,
      "linter_configs": [],
      "has_editorconfig": false,
      "has_linter_config": true,
      "has_precommit_config": true
    },
    "security_signals": {
      "lockfiles": [
        "go.sum"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 6,
            "reason": "branch protection is not maximal on development and all release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 10,
            "reason": "14 out of 14 merged PRs checked by a CI test -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 10,
            "reason": "all changesets reviewed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 10,
            "reason": "project has 19 contributing companies or organizations",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 10,
            "reason": "update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 10,
            "reason": "30 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": 10,
            "reason": "packaging workflow detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 4,
            "reason": "dependency not pinned by hash detected -- score normalized to 4",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 10,
            "reason": "SAST tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 10,
            "reason": "security policy file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": 0,
            "reason": "Project has not signed or included provenance with any releases.",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 7,
            "reason": "3 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "4e01283271ae11c90821c85e293b47be9cdf3a06",
        "ran_at": "2026-07-30T03:27:56Z",
        "aggregate_score": 7.1,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": true,
      "has_dependabot_config": true
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-30T00:13:47Z",
      "oldest_open_prs": [
        {
          "number": 379,
          "created_at": "2026-05-07T14:42:34Z",
          "last_comment_at": "2026-07-16T14:27:41Z",
          "last_comment_author": "mrsabath"
        },
        {
          "number": 380,
          "created_at": "2026-05-07T14:54:32Z",
          "last_comment_at": "2026-07-16T14:27:11Z",
          "last_comment_author": "mrsabath"
        },
        {
          "number": 381,
          "created_at": "2026-05-07T15:22:39Z",
          "last_comment_at": "2026-07-16T14:26:56Z",
          "last_comment_author": "mrsabath"
        },
        {
          "number": 382,
          "created_at": "2026-05-07T15:23:01Z",
          "last_comment_at": "2026-07-16T14:26:25Z",
          "last_comment_author": "mrsabath"
        },
        {
          "number": 677,
          "created_at": "2026-07-17T22:29:17Z",
          "last_comment_at": "2026-07-17T22:30:29Z",
          "last_comment_author": "aslom"
        },
        {
          "number": 685,
          "created_at": "2026-07-20T23:13:52Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 686,
          "created_at": "2026-07-20T23:13:58Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 687,
          "created_at": "2026-07-20T23:14:07Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 688,
          "created_at": "2026-07-20T23:14:10Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 689,
          "created_at": "2026-07-20T23:14:14Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 690,
          "created_at": "2026-07-20T23:14:55Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 691,
          "created_at": "2026-07-20T23:15:15Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 701,
          "created_at": "2026-07-27T23:14:21Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 702,
          "created_at": "2026-07-27T23:14:31Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 703,
          "created_at": "2026-07-27T23:14:55Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 704,
          "created_at": "2026-07-27T23:15:10Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 710,
          "created_at": "2026-07-29T10:27:47Z",
          "last_comment_at": "2026-07-29T10:28:00Z",
          "last_comment_author": "coderabbitai"
        },
        {
          "number": 719,
          "created_at": "2026-07-30T00:13:12Z",
          "last_comment_at": "2026-07-30T00:13:39Z",
          "last_comment_author": "coderabbitai"
        }
      ],
      "last_merged_pr_at": "2026-07-29T23:24:59Z",
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": [
        {
          "number": 182,
          "created_at": "2026-03-09T14:14:07Z",
          "last_comment_at": "2026-07-13T13:52:46Z",
          "last_comment_author": "huang195"
        },
        {
          "number": 330,
          "created_at": "2026-04-17T18:39:24Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 336,
          "created_at": "2026-04-21T19:44:55Z",
          "last_comment_at": "2026-07-21T08:23:53Z",
          "last_comment_author": "github-actions"
        },
        {
          "number": 341,
          "created_at": "2026-04-22T19:30:51Z",
          "last_comment_at": "2026-07-21T13:42:24Z",
          "last_comment_author": "huang195"
        },
        {
          "number": 398,
          "created_at": "2026-05-11T19:45:21Z",
          "last_comment_at": "2026-07-21T13:45:48Z",
          "last_comment_author": "huang195"
        },
        {
          "number": 467,
          "created_at": "2026-06-03T09:27:43Z",
          "last_comment_at": "2026-06-03T10:47:58Z",
          "last_comment_author": "huang195"
        },
        {
          "number": 503,
          "created_at": "2026-06-15T18:41:41Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 504,
          "created_at": "2026-06-15T19:24:30Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 505,
          "created_at": "2026-06-15T19:24:43Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 506,
          "created_at": "2026-06-15T19:25:06Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 508,
          "created_at": "2026-06-15T19:25:40Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 509,
          "created_at": "2026-06-15T19:25:55Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 510,
          "created_at": "2026-06-15T19:27:06Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 511,
          "created_at": "2026-06-15T19:27:26Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 512,
          "created_at": "2026-06-15T19:27:41Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 513,
          "created_at": "2026-06-15T19:27:59Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 514,
          "created_at": "2026-06-15T19:28:38Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 515,
          "created_at": "2026-06-15T19:28:56Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 528,
          "created_at": "2026-06-21T10:33:26Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 529,
          "created_at": "2026-06-21T10:56:38Z",
          "last_comment_at": null,
          "last_comment_author": null
        }
      ]
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/rossoctl/cortex",
    "host": "github.com",
    "name": "cortex",
    "owner": "rossoctl"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "good",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 75,
      "inputs": {
        "security": 70,
        "vitality": 91,
        "community": 51,
        "governance": 74,
        "engineering": 86
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "excellent",
        "name": "Vitality",
        "value": 91,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "excellent",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 91,
            "inputs": {
              "commits_last_year": 1599,
              "human_commit_share": 0.85,
              "days_since_last_push": 0,
              "active_weeks_last_year": 39
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 0 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 0
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "39/52 weeks with commits",
                "points": 27,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 39
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "1599 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 1599
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "30 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": null,
            "notes": [],
            "value": 90,
            "inputs": {
              "releases_count": 29,
              "latest_release_tag": "v0.7.0-alpha.1",
              "releases_from_tags": false,
              "days_since_latest_release": 0,
              "mean_days_between_releases": 14.8
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "29 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 29
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 0 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 0
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~14.8 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 14.8
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "maintained",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": null,
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": 0,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "last human commit 0 days ago",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_maintained",
                    "params": {
                      "days": 0
                    }
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "moderate",
        "name": "Community & Adoption",
        "value": 51,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 29,
            "inputs": {
              "forks": 40,
              "stars": 10,
              "watchers": 2,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "10 stars",
                "points": 15.5,
                "status": "partial",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 10
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "40 forks",
                "points": 13.3,
                "status": "partial",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 40
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "2 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "good",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 77,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": true,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (Apache-2.0)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "Apache-2.0"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 18,
                "status": "met",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 6.3,
                "status": "met",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "good",
        "name": "Sustainability & Governance",
        "value": 74,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "moderate",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 61,
            "inputs": {
              "bus_factor": 2,
              "contributors_sampled": 23,
              "top_contributor_share": 0.455
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "2 contributor(s) cover half of all commits",
                "points": 25.2,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 46% of commits",
                "points": 12.3,
                "status": "partial",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 46
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "23 contributors",
                "points": 13.5,
                "status": "met",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 23
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 19 contributing companies or organizations",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "excellent",
            "name": "Issue & PR responsiveness",
            "note": null,
            "notes": [],
            "value": 86,
            "inputs": {
              "merged_prs": 359,
              "open_issues": 36,
              "closed_issues": 218,
              "issue_closed_ratio": 0.858,
              "closed_unmerged_prs": 87
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "86% of issues closed",
                "points": 40.1,
                "status": "partial",
                "details": [
                  {
                    "code": "issues_closed_share",
                    "params": {
                      "share": 86
                    }
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "359/446 decided PRs merged",
                "points": 30.8,
                "status": "partial",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 359,
                      "decided": 446
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "all changesets reviewed",
                "points": 15,
                "status": "met",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "moderate",
            "name": "Ownership & stewardship",
            "note": null,
            "notes": [],
            "value": 56,
            "inputs": {
              "followers": 68,
              "owner_type": "Organization",
              "is_verified": null,
              "owner_login": "rossoctl",
              "public_repos": 21,
              "account_age_days": 495
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "organization-owned",
                "points": 30,
                "status": "met",
                "details": [
                  {
                    "code": "owner_organization",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "68 followers of rossoctl",
                "points": 13.2,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 68,
                      "login": "rossoctl"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "21 public repos, account ~1 yr old",
                "points": 12.5,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 21
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 1
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "github.com/rossoctl/cortex"
              ],
              "ecosystems": "go",
              "any_deprecated": false,
              "min_days_since_publish": 180
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on go",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "go"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 180 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 180
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "57 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 57
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "excellent",
        "name": "Engineering Quality",
        "value": 86,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "excellent",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 94,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": true,
              "has_precommit_config": true
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "10 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 10
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": null,
                "points": 16,
                "status": "met",
                "details": [],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 9.6,
                "status": "met",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "14 out of 14 merged PRs checked by a CI test -- score normalized to 10",
                "points": 20,
                "status": "met",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "good",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 75,
            "inputs": {
              "topics": [],
              "has_wiki": true,
              "homepage": null,
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "good",
        "name": "Security",
        "value": 70,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "good",
            "name": "Security posture",
            "note": null,
            "notes": [],
            "value": 71,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 18,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 0,
              "scorecard_aggregate": 7.1
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection is not maximal on development and all release branches",
                "points": 4.5,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "14 out of 14 merged PRs checked by a CI test -- score normalized to 10",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "all changesets reviewed",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 19 contributing companies or organizations",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "update tool detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "30 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 4",
                "points": 2,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "3 existing vulnerabilities detected",
                "points": 5.2,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "moderate",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories. Remaining weights renormalized. Matched 156 resolved dependencies against OSV; 8 could not be assessed (no resolved version, an unsupported ecosystem, or beyond the reported package list). This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "indirect_dependencies_free_of_known_advisories"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_repository",
                "params": {
                  "assessed": 156
                }
              },
              {
                "code": "advisories_unassessed",
                "params": {
                  "count": 8
                }
              },
              {
                "code": "advisories_repo_graph_caveat",
                "params": {}
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 66,
            "inputs": {
              "source": "osv",
              "advisories": 4,
              "affected_packages": 3,
              "assessed_packages": 156,
              "unassessed_packages": 8,
              "affected_by_severity": "critical 1, unknown 2",
              "direct_affected_packages": 1
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "1 affected: google.golang.org/grpc v1.82.0 (critical 9.1)",
                "points": 9.5,
                "status": "partial",
                "details": [
                  {
                    "code": "advisories_affected",
                    "params": {
                      "count": 1,
                      "packages": "google.golang.org/grpc v1.82.0 (critical 9.1)"
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "transitive set not separable from development and test dependencies in this scope",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_scope_not_separable",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory has been public longer than 90 days",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "advisories_none_stale",
                    "params": {
                      "days": 90
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 156,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 20
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "good",
        "name": "AI Readiness",
        "value": 80,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "excellent",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 0.965,
              "agent_instruction_files": [
                "CLAUDE.md",
                "authbridge/CLAUDE.md"
              ],
              "agent_instruction_max_bytes": 46101
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "CLAUDE.md, authbridge/CLAUDE.md",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "CLAUDE.md, authbridge/CLAUDE.md"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "82 of 85 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 82,
                      "sampled": 85
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "good",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 84,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "go.sum"
              ],
              "has_dockerfile": true,
              "typed_language": true,
              "bootstrap_files": [
                "Makefile",
                "authbridge/demos/echo/Makefile",
                "authbridge/demos/finance-sparc/Makefile",
                "authbridge/demos/github-issue/aiac/Makefile",
                "authbridge/demos/github-issue/rbac/Makefile",
                "authbridge/demos/hr-cpex/Makefile",
                "authbridge/demos/ibac/Makefile",
                "authbridge/demos/mtls/Makefile",
                "authbridge/proxy-init/Makefile",
                "authbridge/sparc-service/deploy/Makefile"
              ],
              "has_devcontainer": false,
              "has_linter_config": true,
              "typecheck_configs": [],
              "agent_commit_share": 0,
              "toolchain_manifests": [
                "authbridge/authlib/go.mod",
                "authbridge/cmd/abctl/go.mod",
                "authbridge/cmd/authbridge-cpex/go.mod",
                "authbridge/cmd/authbridge-envoy/go.mod",
                "authbridge/cmd/authbridge-proxy/go.mod",
                "authbridge/demos/echo/go.mod",
                "authbridge/demos/finance-sparc/go.mod",
                "authbridge/demos/ibac/go.mod"
              ],
              "dependency_bot_commit_share": 0.15
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "Makefile, authbridge/demos/echo/Makefile, authbridge/demos/finance-sparc/Makefile, authbridge/demos/github-issue/aiac/Makefile, authbridge/demos/github-issue/rbac/Makefile, authbridge/demos/hr-cpex/Makefile, authbridge/demos/ibac/Makefile, authbridge/demos/mtls/Makefile, authbridge/proxy-init/Makefile, authbridge/sparc-service/deploy/Makefile",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Makefile, authbridge/demos/echo/Makefile, authbridge/demos/finance-sparc/Makefile, authbridge/demos/github-issue/aiac/Makefile, authbridge/demos/github-issue/rbac/Makefile, authbridge/demos/hr-cpex/Makefile, authbridge/demos/ibac/Makefile, authbridge/demos/mtls/Makefile, authbridge/proxy-init/Makefile, authbridge/sparc-service/deploy/Makefile"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": null,
                "points": 11,
                "status": "met",
                "details": [],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "Go (statically typed)",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "Dockerfile, lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Dockerfile, lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "no agent-authored commits among the last 100",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_authored_commits",
                    "params": {
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "15 of the last 100 commits are automated dependency updates",
                "points": 8,
                "status": "met",
                "details": [
                  {
                    "code": "dependency_bot_commits",
                    "params": {
                      "count": 15,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 4",
                "points": 4,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "Go",
              "largest_source_bytes": 60889,
              "source_files_sampled": 355,
              "oversized_source_files": 1
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Go (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "1/355 source files over 60KB",
                "points": 54.8,
                "status": "partial",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 355,
                      "oversized": 1
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "at_risk",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "example_dirs": [
                "demos"
              ],
              "has_mcp_signal": false,
              "api_schema_files": []
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": "demos",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "demos"
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
    "Could not fetch pypi package 'rossoctl-sparc-service' from its registry"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-30T03:28:23.631137Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/r/rossoctl/cortex.svg",
  "full_name": "rossoctl/cortex",
  "license_state": "standard",
  "license_spdx": "Apache-2.0"
}