sanhaji182/lintasan holds a health index of 44 out of 100, placing it in the At risk band. It scores highest on AI Readiness (76/100) and lowest on Security (18/100). It was last updated 20 days ago. A single contributor accounts for most of its recent work.
44
overall / 100
At risk
Software health index
Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At risk ceiling of 49. AI Readiness sits outside the overall score.
44
Excellent85-100Exemplary; meets essentially all checked criteria
Good70-84Healthy; minor gaps
Moderate50-69Acceptable with notable gaps; review recommended
At risk30-49Significant weaknesses; adoption warrants caution
Critical1-29Severe problems (abandoned, single-maintainer, no hygiene)
Score profile
Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.
How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score.
Manageable file sizes — 2/283 source files over 60KB
Inputs used
primary_language
Go
largest_source_bytes
74,006
source_files_sampled
283
oversized_source_files
2
Key facts
4GitHub stars
1contributors
207commits, last 12 months
20days since last push
7releases
1bus factor
0open issues
Go, npmpackage ecosystems
Data collection warnings
GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
More detail
Star and fork history 4 ★ / 0 ⇿
4Stars
7Releases
When each star and fork was added, collected from GitHub and bucketed by day. Cumulative growth sits directly above the daily additions it is made of, so the two read against each other: steady organic accretion looks nothing like an abrupt, short-lived burst. Where that difference is measurable, it is reported as growth authenticity.
Major 0Minor 3Patch 4
OpenSSF Scorecard 1.8 / 10
1.8aggregate
Independent, tool-agnostic security assessment from the open-source OpenSSF Scorecard. Each check rewards a security practice, not a specific vendor's tool. Checks Scorecard could not determine are marked n/a and excluded from the security score (never counted as zero).Scorecard v5.5.0 · 2026-07-22 04:22 UTC
The resolved dependency set could not be collected for this report: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
Raw JSON report machine-readable
{
"data": {
"repo": {
"topics": [
"ai-gateway",
"api-gateway",
"golang",
"llm",
"llm-gateway",
"llm-proxy",
"openai-api",
"self-hosted",
"sqlite",
"svelte"
],
"is_fork": false,
"size_kb": 24101,
"has_wiki": true,
"homepage": "https://sanhaji182.github.io/lintasan/",
"languages": {
"Go": 1823143,
"CSS": 6292,
"HTML": 611,
"Svelte": 627819,
"Makefile": 2653,
"Dockerfile": 1536,
"JavaScript": 748,
"TypeScript": 29338
},
"pushed_at": "2026-07-01T08:16:34Z",
"created_at": "2026-05-25T12:03:26Z",
"owner_type": "User",
"updated_at": "2026-07-15T15:35:36Z",
"description": "High-performance LLM gateway in Go. 35x less RAM than Node.js version.",
"is_archived": false,
"is_disabled": false,
"license_spdx": "MIT",
"default_branch": "main",
"license_spdx_raw": "MIT",
"primary_language": "Go",
"significant_languages": [
"Go",
"Svelte"
]
},
"owner": {
"blog": null,
"name": "Sanhaji",
"type": "User",
"login": "sanhaji182",
"company": null,
"location": null,
"followers": 2,
"avatar_url": "https://avatars.githubusercontent.com/u/17717848?v=4",
"created_at": "2016-03-08T06:09:36Z",
"is_verified": null,
"public_repos": 32,
"account_age_days": 3787
},
"license": {
"state": "standard",
"spdx_id": "MIT",
"raw_spdx": "MIT",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v0.26.2",
"kind": "patch",
"published_at": "2026-06-30T08:55:20Z"
},
{
"tag": "v0.26.1",
"kind": "patch",
"published_at": "2026-06-30T08:12:55Z"
},
{
"tag": "v0.26.0",
"kind": "minor",
"published_at": "2026-06-30T07:58:41Z"
},
{
"tag": "v0.25.0",
"kind": "minor",
"published_at": "2026-06-30T07:49:19Z"
},
{
"tag": "v0.24.2",
"kind": "patch",
"published_at": "2026-06-05T07:52:44Z"
},
{
"tag": "v0.24.1",
"kind": "patch",
"published_at": "2026-06-05T06:07:17Z"
},
{
"tag": "v0.24.0",
"kind": "minor",
"published_at": "2026-06-05T05:07:18Z"
}
],
"recent_commits": [
{
"oid": "7fe574d5655c973a3860bd8e3ed139d112b67526",
"body": "- docs page: 'LLM proxy gateway' → 'LLM gateway'\n- docs page: 'API Key for proxy access' → 'API Key for gateway access'\n- AGENTS.md: 'start proxy server' → 'start gateway server'\n- AGENTS.md: 'Log semua proxy request' → 'Log semua gateway request'",
"is_bot": false,
"headline": "docs: rename 'proxy' to 'gateway' in dashboard docs and AGENTS.md",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-07-01T08:16:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "74dce80e90543070b00c5d17d5fdc61735d01aca",
"body": "Lintasan is a gateway (routing, failover, caching, circuit breaker),\nnot just a proxy (simple request forwarding)",
"is_bot": false,
"headline": "docs: rename 'proxy' to 'gateway' in README",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-07-01T08:13:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d71de48c2cf1f8cf73b6f23e8442c305902c6df2",
"body": "- Version badges: v0.25.0 → v0.29.3\n- Test count: 900+ → 1021+ (43 packages)\n- Dashboard pages: 17 → 25\n- Feature table: 36 → 39 features (added grouped connections, shared models viewer, balance checker, token compression, semantic cache, guardrails)\n- Project structure: updated to 43 internal pack\n[…]\nild)\n- Removed bilingual duplication where possible\n- Removed outdated migration section\n- Fixed provider preset counts\n\nAlso: remove redundant model count from nested connection cards in grouped view",
"is_bot": false,
"headline": "docs: update README to match current functionality",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-07-01T08:07:00Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "38545476d908d022b223eacf2d74de342dd7ca79",
"body": "- totalModels now uses max() instead of sum() (shared models across accounts)\n- Group header shows format badges (openai, commandcode)\n- Group header shows base URL (truncated with ellipsis)\n- Active ratio shown without redundant 'active' text\n- Added .conn-group-url CSS class",
"is_bot": false,
"headline": "fix(ui): group header - unique model count, base URL, format badges",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-30T15:35:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9b44e25e73732e92991254b9d48512f01a289beb",
"body": "make frontend copies frontend/build/* → internal/web/dist/ before go:embed.\nPrevious manual build skipped this step, serving stale frontend.",
"is_bot": false,
"headline": "fix: rebuild with correct frontend embed (dist/ sync)",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-30T15:28:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1e2ac68385f08dcfef2552f881faeef2ea9d3745",
"body": "- Backend: BalanceInfo now includes RateWindows[], UsageStats, BillingReset\n- Frontend: CommandCode cards show structured detail strip with:\n - Credit balance + plan type + billing reset date\n - 5h and weekly rate limit progress bars\n - Usage stats (requests, tokens, success rate)\n- Other providers keep simple badge display",
"is_bot": false,
"headline": "feat(balance): structured CommandCode rate windows + detail UI",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-30T15:23:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "dfffdfc408f63f339dfc9e4cf33037187ca9fca3",
"body": "- WindowLimits.used/cap are float64 not int (1.8994 fractional credits)\n- Balance now shows correctly: $9.38, $9.98\n- Rate info includes: 5h window, weekly window, request count, tokens, success %",
"is_bot": false,
"headline": "fix(v0.29.2): CommandCode balance - fix float parsing for rate limits",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-30T15:12:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e1dad28ed22bbe3bb2463150887eaa1a881a6621",
"body": "- Uses /alpha/usage/summary, /alpha/billing/credits, /alpha/billing/subscriptions\n- Shows: total credits ($XX.XX), used credits, rate limits (5h/weekly windows)\n- Shows: plan type (individual-go), period end date, request count, tokens, success rate\n- Parallel fetch all 3 endpoints with 7s timeout",
"is_bot": false,
"headline": "feat(v0.29.1): CommandCode balance checker via /alpha/ billing API",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-30T15:01:36Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e38bcdb9981fd4c23f568568ebd44920c6cb2f18",
"body": "Backend:\n- New handlers_balance.go: fetchProviderBalance() with per-provider logic\n- Deepseek: direct balance API (/api/user/balance) → USD balance + total used\n- OpenAI: rate limit headers from models endpoint\n- Groq: rate limit headers (free tier)\n- Cerebras, xAI, generic: rate limit extraction fr\n[…]\ners that report credits\n- ⚡ badge with rate limit info for providers with rate headers\n- Balance loads async after page mount (non-blocking)\n- Balance shown on both single cards and nested group cards",
"is_bot": false,
"headline": "feat(v0.29.0): provider balance/credit checker",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-30T14:50:44Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f6f9249f7acbf4bd9488e664b2dabf09147d9e09",
"body": "- Models viewer now loads from ALL connections in the same provider group\n- Models are merged and deduplicated across accounts\n- Sync button in viewer syncs all active accounts in the group (parallel)\n- Toast shows total synced count across all accounts",
"is_bot": false,
"headline": "fix(v0.28.1): shared models viewer for grouped connections",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-30T14:31:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a650476254bde52b1ec0d0fe6b27e13f6402fa18",
"body": "- Connections from same provider (same base_url domain) are now grouped\n- Multi-account providers show collapsible group header with:\n - Provider name, account count, active/total status, total models\n- Single connections render as standalone cards (no grouping wrapper)\n- Nested cards inside groups have no border/shadow for cleaner look\n- ChevronRight for expand/collapse, responsive on mobile\n- Smart provider name detection from URL domain and name prefix",
"is_bot": false,
"headline": "feat(v0.28.0): group connections by provider for better visibility",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-30T13:48:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "512c0d9198e2a34faff058c273ddd5c1c702928b",
"body": "… grid layout\n\n- Unified toolbar: title + search + refresh + import + add buttons in one row\n- Card grid layout instead of cramped table for better scannability\n- Primary actions (Test, Toggle, Sync, Models) visible inline on each card\n- Only secondary actions (Pool, Copy, Delete) in dropdown menu\n- Fixed bind:value Svelte 5 compatibility for pool editing\n- Responsive design: cards stack on mobile, icon-only actions on narrow screens\n- All CSS uses design system variables, no hardcoded colors",
"is_bot": false,
"headline": "feat(v0.27.1): redesign connections page - toolbar with refresh, card…",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-30T12:22:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a17adfa75e86a207b16bb55a891bcfe5381788c7",
"body": null,
"is_bot": false,
"headline": "release(v0.27.0): connections table redesign",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-30T12:01:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cef0dffa7455514bb8a039b134aad2992df9b307",
"body": "Complete redesign of connections list from card-based to professional data table:\n- Sortable columns: Status, Name, Format, Priority, Pool, Models, Actions\n- Status dots: green=active, gray=inactive\n- Name column: bold name + masked API key in mono\n- Format badge with purple-light styling\n- Pool bad\n[…]\n, Edit Pool, Copy API Key, Delete\n- Responsive: Priority + Pool columns hidden on mobile\n- Sort indicators (↑/↓) on active column\n- 208 ins, 332 del — net 124 lines reduction\n- File: 2059 → 1935 lines",
"is_bot": false,
"headline": "feat(ui): connections page full table redesign",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-30T12:01:28Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "6024642d248500e2ddd65220dc027b6834e75990",
"body": null,
"is_bot": false,
"headline": "release(v0.26.3): connections page UX overhaul",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-30T09:25:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ba4b189fa0dd9f8737ecef3dbaaa4074798b2a7a",
"body": "- Button overload fixed: 6 buttons per row → 2 inline (Toggle, Test) + ⋯ dropdown menu (Models, Sync, Pool, Delete)\n- Search/filter bar added: filter by name, format, pool_id with match count\n- Pool health: 0% → \"—%\" when no traffic data (prevents misleading display)\n- Click-outside detection for dropdown menus\n- svelte-check: 0 errors",
"is_bot": false,
"headline": "fix(ui): connections page UX overhaul",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-30T09:24:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9b4f82f230bc0c6add8eb494c171bd7cd03e4fb3",
"body": null,
"is_bot": false,
"headline": "release(v0.26.2): design system migration + error handling fix",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-30T08:55:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bc821fabc8963a8eeb8889a37dcba0a5bf4223d1",
"body": "CRITICAL:\n- Migrate MCP page from Tailwind dark-hardcoded to design system CSS vars\n- Migrate Translator page from Tailwind dark-hardcoded to design system CSS vars\n- Fix --color-bg-hover (undefined) → --color-bg-sidebar-hover in Discover\n- Fix hardcoded hex colors (#10b981, #f59e0b, #8b5cf6) → CSS \n[…]\ner (role=status, aria-label, sr-only)\n- Add role=status to EmptyState\n- showToast for action errors (keys create/delete, discover connect, translator)\n\nFiles: 11 changed, 304 insertions, 139 deletions",
"is_bot": false,
"headline": "fix(ui): design system migration + error handling + accessibility",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-30T08:54:23Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "0b2e11f282a7532059c81fdd878976ba0f07bf48",
"body": null,
"is_bot": false,
"headline": "release(v0.26.1): savings redesign + pool tests",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-30T08:12:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "dfe69dd504c5211846558973893b3856b14616ef",
"body": "- Savings page: migrated from dark-hardcoded Tailwind to design system CSS vars\n (4-col summary grid, breakdown cards with icons, proper table styling)\n- Pool tests: 5 new tests covering CRUD, multi-pool, patch, delete, empty state\n- .gitignore: added coverage*.out, cmd/jwttest/, cmd/resetpass/, cmd/testpools/,\n dist-bin/ to prevent dev artifacts from entering repo",
"is_bot": false,
"headline": "feat(v0.26.1): savings page redesign + pool tests + gitignore cleanup",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-30T08:12:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "272a7b85314e78eddbcbee2faa1b2f826564432f",
"body": null,
"is_bot": false,
"headline": "release(v0.26.0): connection pool management",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-30T07:58:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3678d3735a6bf4e0110e27b3f534dcdd698743f9",
"body": "- DB: add pool_id column + index on connections table\n- Backend: GET /api/connections/pools (health stats with runtime LB data)\n- Backend: pool_id in connection CRUD (create, patch, delete trigger pool refresh)\n- Proxy: initMultiAccountPools() on startup, pickMultiAccountAPIKey() per request\n- Proxy\n[…]\nordMultiAccountResult() for health\n- Frontend: pool health cards, pool ID assignment in form, collapsible sections\n- Frontend: 4-column summary grid (total/active/formats/pools)\n- All 44 packages PASS",
"is_bot": false,
"headline": "feat(pools): connection pool management with multi-account LB",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-30T07:58:03Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "17a96e17ad940b72c885451c08a19c041fb2fc22",
"body": "- IDE OAuth experimental lab (antigravity, claude, cline, codex, cursor, copilot, kilocode, xai)\n- Security audit fixes (rows.Scan, stubs, config struct, globals -> Server struct)\n- Test coverage: 43/43 pkgs pass, 900+ tests, critical pkgs >= 60%\n- Docs overhaul: INSTALL.md, CONFIGURATION.md, QUICKSTART.md, api-reference.md\n- UX polish: login redesign, landing hero, EmptyState 3 variants, Toast system\n\nCloses P1.6",
"is_bot": false,
"headline": "release(v0.25.0): P1.6 ship — all P1 tasks complete",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-22T23:24:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c29311294346359ebcabfa3ac3e5215b19d147fc",
"body": "…log)",
"is_bot": false,
"headline": "feat(oauthide): antigravity, kilocode, cline, cursor import (8/8 cata…",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-09T01:18:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1c429038f8f3f15cc0be2d1808787ea01432e4a6",
"body": "- claude: JSON token exchange, codex: form + id_token meta\n- catalog implementation=ready for both\n- callback stores flow_meta for codex",
"is_bot": false,
"headline": "feat(oauthide): Claude Code + Codex PKCE (9router port)",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-08T23:57:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "df4d804fee9ebabdc9850437a1103b267808ad2b",
"body": "- StartGitHubDevice + poll + copilot_internal token exchange\n- POST /api/oauth/device/poll, authorize returns flow=device_code\n- UI: user_code, GitHub link, poll button\n- github catalog implementation=ready (with xai)",
"is_bot": false,
"headline": "feat(oauthide): GitHub Copilot device flow (9router port)",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-08T23:52:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4061b544c7e4cc6d9ff8ebacc76fe949ad1891d1",
"body": "- internal/oauthide catalog + xai port from 9router constants\n- PKCE verifier column on oauth_sessions\n- UI lists all 8 with implementation status; authorize ready only (xai)\n- Remaining 7: planned with clear errors on authorize",
"is_bot": false,
"headline": "feat(oauthide): 9router catalog (8 providers), xai PKCE e2e",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-08T23:45:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6ec3d3e5476616b122f2a8285cbfdcd02b52b3fb",
"body": "…b tokens)\n\n- LINTASAN_OAUTH_IDE_ENABLED default false; public callback only when enabled\n- Admin gate + acknowledge_risk on authorize; real token exchange (env client creds)\n- Dashboard /dashboard/oauth-ide with ToS disclaimer\n- docs/oauth-ide-experimental.md + README env table",
"is_bot": false,
"headline": "feat(oauth): experimental IDE OAuth lab (flag off, admin-only, no stu…",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-08T23:06:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "982fe93318ac468a03210ba30713838552280f44",
"body": "- README: lintasan-go → lintasan, add Go/License/Version/Tests badges\n- CONTRIBUTING.md: update clone URL and project structure name\n- AGENTS.md: update repo reference URL\n- README version: v0.24.0 → v0.24.2\n- Remove 'v2' branding — just 'Lintasan' now",
"is_bot": false,
"headline": "docs: rename repo from lintasan-go → lintasan, add open-source badges",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-08T07:51:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9419e3e382b733e6dfe8ae3e92fa614f30233a18",
"body": null,
"is_bot": false,
"headline": "chore: remove stale binary artifacts, broaden gitignore patterns",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-08T07:11:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "54070d834191e462a04fbfcdab1241ce88344e9a",
"body": "…NT.md\n\n- Add docs/qa-test-plan.md: 87 test cases across 16 areas, execution flow\n- Add docs/qa-test-report.md: 64 PASS, 7 NEEDS_KEY, 0 P0/P1 regressions\n- AGENTS.md §12: update headline (HEAD fb19ed1), fix broken link, add\n QA validation summary table, mark Beta: GO\n- Remove AGENT.md (singular, 25\n[…]\nbsolete, nunjuk ke 17322f6,\n superseded by AGENTS.md as authoritative source\n\nTested against prod build v0.24.2-1-gfb19ed1 at lintasan.sans.biz.id:20180.\nSee docs/qa-test-report.md for full evidence.",
"is_bot": false,
"headline": "docs(qa): add QA test plan + report (2026-06-05), remove obsolete AGE…",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-05T09:11:46Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "fb19ed1323bf0c7995876704875161483a3a43c4",
"body": null,
"is_bot": false,
"headline": "merge: beta-readiness P0+P1 fix batch (v0.24.2)",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-05T07:50:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9dc35562f447bb2699bfaf0441fc879cf5ce6c89",
"body": "…rrections\n\nUpdates the authoritative state snapshot to reflect the beta-readiness\nfix batch. Also adds an 'Audit corrections' note explaining that the\noriginal audit's '16+ missing routes' finding was a false positive\ncaused by a grep that missed handlers_rest.go, where all 16 routes\nwere already w\n[…]\nnext session does not re-derive\nthe same false positive from scratch. The load-balancer 401 was a\nreal finding and is fixed in 9551304.\n\nTests: 826 passing in 44 packages, 0 regressions, go vet clean.",
"is_bot": false,
"headline": "docs(release): CHANGELOG v0.24.2 + AGENTS.md §12 audit follow-up + co…",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-05T07:46:31Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a7fdf41911b93d27bf53cc49ea5d3d986285dc8f",
"body": "The quick reference had a login example with hardcoded credentials\nthat no longer work: the admin password is randomly generated on\nfirst start (SeedAdmin in internal/auth/users.go) and is forced to\nrotate on first login. Copy-pasting 'admin/admin123' from the doc\nreturned 401, which is confusing fo\n[…]\nblock describing:\n - The password is randomly generated and surfaced once on stderr.\n - Recovery steps (journalctl, DB reset, master_key via dashboard).\n\nRefs beta-readiness audit (v0.24.1), item E.",
"is_bot": false,
"headline": "docs(agent): §11 — drop admin/admin123, document password recovery",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-05T07:44:50Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e73b019b7a66cc699d34bebd6e7fae0bd92b6faa",
"body": "The endpoint previously returned hardcoded zeros. The cost package\nhas a full Calculator + Tracker + PricingLookup (11 test files) but\nthe handler wasn't wired to any of it.\n\nNew behavior: aggregate request_logs by model for 'today' and 'this\nmonth' (SQLite date functions, server timezone), compute \n[…]\n(math.Round is half-away-\nfrom-zero but float64 representation can flip 1.005 → 1.0049999…;\nthe helper is for display only, not financial-grade rounding).\n\nRefs beta-readiness audit (v0.24.1), item D.",
"is_bot": false,
"headline": "fix(server): handleCosts — read real cost data from request_logs",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-05T07:44:35Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c6cd2fd69de2eb0f93afddd28dfdcf7738ce31bf",
"body": "…mplate\n\nThe prior stub returned a hardcoded 'export default async function\nplugin(ctx) { return ctx.next(); }' regardless of the prompt, making\nthe 'AI Generate' tab in the Plugins page a lie.\n\nNew behavior:\n- 400 if the request is missing 'prompt'\n- 503 with a clear hint if 'plugin_generator_model\n[…]\n the response shape is stable. Live LLM-backed\ngeneration is exercised only in prod (deterministic test for a\nnon-deterministic LLM would just be a mock).\n\nRefs beta-readiness audit (v0.24.1), item B.",
"is_bot": false,
"headline": "fix(server): handlePluginGenerate — real LLM codegen, no more fake te…",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-05T07:44:17Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "9551304cba0b5b7f6348dc3b1151ccc54ce30e2c",
"body": "The routing page sent PUT /api/load-balancer but server.go:276 only\nregisters POST. Go 1.22's strict ServeMux returns 405 (or 401 behind\nthe auth middleware) for mismatched methods, so the 'Set strategy'\nbutton silently did nothing when the user was logged in.\n\nFrontend is the smaller of the two surfaces to change (1 line). Align\nhere rather than adding a PUT handler on the server.\n\nRefs beta-readiness audit (v0.24.1), item C.",
"is_bot": false,
"headline": "fix(frontend): load-balancer strategy — use POST to match server",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-05T07:43:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1d3badae06022d5a444ab674017303de2a3faf3f",
"body": null,
"is_bot": false,
"headline": "docs(release): CHANGELOG v0.24.1 + AGENTS.md §12 audit state snapshot",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-05T06:02:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c030fdddfecac31090bb31e9b0d360c3523b7080",
"body": "…stream response headers\n\nWhen the Go http.Transport transparently decompresses a gzipped upstream\nresponse, it also clears (or sets to 0) the upstream's Content-Length\nheader. If we forward that stale or zero Content-Length to the downstream\nclient, the client sees an empty body even though w.Write\n[…]\n a stale\n9353317, so its 47-file diff was mostly noise. Extracted the\nsubstantive fix and applied it to all three sites on a fresh branch\nfrom main.\n\nTest count: 816 passed (unchanged), 0 regressions.",
"is_bot": false,
"headline": "fix(proxy): strip hop-by-hop Content-Length/Transfer-Encoding from up…",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-05T05:49:27Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "84874cf88ee1251f61c25ecdbe08a9fc4106a5ae",
"body": "The curl_import endpoint (POST /api/connections/import-curl) was\nlanded in 17322f6 to repair a broken main, but came with zero\nunit-test coverage. This commit adds 28 tests in\ninternal/server/curl_import_test.go covering:\n\n- parseCurlCommand: basic GET, POST with body, Bearer auth,\n x-api-key auth,\n[…]\ning the branch's file as-is\nwould not compile against main. The smallest safe patch is a\nfresh test that exercises main's actual API surface.\n\nTest count: 788 -> 816 (+28), 44 packages, 0 regressions.",
"is_bot": false,
"headline": "test(server): add tests for internal/server/curl_import.go",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-05T05:41:46Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4329efa970fb193a8525b58f9550dbf4511901a4",
"body": "Full state refresh after the v0.24.0 version reset + curl-import hot-fix\n(commits cfc007a, 17322f6). AGENT.md was last reconciled 2026-05-31\nagainst main @ 52647d1 / prod binary 0989e21a (v2.4.0-20-gca85973) — both\nof those are stale now.\n\nWhat changed in repo/runtime since then:\n- v0.24.0 tag lande\n[…]\nygiene added per\nthe pitfall that bit the v0.24.0 deploy).\n\nHistorical commit refs (e.g. \"framework baseline sejak 52647d1\") kept —\nthey refer to when the framework was established, not current state.",
"is_bot": false,
"headline": "docs(agent): reconcile to 2026-06-05 / main 17322f6 / prod 7b273520",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-05T04:40:20Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "17322f614ccd04bec9e35ee91b92b2bdc1d6aefc",
"body": "Commit 34336df registered the route POST /api/connections/import-curl\non *Server.handleCurlImport, but never landed the file that defines\nthe method. The result: main HEAD has been in a half-broken state —\n`go build ./...` fails with \"s.handleCurlImport undefined\" on a clean\ncheckout, and only build\n[…]\nn its own time. This commit makes main buildable\nwithout forcing that merge.\n\nNo tests for curl_import.go itself — that's a known gap, deferred to\na follow-up. The current 788-test suite still passes.",
"is_bot": false,
"headline": "fix(server): commit untracked curl_import.go — repair broken build",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-05T04:34:21Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "cfc007a466e8d798455c0f420fce48cfc8e2da64",
"body": "Move Lintasan to the 0.x.x (pre-1.0) semver range. The .24 keeps\ncontinuity with the prior v2.4.0 work; the v2.4.0 tag remains in\nhistory for reference.\n\nWhat changes:\n- internal/version/version.go: default 2.4.0 -> 0.24.0 (Makefile\n continues to inject the exact git describe at build time)\n- cmd/l\n[…]\ng\n\nNo code or behavior change. Build + 788 tests pass on the affected\npackages. Prod binary to be rebuilt and redeployed as v0.24.0 in a\nfollow-up commit; v0.24.0 tag will be cut on the deployed main.",
"is_bot": false,
"headline": "chore(release): version reset v2.4.0 -> v0.24.0",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-05T04:14:37Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "6b29d79670bc20426653d6cb9d684987ab62cc90",
"body": "…700+)",
"is_bot": false,
"headline": "docs(readme): correct exact number of presets (118) and tests count (…",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-03T01:36:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b8ef695fa88967dd2862e730d72bccc1c7e7bcf3",
"body": "…ets, and build updates",
"is_bot": false,
"headline": "docs(readme): add info about cURL import, metrics endpoint, 113+ pres…",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-03T01:23:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b425619dda96642adc5d35a2dc504d7443bf9217",
"body": null,
"is_bot": false,
"headline": "docs(readme): bump version note in README header to v2.4.0",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-03T01:22:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9be5f6130fd487023909333f13387ee1e9c599d4",
"body": null,
"is_bot": false,
"headline": "docs(readme): update readme for v2.4.0 single-binary and new components",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-03T01:13:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "34336df76308dc5fdc2fc7ff5c3238cb7b6fd218",
"body": null,
"is_bot": false,
"headline": "fix(frontend): svelte a11y & typing fix, backend mask updates",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-03T00:53:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a84f7ffacfbe8ea51f18c8749f0aa9d851c31f6f",
"body": null,
"is_bot": false,
"headline": "fix(cache): fix ttl expiration query",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-03T00:36:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9353317b75d356542f2718614169c786f881f96d",
"body": "…ential masking warning\n\n- Line 274: 'allow-all (dev mode)' → 'fail-closed (return 401)' — the actual\n behavior when master key is empty, verified against authMiddleware code.\n- Add 4 new tables to schema section: experimental_providers,\n experimental_credentials, provider_presets, preset_categories.\n- Add credential masking pitfall warning: masked values (25 chars) get saved\n back as real keys. Mitigations: no pre-fill, length validation, sanity check.",
"is_bot": false,
"headline": "docs(agents): fix auth mode claim (fail-closed, not allow-all) + cred…",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-01T15:22:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fd094361e87ee129c8ffee677a599a05f9ba409b",
"body": "ROOT CAUSE:\nAdmitProvider() in handlers_experimental.go was called with `nil` as the\nprovider registry (line 220), causing every admit attempt to fail with\n\"admission-error: expprovider: nil registry\" regardless of credentials.\nThis made the experimental provider admit → activate → deactivate chain\n\n[…]\nIL → persisted state=\"admitted\" (correct per framework)\n\nThis is an environment-blocker for protocol/acceptance gates (no real\ncodex-acp CLI installed), not a code-blocker. The wiring fix is complete.",
"is_bot": false,
"headline": "fix(expprovider): G1 — nil-registry admit fix + state-machine alignment",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-01T15:13:23Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f698f01ad96ac2699b5c3f0c621abee72f7d26dc",
"body": "…l page UI\n\nExperimental providers (Codex, Claude Code, Gemini CLI, Copilot)\npreviously required their auth token in the server's environment\nvariable (e.g. OPENAI_API_KEY, ANTHROPIC_API_KEY, COPILOT_GITHUB_TOKEN).\nThis blocked the dashboard operator workflow: every credential\nchange required a serv\n[…]\nich is operator-hostile\nwhen the dashboard is the only thing the operator touches.\nDashboard path is a strict superset of env-var path — env\nremains as fallback so bare-metal deployments keep working.",
"is_bot": false,
"headline": "feat(expprovider): Encrypted dashboard credential store + experimenta…",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-01T12:38:01Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4ee6f93b1208541893c2809426f5f3b384e52192",
"body": "…efore-save, view models\n\nOverhaul /dashboard/connections into a self-service catalog for\nadding/managing LLM provider connections. The old page was a flat\nlist with no discovery aid; this commit turns it into a hub where\nthe user can browse a built-in catalog, pick a preset, configure\na key, verify\n[…]\nd map\n3. API-driven categories\n4. Tabbed Manage modal (Presets | Categories)\n5. Test-before-save gate\n6. Rich errfmt display in test result banner\n7. View models modal (this commit's headline feature)",
"is_bot": false,
"headline": "feat(frontend): Connections page — preset catalog, categories, test-b…",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-01T12:35:25Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "066c7edcdd0304e9d536c54b2df6dd062dd07fae",
"body": "Standardize upstream error parsing so dashboard, test endpoint, and\nclients all see a consistent shape regardless of which provider\nemitted the error (OpenAI, Anthropic, Google, LiteLLM proxies,\nor raw HTTP).\n\nEnvelope shape\n==============\n\nAll error responses from internal endpoints now follow:\n\n \n[…]\nenAI-compatible\ngateway. The `__lintasan_ping__` model name is a sentinel that\nthe upstream will reject with a model-not-found error — which is\nexactly the signal we need (auth passed, traffic flows).",
"is_bot": false,
"headline": "feat(errfmt): OpenAI-compatible error envelope across all providers",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-06-01T12:33:14Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2023d998f460483ff6d705c232eb23a1600bc1c6",
"body": "…ence\n\nClaude Code:\n- DefaultPath: claude-code-acp → cc-acp (npm bin name)\n- AuthMethodID: anthropic-api-key → claude-code-subscription\n- Binary: cc-acp v0.1.1 (community ACP wrapper over Claude Code SDK)\n\nGemini CLI:\n- Args: --experimental-acp → --acp (deprecated flag updated)\n- AuthMethodID: gemin\n[…]\nD: github-token → copilot-login\n- Binary: @github/copilot v1.0.56 (native --acp)\n\nAll descriptors now carry VALIDATED comments with real binary evidence.\nNo framework changes. Build + full suite pass.",
"is_bot": false,
"headline": "fix(expprovider): patch Cohort-A descriptors with validated wire evid…",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-05-31T17:37:46Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "60df4f379e75bd4eca2e97f01274b5fd75070646",
"body": "Drives the REAL codex-acp 0.15.0 binary through the broker's ACPClient,\nproving the full wire contract without requiring a valid API key:\n\n1. InitializeContract — protocolVersion=1, agentInfo, authMethods\n2. AuthenticateContract — deferred validation accepted\n3. SessionNewContract — valid sessionId \n[…]\nrFidelity — name/version/authMethodID match descriptor\n\nGate: LINTASAN_CODEX_LIVE=1 + LINTASAN_CODEX_ACP_BIN (no OPENAI_API_KEY needed).\nWire contract PASS; model boundary BLOCKED (credential absent).",
"is_bot": false,
"headline": "test(expprovider): Codex ACP wire contract validation — 5 live tests",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-05-31T17:24:42Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1f9a7ec5bb896c9058c18286eea14a0e0c8c74e2",
"body": "Adds the dashboard page for managing Experimental providers — the product surface\nthat makes the Experimental ecosystem visible and actionable from the UI.\n\nWhat landed:\n - frontend/src/routes/dashboard/experimental/+page.svelte (new):\n Full-featured Experimental Providers page with:\n * Summa\n[…]\nars for theming, responsive grid.\n - No credential values ever displayed or transmitted (Invariant 3 preserved).\n\nScope: frontend only. Go backend untouched. Full suite 769 pass (backend unaffected).",
"is_bot": false,
"headline": "feat(frontend): P3 — Experimental Provider Dashboard",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-05-31T17:04:49Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4b13da25ebb9c9a96d6988cc97cf4867d7838040",
"body": "Adds the admin-only HTTP API surface for managing Experimental providers from the\ndashboard. All endpoints are behind the existing authMiddleware (fail-closed).\n\nEndpoints:\n GET /api/experimental/providers — list all Cohort-A providers + state\n GET /api/experimental/providers/{name} \n[…]\nandlers_experimental.go (new): 5 handlers + helpers\n - internal/server/server.go: +3 lines (registerExperimentalRoutes call)\n\nScope: internal/server only. framework.go untouched. Full suite 769 pass.",
"is_bot": false,
"headline": "feat(server): P2 — Experimental Provider API",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-05-31T17:01:31Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "70c3e41b6fcdbed30fcc3eb03b6b8d59ce41532d",
"body": "Adds the persistence layer for the Experimental Provider lifecycle so admission\nresults, lifecycle state, validation evidence, and descriptor snapshots survive\nrestarts and are queryable by the API (P2) and dashboard (P3).\n\nWhat landed:\n - internal/expprovider/store.go: Store interface + SQLiteStor\n[…]\nvider output (framework.go unchanged). Single\ntable, JSON columns, append-only audit semantics for admission reports.\n\nScope: internal/expprovider + internal/db. Full suite 769 pass / 0 fail / 43 pkg.",
"is_bot": false,
"headline": "feat(expprovider): P1 — Experimental Registry Persistence",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-05-31T16:57:57Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "0a3f17696c0a702860afc0b5bc07bfb3e3867d57",
"body": "…skeletons + onboardability proof\n\nConsolidation toward Cohort-A readiness. Every Cohort-A provider now has the\nthree legs the framework requires — descriptor + credential mapping + fixture —\nand is PROVEN onboardable through the Generic ACP Framework with ZERO engine\nchange. framework.go is byte-id\n[…]\n modification; no prod touch. Cohort-A descriptors remain WIRE-UNVERIFIED\nscaffold + skeleton — readiness, not validation.\n\nScope confined to internal/expprovider + AGENT.md. Full suite 763 pass (+7).",
"is_bot": false,
"headline": "feat(expprovider): Cohort-A readiness — credential mapping + fixture …",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-05-31T16:28:17Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "52647d15a3f29e3e0b2bf0783db11fdc7622e6f0",
"body": "…riptor + fixture\n\nCodex onboarding proved the full path (LaunchSpec → credential injection →\nadmission harness → membrane-gated registration) end-to-end against a real ACP\nagent. This extracts the provider-AGNOSTIC engine so provider N+1 (Claude Code,\nGemini CLI, Copilot, …) is a DESCRIPTOR + a fix\n[…]\ntests.\n\nScope confined to internal/expprovider. Additive + dormant + membrane-gated; no\nprovider validated, no deploy, no activation, no prod touch. Full suite 756 pass\n(+4 from the genericity tests).",
"is_bot": false,
"headline": "feat(expprovider): Generic ACP Provider Framework — onboarding = desc…",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-05-31T16:03:00Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4794542643821872f3d5f48ce8bc7a8822a502dc",
"body": "…CP turn\n\nLive validation (M5) against real codex-acp 0.15.0 found 4 onboarding\nimplementation gaps in the broker's prompt turn. Foundation/membrane/\nisolation were NOT at fault — these are wire-contract bugs the permissive\nfixtures masked. Remediated:\n\n1. authenticate lifecycle — broker gains ACPCl\n[…]\n1) that run the real binary through\nAdmitCodex.\n\nScope confined to internal/experimental + internal/expprovider. Additive +\ndormant + membrane-gated; production routing untouched. Full suite 752 pass.",
"is_bot": false,
"headline": "fix(expprovider): Codex live-validation remediation — spec-faithful A…",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-05-31T15:30:38Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7f96a7e9f7a4074a9427460eede8c683e0fd65ee",
"body": "…hort A #1)\n\nOnboard Codex as the first concrete Experimental provider on the live foundation\n(reconciled ACP broker, E1 isolation, membrane, F2.4 live, M5 acceptance). ACP\nShape 2: Lintasan drives the codex-acp adapter (Zed's Apache-2.0 ACP wrapper) as\nan E1 subprocess. Additive + dormant + membran\n[…]\n. green, go vet clean, gofmt clean, 748 pass / 0 fail / 43\npkgs (+7 Codex tests). Confined to internal/expprovider/ (+ TestMain dispatch in\ne2e_test.go). Membrane/registry/E1/proxy hot path unchanged.",
"is_bot": false,
"headline": "feat(expprovider): Codex onboarding — first Experimental provider (Co…",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-05-31T14:41:07Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "0a6bbd6cc77eac5eac98844cca2572c2d38e5830",
"body": "…ap 1-5)\n\nReconcile the ACP broker to the real ACP spec (agentclientprotocol.com) so the\nSAME broker can serve Codex/Claude Code/Gemini CLI/Copilot through one Protocol\nGate. Additive + dormant + membrane-gated: no production path imports these\npackages; proxy hot path untouched.\n\n- E1 (subprocess.g\n[…]\nifier fidelity, permission outcome round-trip.\n\nVerify: go build ./... green, go vet clean, gofmt clean, 741 pass / 0 fail / 43\npkgs. Membrane/registry/launcher/credential/lifecycle/routing unchanged.",
"is_bot": false,
"headline": "feat(experimental): ACP wire reconciliation — spec-faithful broker (g…",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-05-31T14:20:25Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "095b5d6ff986648d0a388d45d10b9037c7707257",
"body": "…ormant)\n\nThe provider-agnostic seam connecting the merged foundation (provider SDK +\nmembrane + E1 + ACP) to future Experimental-provider onboarding. NO concrete\nprovider implemented; nothing wired into the live proxy. Additive + dormant.\n\n G1 adapter.go ACPProvider: provider.Provider (Track=E\n[…]\nal injection\nreaching the child (and foreign secret NOT leaking). Full repo suite 43 pkg,\n0 fail. 9 foundation guards green. One-way dep: expprovider -> {provider,\nexperimental}; neither depends back.",
"is_bot": false,
"headline": "feat(expprovider): Experimental-provider substrate G1-G6 (additive, d…",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-05-31T11:38:19Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ca859736100a2ab4646e137543ce8d3313e10858",
"body": "… (Foundation Phase 4)\n\nPHASE 4 (final) of the Experimental Ecosystem Foundation. The Agent Client\nProtocol broker that lets Lintasan (as ACP CLIENT/HOST) drive an agent CLI (as\nACP AGENT) over one official protocol — \"Shape 2\", ZERO reverse-engineering. It\nis layered ON TOP of the Phase-3 E1 byte t\n[…]\n2 + 6 membrane).\n\n=== EXPERIMENTAL ECOSYSTEM FOUNDATION COMPLETE ===\nPhase 1 F2.4 enforcement (00019a9) · Phase 2 membrane (1a24e57) ·\nPhase 3 E1 isolation (2d4de48) · Phase 4 ACP layer (this commit).",
"is_bot": false,
"headline": "feat(experimental): ACP integration layer — JSON-RPC lifecycle broker…",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-05-31T10:46:18Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2d4de48c9a23999cfaf2cd38e565be295e500689",
"body": "PHASE 3 of the Experimental Ecosystem Foundation. A provider-agnostic\nout-of-process subprocess harness — the isolation substrate the Experimental\ncontainer (ACP, Phase 4) runs agent CLIs in. A misbehaving Experimental agent\n(crash / hang / panic / non-zero exit) can NEVER take down the gateway.\n\nNe\n[…]\nlls a hung child, lifecycle guards, missing-path.\nAll 7 pass under `go test -race` (clean). Full suite 714 pass / 0 fail (42 pkgs,\nwas 707/41 — experimental is the new package). Build+vet+gofmt clean.",
"is_bot": false,
"headline": "feat(experimental): E1 process isolation harness (Foundation Phase 3)",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-05-31T10:42:34Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1a24e57a78653fea909e07e13c43e1a811308a34",
"body": "…embrane\n\nPHASE 2 of the Experimental Ecosystem Foundation. Encodes INVARIANT 1 in code:\nproduction/auto/default routing selects ONLY Official-track providers;\nExperimental is reachable EXCLUSIVELY via an explicit opt-in door. Promotion\nExperimental → Official is impossible through the API shape.\n\ni\n[…]\ned,\nno Experimental adapter, no existing routing behavior changed.\n\nTests: +6 membrane guards. Full suite 707 pass / 0 fail (41 pkgs, was 701).\nBuild+vet+gofmt clean. F2.0/F2.1/F2.2 guards stay green.",
"is_bot": false,
"headline": "feat(provider): F2-membrane — Official/Experimental one-way routing m…",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-05-31T10:37:52Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "00019a965a11c18a42476f7218847463cf1bb86a",
"body": "…gated, default OFF)\n\nPHASE 1 of the Experimental Ecosystem Foundation. Enforcement is the \"+ act\"\nhalf of \"shadow + act\": it reuses the EXACT F2.3 re-bake evaluator\n(ShadowEvaluateIdentity → 3-tier resolveIdentityCaps) and derives a fail-open\nkeep mask. No new evaluation, no new resolver, no new id\n[…]\ngin/main's coarse Format-keyed shadow).\n\nNOT activated in prod: flag default OFF. Production flip + enforced bake remain\na separate, evidence-gated production decision per f2.4-implementation-prep.md.",
"is_bot": false,
"headline": "feat(provider+server): F2.4 capability eligibility enforcement (flag-…",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-05-31T10:31:04Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "11bacbbf5709781b7b105c6453f9f291ccb8ea70",
"body": "…regator (observe-only)\n\nCloses the evidence-emission gap from the deploy review: the resolver already\nCOMPUTED all 6 evidence categories but emission was lossy (header ephemeral,\nstderr only on would_exclude>0). Option A adds durable, always-on accumulation.\n\n- shadow_stats.go: ShadowAggregator (th\n[…]\nl capability logic\nstays in the provider package (guards F2.0/F2.1/F2.2 green unchanged). Full suite\n688 green; 3 new aggregator tests.\n\nNOT deployed. Flag capability_shadow_enabled still default OFF.",
"is_bot": false,
"headline": "feat(provider+server): F2.3 Option A — structured shadow evidence agg…",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-05-31T06:30:59Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c9b4b5fb22dada7f4045bbc6d03a7899e17c686c",
"body": "- capability_identity_test.go: 6 tests for 3-tier resolution + fail-open invariant\n- rebake_evidence_test.go: deterministic traffic-shape harness emitting tier\n distribution + would_exclude evidence to rebake-evidence.json. Audits\n fail_open_violations (asserts 0).",
"is_bot": false,
"headline": "test(provider): F2.3 re-bake evidence harness + resolver/fail-open tests",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-05-31T05:36:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cd50b268ac9a3a7a9350e41afcb856ee87144dfe",
"body": "…lver (observe-only)\n\nReplace coarse conn.Format capability key with the APPROVED 3-tier identity\nresolver (per-model catalog -> canonical provider-id -> conservative default).\n\n- capability_identity.go: resolveIdentityCaps + IdentityTier + CandidateIdentity.\n Tier F = models.FindModel(model).Capab\n[…]\noted to wire-protocol label only.\n\nSTILL observe-only. No enforcement. Flag capability_shadow_enabled default OFF.\nFull suite 684 green, guards F2.0/F2.1/F2.2 green unchanged, F2.3 server tests green.",
"is_bot": false,
"headline": "feat(provider+server): F2.3 re-bake — 3-tier capability identity reso…",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-05-31T05:35:25Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e91e5ef0c51b80d305e1c98b1014a60b26b8ffe0",
"body": "- Implement Embedder interface, /v1/embeddings routed through provider contract\n- Byte-parity with legacy path (flag on vs off), custom-auth quirk preserved\n- Flag-gated (default OFF), zero production behavior change\n- Deterministic direct-call parity tests (no DB dependency)\n\nBranch: feat/f2.5-embedder-path @ 20dad85\n\n# Conflicts:\n#\tinternal/server/provider_bootstrap.go\n#\tinternal/server/proxy.go",
"is_bot": false,
"headline": "merge: F2.5 Embedder Path (/v1/embeddings via provider contract)",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-05-31T05:18:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d2e354a313842d3683c2fd34289188aed2b821b1",
"body": "- Wire Satisfies() eval against route candidates via provider-package facade (ShadowEvaluate)\n- Records capability match in routing log + response header, NEVER excludes (observe-only)\n- Flag-gated (default OFF), zero production behavior change\n- Guards F2.0/F2.1/F2.2 stay green unchanged (facade keeps forbidden symbols in provider pkg)\n\nBranch: feat/f2.3-shadow-routing @ 276d771",
"is_bot": false,
"headline": "merge: F2.3 Shadow Routing (capability-aware observe-only routing)",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-05-31T05:17:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "276d771ab3a92b34ae795493657025a197c21a62",
"body": "First capability-AWARE routing surface, but OBSERVE-ONLY: the chat router\nevaluates whether each candidate satisfies the request's required capabilities\nand RECORDS the result, NEVER excluding/reordering/selecting. Enforcement is\nF2.4 (separate checkpoint).\n\n- provider/capability_shadow.go: ShadowEv\n[…]\n\n\nScope: F2.3 ONLY (shadow/observe). No exclusion, no eligibility enforcement, no\nprovider gating, no production deploy. Build/vet/full-suite green (32 pkgs, 0\nfail), all prior guards green unchanged.",
"is_bot": false,
"headline": "feat(provider+server): F2.3 capability shadow routing (observe-only)",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-05-31T05:13:14Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "20dad85eadefba8587348ad9296e1e31c249454f",
"body": "Implement the provider.Embedder optional interface on DefaultProvider and route\n/v1/embeddings through it behind a kill-switch, byte-for-byte identical to the\ninline handler.\n\n- provider/embedder.go: DefaultProvider.Embed builds the /v1/embeddings upstream\n request (URL, POST, Content-Type, faithfu\n[…]\nNo chat routing change, no capability\nfiltering/eligibility (F2.0/F2.1/F2.2 server guards stay green, untouched). Flag\ndefault OFF = zero behavior change. Build/vet/full-suite green (32 pkgs, 0 fail).",
"is_bot": false,
"headline": "feat(provider): F2.5 Embedder execution path (flag-gated, byte-parity)",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-05-31T05:06:07Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a8383e24a0034ab7266b4c58dd967ab1820ae56e",
"body": "…ge README\n\nUpdate Files table with capability_lookup.go (F2.1) and capability_catalog.go\n(F2.2) + their tests. Refresh status block: F2.0/F2.1 merged to main, F2.2 adds\nthe catalog JOIN + /api/capabilities diagnostic facade. Note the F2.2 scope\nguard forbids Satisfies in the server (the F2.4 tripwire).",
"is_bot": false,
"headline": "docs(provider): record F2.1 merge + F2.2 catalog integration in packa…",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-05-31T02:22:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7b7384e46b00713108d762c123d723a3c2516b0b",
"body": "…nostic (read-only)\n\nCatalog JOIN + read-only diagnostic facade — the first capability surface the\nserver consumes, strictly observability. Implements F2 Design Baseline F2.2\nunder locked decisions D1/D2/D3.\n\nWhat it adds over F2.1:\n- provider.CapabilityCatalog(): joins F2.1 declared caps with model\n[…]\nvet green whole-repo, full suite 652 pass / 0 fail\n(41 pkgs), gofmt clean, diff confined to internal/provider + internal/server.\nEndpoint runtime-verified (anonymous 401, authed 200, correct payload).",
"is_bot": false,
"headline": "feat(provider): F2.2 capability catalog join + /api/capabilities diag…",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-05-31T02:20:05Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a95b30a3680c1070fc0e501cb6e5a77e45ff01ec",
"body": "…kage)\n\nFirst consumer of the F2.0 canonical vocabulary. Adds a read-only lookup table\nmapping official provider identity -> declared CapabilitySet (F2 Baseline §2),\nplus the first registry consumption (CapabilityReport), WITHOUT any behavior\nchange.\n\n- CapabilitiesFor(providerID): table lookup with\n[…]\nchange, no provider selection, no eligibility\nfiltering, no production deployment, no experimental layer. Build green, full\nsuite green (32 pkgs, 0 fail; server 8.5s). Only internal/provider/ touched.",
"is_bot": false,
"headline": "feat(provider): F2.1 capability lookup integration (read-only, in-pac…",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-05-31T02:00:00Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f15cb17f5458f5bd760fd141c8ab47959c20c410",
"body": "Architecture-doc update only (no code). Document vocabulary.go + vocabulary_test.go\nin the Files table, add CapJSONMode note, and add an F2.0 status block stating the\nvocabulary is declaration-only with a non-consumption guard, and that F2.1/filtering/\neligibility/routing are not started.",
"is_bot": false,
"headline": "docs(provider): record F2.0 canonical vocabulary in package README",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-05-31T01:42:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "733e4548b98d5b32000969d771294b66ca07a89e",
"body": "Turn the F2 Design Baseline (decision D3) into code structure WITHOUT any\nbehavior change:\n\n- Add CapJSONMode constant (found missing in the F2 capability audit; the\n models catalog tags 20+ models with json_mode but no SDK constant existed).\n- Add CanonicalVocabulary as the single source of truth \n[…]\ne separately-approved F2.1.\n\nScope: F2.0 ONLY. Zero runtime change, zero API change, zero routing change.\nBuild green, full suite green (incl. server 8.85s, provider). Only\ninternal/provider/ touched.",
"is_bot": false,
"headline": "feat(provider): F2.0 canonical capability vocabulary (declaration-only)",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-05-31T01:36:34Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "70089da4ee79ef5688875a21dba7008afa5a1635",
"body": "Reflect the v2.4.0 single-binary migration: backend :20180 serves both\nthe embedded SPA dashboard and the API. Remove the deprecated 2-service\n(SvelteKit :5173 + nginx split) instructions from port map, deploy, and\nquick-reference sections. Add a note that lintasan-dashboard is disabled.",
"is_bot": false,
"headline": "docs(agents): update architecture to single self-contained binary",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-05-30T23:51:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4dea5e5620ee3a109a506d380f6353915162e3c2",
"body": "…ehavior change)\n\nF1 wires the v3 Provider SDK into doUpstream behind provider_sdk_enabled\n(default OFF). When OFF, runtime is bit-for-bit identical to pre-F1.\n\n- internal/provider/ SDK (10 files) cherry-picked from foundation d5b12cc\n- Prepare-only seam in doUpstream (NOT Dispatch — streaming-safe)\n[…]\n21/21, T2 parity (5 formats byte-identical), T3 guards,\n T4 full suite 627, staging streaming sign-off (frame-identical OFF vs ON)\n\nActivation (flag flip) is a SEPARATE checkpoint, not approved here.",
"is_bot": false,
"headline": "Merge F1: Provider SDK Official Layer integration (flag-gated, zero b…",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-05-30T23:49:11Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "5c49c8d4320318f40c1e8c0fd0427552511ee3f9",
"body": "Empirical 4-scenario streaming sign-off driving the REAL HandleChatCompletions\nover real TCP against a deterministic mock SSE upstream. Confounders neutralized\nvia X-Lintasan-Direct (cache+hedge off). Build-tagged 'staging' so it stays out\nof the unit suite.\n\nResults: non-stream byte-identical, 8 frames frame-identical + in order,\n[DONE] present, TTFB OFF=2ms ON=1ms, no buffering (spread 202ms both), upstream\ncalls=1 each. OFF vs ON indistinguishable client-side.",
"is_bot": false,
"headline": "test(staging): F1 streaming verification harness (build-tagged)",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-05-30T23:48:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8b5d494ee075f2dc9d03d660d391403700dd8c55",
"body": "…ehavior change)\n\nWire the v3 Provider SDK into doUpstream behind a default-off kill-switch\n(provider_sdk_enabled). When on, OpenAI-compatible connections build their\nupstream request via DefaultProvider.Prepare; the HTTP call, reliability\nwrapping, and streaming response path stay in the router unt\n[…]\ns: T1 provider unit 21/21, T2 parity (5 formats byte-identical legacy vs SDK),\nT3 guards (default-off, flag parsing, commandcode-legacy), T4 full suite 627 pass\n(+46 vs 581 baseline, zero regression).",
"is_bot": false,
"headline": "feat(provider): F1 Official Layer SDK integration behind flag (zero b…",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-05-30T23:48:05Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "899ee16265b3fee3c10d5c5e7e7dec99d5bb4392",
"body": "The sidebar showed a stale hardcoded \"v2.5\" while the backend reported\nv2.4.0. Fetch the version from /health (single source of truth in the Go\nbinary) on mount so the displayed version always matches the actual build.",
"is_bot": false,
"headline": "fix(ui): sidebar version reads from /health instead of hardcoded string",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-05-30T23:42:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8960000d69a86c3c9a4c6f70a8540cb090f7c20b",
"body": "…eadiness\n\n- Add internal/version package as single source of truth for the build\n version (default 2.4.0, overridable via -ldflags -X).\n- Wire /health, /metrics build_info, and MCP server_info to version.Version\n (was hardcoded 2.0.0 / 2.3.1 / 2.3.0 respectively — now consistent).\n- Makefile LDFL\n[…]\nt.go, metrics_handler_test.go) so a full-history scan\n reports zero leaks. Verified clean: 122 commits scanned, no real secrets.\n\n581 tests pass. Runtime verified: /health and /metrics report v2.4.0.",
"is_bot": false,
"headline": "chore: unify version reporting + add gitleaks allowlist for release r…",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-05-30T23:25:55Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e3107de571d1e5610d711e2db4d0c93ab26f929b",
"body": "The dashboard previously required a separate SvelteKit/Node process (:5173)\nbehind nginx, so the README's \"download one binary and run\" promise was false:\nthe pre-built binary URL 404'd, `./lintasan start` served no UI (just a redirect\nto a 401), and `docker compose up` referenced a compose file tha\n[…]\nOG.\n\nVerified: 581 tests pass (39 pkg, excl. untracked experimental provider pkg),\nstandalone binary serves /dashboard + /login + assets at :20180 with API gated,\nbrowser-confirmed login page renders.",
"is_bot": false,
"headline": "feat: embed dashboard into single self-contained binary (v2.4.0)",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-05-30T16:51:47Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "777a5531935eee39963d81abed0ca32434915b5f",
"body": "…v2.3.7)\n\nThe SvelteKit dashboard called RESTful sub-paths (DELETE /api/keys/{id},\nPATCH /api/plugins/{id}, etc) that were never registered in the mux. Go 1.22\nServeMux is strict on method+path, so every edit/delete/toggle button fell\nthrough to the SPA catch-all and silently returned 405 — buttons \n[…]\nisting stubs that returned success without persisting:\nteam delete, team member add, and webhook create (form posts {url,events}\nwith no action field). +16 unit tests, all persist-verified on staging.",
"is_bot": false,
"headline": "fix(dashboard): register missing REST routes for resource mutations (…",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-05-30T16:20:03Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "62f71d9ed01a45d6ee1ccea5943410a71d72b5a3",
"body": "…ete + self change-password\n\nThe User Management page was scaffolded against a mock schema (name/email/\nstatus) that never matched the backend (username/role/must_change_password),\nso: (1) admin never appeared — frontend read res.data but /api/users returns\na raw array; (2) there was no change-passw\n[…]\nself-service change-password modal. A11y-clean.\n\nTests: +10 auth unit tests (CRUD, last-admin guards, must_change surfacing).\nVerified on staging end-to-end (API + real browser UI). Bump banner 2.3.6.",
"is_bot": false,
"headline": "feat(users): full User Management parity — list/create/role/reset/del…",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-05-30T15:36:06Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2f953d521764024a0a063ce846f9789891e8d4b0",
"body": "…expired'\n\nA 401 from /api/auth/login is a credential rejection, not a session\nexpiry. The shared request() wrapper mapped ALL 401s to the\n'Session expired. Please sign in again.' copy + token-clear + redirect,\nso a wrong password on the login form showed the misleading session\nmessage. Exempt the l\n[…]\nr, no redirect (already on /login). Bump banner to 2.3.5.\n\nVerified in browser: wrong pw -> 'invalid credentials', stays on /login,\nno token written; correct pw -> 200 + dashboard (happy path intact).",
"is_bot": false,
"headline": "fix(auth): login 401 shows 'invalid credentials', not false 'Session …",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-05-30T15:01:22Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "65978377085718288aba2c23177010ddd7e63805",
"body": null,
"is_bot": false,
"headline": "chore(release): bump version banner to 2.3.4",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-05-30T14:48:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d2b1126bb0e55edbb7b68670660a26af450e37ab",
"body": "… cookie reliance\n\nROOT CAUSE (production frontend regression after v2.3.1):\nThe dashboard had TWO divergent auth transports that could desync:\n - api.ts wrapper: reads JWT from localStorage -> sends Authorization: Bearer\n - raw fetch() in savings/translator/mcp/backup/playground/observability:\n \n[…]\nkend unchanged: still accepts cookie OR Bearer, still fail-closed.\nVerified: anon/garbage/MITM = 401, security boundary tests pass, all\ndashboard pages load, console clean, no false 'Session expired'.",
"is_bot": false,
"headline": "fix(auth): unify dashboard auth transport to Bearer; kill split-brain…",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-05-30T13:05:56Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "cb857bd9ecba8654ed25ed23dd097142e3e9f71e",
"body": "…/settings; bump version banner to 2.3.3\n\nSecurity fix:\n- GET /api/settings masked only master_key, leaking jwt_secret in\n plaintext to authenticated admins. A leaked jwt_secret lets an\n attacker forge valid JWTs. Now masks master_key, jwt_secret, and any\n key containing secret/password/api_key/a\n[…]\nxactHits) flagged by\n go vet in handlers_dashboard.go.\n\ngo vet clean, go test ./... 31/31 packages pass. Verified at runtime:\njwt_secret/master_key/api_key masked, non-secret keys (log_level) intact.",
"is_bot": false,
"headline": "fix(security): mask jwt_secret (and all secret-like keys) in GET /api…",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-05-30T12:15:31Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "96cf355a33aadc0aa7b9800d48e518861e3c4d26",
"body": "P1 regression after v2.3.1: migration backfilled must_change_password=1\non the admin account, so the auth middleware returned 403\npassword_change_required on every dashboard endpoint while the frontend\nhad zero handling for the rotation flow. Result: login succeeded but the\ndashboard was unusable (4\n[…]\notstrap state machine, MITM\nhardening, observability) is untouched. Verified end-to-end against an\nACTIVE-state instance: 403 before rotate -> change-password reachable ->\n200 everywhere after rotate.",
"is_bot": false,
"headline": "fix(auth): handle must_change_password flow end-to-end",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-05-30T11:56:42Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c7ae04c2194a01efa9e40d40caf3b6ad27ca6519",
"body": "Adds lintasan_cache_hits_total / lintasan_cache_misses_total (operational\nquestion #3, cache hit rate). Counters live in internal/metrics (atomic, no\nimport cycle), instrumented in proxy.go: CacheHit() on exact + semantic cache\nhits, CacheMiss() once per cache-eligible request that falls through to\n\n[…]\nd from the semantic-SEARCH hit rate card.\n\nTests: TestCacheCounters (metrics pkg) + cache families asserted in the\n/metrics valid-exposition test. go build clean, full suite green, SvelteKit\nbuild OK.",
"is_bot": false,
"headline": "feat(observability): add response-cache hit/miss metric (v2.3.1 #5)",
"author_name": "lintasan-bot",
"author_login": null,
"committed_at": "2026-05-30T09:40:49Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "15fb89113a46a8fcef4b8106ddc6f9470e3e3ec5",
"body": "…v2.3.1 #5)\n\nBackend:\n- New internal/metrics package: dependency-free Prometheus text exposition\n (v0.0.4) registry. HTTP request counter + latency histogram labeled ONLY by\n normalized endpoint group + status class (bounded cardinality). Pull-based\n collectors for memory search counters (H3), pr\n[…]\narn.\n- Sidebar nav entry.\n\nTests: +12 (537 -> 549). Prometheus exposition validity, secret-redaction\ngrep-assert, cardinality guard, search-counter increment via real vector\nSearch, gate-disabled 404.",
"is_bot": false,
"headline": "feat(observability): Prometheus /metrics endpoint + dashboard panel (…",
"author_name": "Ubuntu",
"author_login": null,
"committed_at": "2026-05-30T09:18:24Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "244e9da0ef300f395d039d2df0599dbc5f5300b9",
"body": "H1 (true root cause): /api/stats fired full-table scans on request_logs.\n - idx_request_logs_cached(cached): cached=1 COUNT 540ms -> 0ms (covering)\n - idx_request_logs_status_lat(status, latency_ms): AVG 380ms -> 110ms (covering)\n Measured on 789k-row bench DB via EXPLAIN QUERY PLAN + timing.\n H\n[…]\nd/capped) exposed at /v1/memory/stats\n Applied to both SQLite and Redis(VSET fallback) scan paths.\n\nTests: +3 H3 regression tests (empty-exit, scan cap, unbounded opt-out).\nSuite: 537 pass (was 534).",
"is_bot": false,
"headline": "perf: index /api/stats hot path + cap semantic search (H1/H3)",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-05-30T08:01:48Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "92ae5a9a998e67635da352df3b3e9889278f6646",
"body": "…ection\n\nAdds opt-in env knobs (all defaults preserve current behaviour) and one\nbehaviour fix discovered during the 3-arm benchmark.\n\nInstrumentation (defaults unchanged):\n * LINTASAN_PPROF=1 → pprof on 127.0.0.1:6060 (localhost only, never nginx),\n with mutex+block sampling so all 5 profiles a\n[…]\nH4 CONFIRMED: proxy overhead is 5% at 200ms upstream, 89% at 10ms\n - decision: targeted fixes (memory gate, cache LIMIT+index, stats indexes,\n settings cache), NOT SQLite arch changes. No rewrite.",
"is_bot": false,
"headline": "perf(bench): instrument for v2.3.1 benchmark + gate vector-memory inj…",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-05-30T07:36:13Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f8eb0b1f83741d6c0213ed59d494e3e921acc60a",
"body": "Closes the fail-open class of vulnerabilities found in the deep audit.\nReplaces the implicit \"allow-all on empty master_key\" + \"/api/dashboard/*\nprefix skip\" + static MITM bypass with an explicit two-state machine.\n\nState machine (internal/server/setup.go):\n BOOTSTRAP = NOT(hasAdmin AND hasMasterKe\n[…]\ncases.\n\n534 tests pass. Verified live on an isolated instance: all bootstrap\nendpoints 503, all active anonymous 401, master key 200, admin123 rejected,\nrotation enforced, static MITM header rejected.",
"is_bot": false,
"headline": "fix(security): P0 — fail-closed auth via bootstrap/active state machine",
"author_name": "Sanhaji-SanKhair",
"author_login": "sanhaji182",
"committed_at": "2026-05-30T06:23:45Z",
"body_truncated": true,
"is_coding_agent": false
}
],
"releases_count": 7,
"commits_last_year": 207,
"latest_release_at": "2026-06-30T08:55:20Z",
"latest_release_tag": "v0.26.2",
"releases_from_tags": false,
"days_since_last_push": 20,
"active_weeks_last_year": 6,
"days_since_latest_release": 21,
"mean_days_between_releases": 4.2
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": true,
"health_percentage": 57,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "github.com/sanhaji182/lintasan-go",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "go",
"matches_repo": true,
"registry_url": "https://pkg.go.dev/github.com/sanhaji182/lintasan-go",
"is_deprecated": false,
"latest_version": "v0.29.2",
"repository_url": "https://github.com/sanhaji182/lintasan-go",
"versions_count": 15,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-06-30T15:12:08Z",
"latest_version_yanked": null,
"days_since_latest_publish": 21
}
]
},
"popularity": {
"forks": 0,
"stars": 4,
"watchers": 0,
"fork_history": {
"days": [],
"complete": true,
"collected": 0,
"total_forks": 0
},
"star_history": {
"days": [
{
"date": "2026-05-31",
"count": 1
},
{
"date": "2026-06-02",
"count": 1
},
{
"date": "2026-06-08",
"count": 1
},
{
"date": "2026-07-15",
"count": 1
}
],
"complete": true,
"collected": 4,
"total_stars": 4
},
"open_issues_and_prs": 0
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": true,
"has_mcp_signal": false,
"bootstrap_files": [
"Makefile"
],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [
"frontend/tsconfig.json"
],
"toolchain_manifests": [
"go.mod"
],
"largest_source_bytes": 74006,
"source_files_sampled": 283,
"oversized_source_files": 2,
"agent_instruction_files": [
"AGENTS.md"
],
"agent_instruction_max_bytes": 27192
},
"dependencies": {
"manifests": [
"frontend/package.json",
"go.mod"
],
"advisories": {
"error": null,
"scope": null,
"source": null,
"findings": [],
"collected": false,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 0,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"go",
"npm"
],
"dependencies": [
{
"name": "@sveltejs/adapter-node",
"manifest": "frontend/package.json",
"ecosystem": "npm",
"version_constraint": "^5.5.4"
},
{
"name": "@tailwindcss/vite",
"manifest": "frontend/package.json",
"ecosystem": "npm",
"version_constraint": "^4.3.0"
},
{
"name": "lucide-svelte",
"manifest": "frontend/package.json",
"ecosystem": "npm",
"version_constraint": "^1.0.1"
},
{
"name": "tailwindcss",
"manifest": "frontend/package.json",
"ecosystem": "npm",
"version_constraint": "^4.3.0"
},
{
"name": "github.com/dop251/goja",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.0.0-20260311135729-065cd970411c"
},
{
"name": "github.com/google/uuid",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.6.0"
},
{
"name": "github.com/mattn/go-sqlite3",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.14.44"
},
{
"name": "github.com/spf13/cobra",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.10.2"
}
],
"all_dependencies": {
"error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"source": null,
"packages": [],
"collected": false,
"truncated": false,
"total_count": null,
"direct_count": null,
"indirect_count": null
}
},
"maintainership": {
"issues": {
"open_prs": 0,
"merged_prs": 0,
"open_issues": 0,
"closed_ratio": null,
"closed_issues": 0,
"closed_unmerged_prs": 0
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "sanhaji182",
"commits": 205,
"avatar_url": "https://avatars.githubusercontent.com/u/17717848?v=4"
}
],
"contributors_sampled": 1,
"top_contributor_share": 1
},
"quality_signals": {
"has_ci": false,
"has_tests": true,
"ci_workflows": [],
"has_docs_dir": true,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"go.sum",
"package-lock.json"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 0,
"reason": "branch protection not enabled on development/release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": null,
"reason": "no pull request found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/30 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 0,
"reason": "project has 0 contributing companies or organizations -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": null,
"reason": "no workflows found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 0,
"reason": "project was created within the last 90 days. Please review its contents carefully",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": null,
"reason": "packaging workflow not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 0,
"reason": "dependency not pinned by hash detected -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "no SAST tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": 0,
"reason": "Project has not signed or included provenance with any releases.",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": null,
"reason": "No tokens found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 6,
"reason": "4 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "7fe574d5655c973a3860bd8e3ed139d112b67526",
"ran_at": "2026-07-22T04:22:27Z",
"aggregate_score": 1.8,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-01T08:16:35Z",
"oldest_open_prs": [],
"last_merged_pr_at": null,
"ci_last_conclusion": null,
"oldest_open_issues": []
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/sanhaji182/lintasan",
"host": "github.com",
"name": "lintasan",
"owner": "sanhaji182"
},
"metrics": {
"overall": {
"key": "overall",
"band": "at_risk",
"name": "Overall health",
"note": null,
"notes": [],
"value": 44,
"inputs": {
"security": 18,
"vitality": 67,
"community": 37,
"governance": 35,
"engineering": 58
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "moderate",
"name": "Vitality",
"value": 67,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "moderate",
"name": "Development activity",
"note": null,
"notes": [],
"value": 51,
"inputs": {
"commits_last_year": 207,
"human_commit_share": 1,
"days_since_last_push": 20,
"active_weeks_last_year": 6
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 20 days ago",
"points": 28.8,
"status": "partial",
"details": [
{
"code": "push_recency",
"params": {
"days": 20
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "6/52 weeks with commits",
"points": 4.2,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 6
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "207 commits in the last year",
"points": 18,
"status": "met",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 207
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": null,
"notes": [],
"value": 90,
"inputs": {
"releases_count": 7,
"latest_release_tag": "v0.26.2",
"releases_from_tags": false,
"days_since_latest_release": 21,
"mean_days_between_releases": 4.2
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "7 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 7
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 21 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 21
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~4.2 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 4.2
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "Project has not signed or included provenance with any releases.",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "unverified",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": "repository_too_young",
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": null,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "maintenance record not established from the collected data",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_unverified",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "at_risk",
"name": "Community & Adoption",
"value": 37,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 8,
"inputs": {
"forks": 0,
"stars": 4,
"watchers": 0,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "below_threshold"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "4 stars",
"points": 7.7,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 4
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "0 forks",
"points": 0,
"status": "missed",
"details": [
{
"code": "forks",
"params": {
"count": 0
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "0 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 0
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "good",
"name": "Community health",
"note": null,
"notes": [],
"value": 70,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": true,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (MIT)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "MIT"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 18,
"status": "met",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "at_risk",
"name": "Sustainability & Governance",
"value": 35,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 10,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 1,
"top_contributor_share": 1
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 100% of commits",
"points": 0,
"status": "missed",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 100
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "1 contributors",
"points": 1.4,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 1
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 0 contributing companies or organizations -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "critical",
"name": "Issue & PR responsiveness",
"note": "Excluded from scoring (no data or not applicable): Issue resolution, PR acceptance. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"issue_resolution",
"pr_acceptance"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 1,
"inputs": {
"merged_prs": 0,
"open_issues": 0,
"closed_issues": 0,
"issue_closed_ratio": null,
"closed_unmerged_prs": 0
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "no issues or no data",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_issues_or_data",
"params": {}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "no decided pull requests or no data",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_decided_prs_or_data",
"params": {}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "at_risk",
"name": "Ownership & stewardship",
"note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"verified_domain"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 46,
"inputs": {
"followers": 2,
"owner_type": "User",
"is_verified": null,
"owner_login": "sanhaji182",
"public_repos": 32,
"account_age_days": 3787
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "personal (user) account",
"points": 10,
"status": "partial",
"details": [
{
"code": "owner_personal",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": "not applicable to user accounts",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_applicable_to_user_accounts",
"params": {}
}
],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "2 followers of sanhaji182",
"points": 3.4,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 2,
"login": "sanhaji182"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "32 public repos, account ~10 yr old",
"points": 23.1,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 32
}
},
{
"code": "account_age_years",
"params": {
"years": 10
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"github.com/sanhaji182/lintasan-go"
],
"ecosystems": "go",
"any_deprecated": false,
"min_days_since_publish": 21
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on go",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "go"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 21 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 21
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "15 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 15
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "moderate",
"name": "Engineering Quality",
"value": 58,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "at_risk",
"name": "Engineering practices",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_ci_tests"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 30,
"inputs": {
"has_ci": false,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "no pull request found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "excellent",
"name": "Documentation",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"topics": [
"ai-gateway",
"api-gateway",
"golang",
"llm",
"llm-gateway",
"llm-proxy",
"openai-api",
"self-hosted",
"sqlite",
"svelte"
],
"has_wiki": true,
"homepage": "https://sanhaji182.github.io/lintasan/",
"has_readme": true,
"has_docs_dir": true,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 25,
"status": "met",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": "https://sanhaji182.github.io/lintasan/",
"points": 15,
"status": "met",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": "10 topics",
"points": 10,
"status": "met",
"details": [
{
"code": "topics_count",
"params": {
"count": 10
}
}
],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "critical",
"name": "Security",
"value": 18,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "critical",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): CI-Tests, Dangerous-Workflow, Packaging, Token-Permissions. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"ci_tests",
"dangerous_workflow",
"packaging",
"token_permissions"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 18,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 14,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 4,
"scorecard_aggregate": 1.8
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection not enabled on development/release branches",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "no pull request found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 0 contributing companies or organizations -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no workflows found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow not detected",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "no SAST tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "Project has not signed or included provenance with any releases.",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "No tokens found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "4 existing vulnerabilities detected",
"points": 4.5,
"status": "partial",
"details": [],
"max_points": 7.5
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "good",
"name": "AI Readiness",
"value": 76,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "excellent",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 85,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 1,
"agent_instruction_files": [
"AGENTS.md"
],
"agent_instruction_max_bytes": 27192
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "AGENTS.md",
"points": 45,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "AGENTS.md"
}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "100 of 100 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 100,
"sampled": 100
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "moderate",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 61,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"go.sum",
"package-lock.json"
],
"has_dockerfile": true,
"typed_language": true,
"bootstrap_files": [
"Makefile"
],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [
"frontend/tsconfig.json"
],
"agent_commit_share": 0,
"toolchain_manifests": [
"go.mod"
],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "Makefile",
"points": 18,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Makefile"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "frontend/tsconfig.json",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "frontend/tsconfig.json"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "Dockerfile, lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Dockerfile, lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "no agent-authored commits among the last 100",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_authored_commits",
"params": {
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "Go",
"largest_source_bytes": 74006,
"source_files_sampled": 283,
"oversized_source_files": 2
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Go (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "2/283 source files over 60KB",
"points": 54.6,
"status": "partial",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 283,
"oversized": 2
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
],
"report_type": "repository",
"generated_at": "2026-07-22T04:22:31.798975Z",
"schema_version": "0.26.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/s/sanhaji182/lintasan.svg",
"full_name": "sanhaji182/lintasan",
"license_state": "standard",
"license_spdx": "MIT"
}
Related records
Inspected repositories sharing catalogue tags or ecosystems with sanhaji182/lintasan. Read them side by side →
Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.
Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v1.13.0, schema v0.26.0 — full methodology · metrics wiki.
