Software health reportschema 0.27.0 · metrics 1.13.0 · 2026-07-24 05:20 UTC

tphakala / go-flac

Native, pure-Go SIMD-accelerated FLAC encoder and decoder

Go · AssemblyMIT★ 1 star⑂ 1 forksince Jul 2026View on GitHub ↗

#audio #audio-codec #avx2 #cgo-free #codec #flac #flac-decoder #flac-encoder #go #golang #lossless-audio #neon #pcm #simd

tphakala/go-flac holds a health index of 60 out of 100, placing it in the Moderate band. It scores highest on Engineering Quality (80/100) and lowest on Community & Adoption (24/100). It was last updated today. A single contributor accounts for most of its recent work.

overall / 100

Moderate

Software health index

Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At risk ceiling of 49. AI Readiness sits outside the overall score.

Excellent85-100Exemplary; meets essentially all checked criteria

Good70-84Healthy; minor gaps

Moderate50-69Acceptable with notable gaps; review recommended

At risk30-49Significant weaknesses; adoption warrants caution

Critical1-29Severe problems (abandoned, single-maintainer, no hygiene)

Score profile

Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.

Ownership

Tomi P. HakalaPersonal account

78 followers64 public repossince Mar 2014

This repository is owned by a personal account. A single-owner project carries more continuity risk than an organization-backed one.

Package ecosystems

Registry	Package	Version	Downloads / mo	Versions	Last publish
Go	github.com/tphakala/go-flac	v0.4.3	-	9	2 days ago

Metrics by category

Vitality

Is the project alive — is code being written and are releases shipping?

74Good · 22% of overall

Development activity

56Moderate

How it's scored

36/36	Push recency — last push 0 days ago
4.2/36	Commit cadence — 6/52 weeks with commits
16/18	Commit volume — 59 commits in the last year
0/10	OpenSSF Scorecard: Maintained — project was created within the last 90 days. Please review its contents carefully

Inputs used

commits_last_year	59
human_commit_share	0.949
days_since_last_push	0
active_weeks_last_year	6

Release discipline

100Excellent

How it's scored

27/27	Ships releases — 9 releases published
36/36	Release recency — latest release 2 days ago
27/27	Release cadence — a release every ~0.6 days
0/10	OpenSSF Scorecard: Signed-Releases — no data

Inputs used

releases_count	9
latest_release_tag	v0.4.3
releases_from_tags	no
days_since_latest_release	2
mean_days_between_releases	0.6

Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.

Community & Adoption

Does the project have users, downloads, attention, and a welcoming setup for contributors?

24Critical · 18% of overall

Popularity & adoption

1Critical

How it's scored

0/60	Stars — 1 stars
0/25	Forks — 1 forks
0/15	Watchers — 0 watchers

Inputs used

forks	1
stars	1
watchers	0
growth_state	unverified
growth_factor_pct	100
growth_unverified_reason	no_history

Community health

50Moderate

How it's scored

22.5/22.5	README
22.5/22.5	License — recognized license (MIT)
0/18	CONTRIBUTING guide
0/13.5	Code of conduct
0/7.2	Issue template
0/6.3	PR template

Inputs used

has_readme	yes
has_license	yes
has_contributing	no
has_issue_template	no
has_code_of_conduct	no
has_pull_request_template	no

Sustainability & Governance

Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?

58Moderate · 24% of overall

Maintainer resilience (bus factor)

10Critical

How it's scored

9/54	Bus factor — 1 contributor(s) cover half of all commits
0/22.5	Commit distribution — top contributor authored 100% of commits
1.4/13.5	Contributor breadth — 1 contributors
0/10	OpenSSF Scorecard: Contributors — project has 0 contributing companies or organizations -- score normalized to 0

Inputs used

bus_factor	1
contributors_sampled	1
top_contributor_share	1

Issue & PR responsiveness

81Good

How it's scored

42.9/46.8	Issue resolution — 92% of issues closed
38.2/38.3	PR acceptance — 6/6 decided PRs merged
0/15	OpenSSF Scorecard: Code-Review — Found 0/29 approved changesets -- score normalized to 0

Inputs used

merged_prs	6
open_issues	1
closed_issues	11
issue_closed_ratio	0.917
closed_unmerged_prs	0

Ownership & stewardship

61Moderate

How it's scored

10/30	Ownership backing — personal (user) account
0/20	Verified domain — not applicable to user accounts
13.6/25	Owner reach — 78 followers of tphakala
25/25	Track record — 64 public repos, account ~12 yr old

Inputs used

followers	78
owner_type	User
is_verified	—
owner_login	tphakala
public_repos	64
account_age_days	4,506

Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.

Package maintenance

100Excellent

How it's scored

25/25	Published & resolvable — 1 package(s) on go
35/35	Publish recency — latest publish 2 days ago
20/20	Version history — 9 published versions
20/20	Not deprecated — active, not deprecated or yanked

Inputs used

packages	github.com/tphakala/go-flac
ecosystems	go
any_deprecated	no
min_days_since_publish	2

Engineering Quality

Are baseline engineering and documentation practices in place?

80Good · 20% of overall

Engineering practices

84Good

How it's scored

24/24	CI workflows — 4 workflow(s)
24/24	Tests present
16/16	Linter config — .golangci.yaml
0/9.6	Pre-commit hooks
0/6.4	.editorconfig
20/20	OpenSSF Scorecard: CI-Tests — 6 out of 6 merged PRs checked by a CI test -- score normalized to 10

Inputs used

has_ci	yes
has_tests	yes
has_editorconfig	no
has_linter_config	yes
has_precommit_config	no

Documentation

75Good

How it's scored

30/30	README
0/25	Documentation directory
15/15	Documentation / homepage site — https://pkg.go.dev/github.com/tphakala/go-flac
10/10	Repository description
10/10	Topics — 14 topics
10/10	Wiki

Inputs used

topics	audio, audio-codec, avx2, cgo-free, codec, flac, flac-decoder, flac-encoder, go, golang, lossless-audio, neon, pcm, simd
has_wiki	yes
homepage	https://pkg.go.dev/github.com/tphakala/go-flac
has_readme	yes
has_docs_dir	no
has_description	yes

Security

Are visible security and supply-chain practices strong, without unresolved high-risk jurisdiction exposure?

57Moderate · 16% of overall

Security posture

46At risk

How it's scored

7.5/7.5	Binary-Artifacts — no binaries found in the repo
0/7.5	Branch-Protection — branch protection not enabled on development/release branches
2.5/2.5	CI-Tests — 6 out of 6 merged PRs checked by a CI test -- score normalized to 10
0/2.5	CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected
0/7.5	Code-Review — Found 0/29 approved changesets -- score normalized to 0
0/2.5	Contributors — project has 0 contributing companies or organizations -- score normalized to 0
10/10	Dangerous-Workflow — no dangerous workflow patterns detected
7.5/7.5	Dependency-Update-Tool — update tool detected
5/5	Fuzzing — project is fuzzed
2.5/2.5	License — license file detected
0/7.5	Maintained — project was created within the last 90 days. Please review its contents carefully
0/5	Packaging — no data
0/5	Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0
0/5	SAST — SAST tool is not run on all commits -- score normalized to 0
0/5	Security-Policy — security policy file not detected
0/7.5	Signed-Releases — no data
0/7.5	Token-Permissions — detected GitHub workflow tokens with excessive permissions
7.5/7.5	Vulnerabilities — 0 existing vulnerabilities detected

Inputs used

source	openssf_scorecard
checks_evaluated	16
scorecard_version	v5.5.0
checks_inconclusive	2
scorecard_aggregate	4.6

Excluded from scoring (no data or not applicable): packaging, signed_releases. Remaining weights renormalized.

Dependency advisories

100Excellent

How it's scored

35/35	Direct dependencies free of known advisories — no direct dependency carries a known advisory
0/25	Indirect dependencies free of known advisories — transitive set not separable from development and test dependencies in this scope
0/40	No advisories left outstanding — no advisory carries a publication date

Inputs used

source	osv
advisories	0
affected_packages	0
assessed_packages	3
unassessed_packages	0
affected_by_severity	none
direct_affected_packages	0

Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 3 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.

AI Readiness

How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score.

69Moderate · 0% of overall

Agent context & guidance

40At risk

How it's scored

0/45	Agent instructions — no CLAUDE.md / AGENTS.md / editor rules
0/15	Machine-readable docs (llms.txt)
40/40	Legible commit history — 56 of 56 human commits state their intent (structured subject or explanatory body)

Inputs used

has_llms_txt	no
legible_history_share	1
agent_instruction_files	—
agent_instruction_max_bytes	—

Verify loop (build / test / typecheck)

80Good

How it's scored

18/18	One-command bootstrap — Taskfile.yml
22/22	Automated tests
11/11	Lint / format config — .golangci.yaml
11/11	Static type checking — Go (statically typed)
10/10	Reproducible environment — lockfile
0/10	Demonstrated agent practice — no agent-authored commits among the last 59
8/8	Automated maintenance — 3 of the last 59 commits are automated dependency updates
0/10	OpenSSF Scorecard: Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0

Inputs used

has_nix	no
has_tests	yes
lockfiles	go.sum
has_dockerfile	no
typed_language	yes
bootstrap_files	Taskfile.yml
has_devcontainer	no
has_linter_config	yes
typecheck_configs	—
agent_commit_share	0
toolchain_manifests	go.mod
dependency_bot_commit_share	0.051

Code legibility for models

100Excellent

How it's scored

45/45	Type-checkable code — Go (statically typed)
55/55	Manageable file sizes — 0/163 source files over 60KB

Inputs used

primary_language	Go
largest_source_bytes	23,830
source_files_sampled	163
oversized_source_files	0

Key facts

1GitHub stars

1contributors

59commits, last 12 months

0days since last push

9releases

1bus factor

1open issues

Gopackage ecosystems

Data collection warnings

Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token

More detail

OpenSSF Scorecard 4.6 / 10

4.6aggregate

Independent, tool-agnostic security assessment from the open-source OpenSSF Scorecard. Each check rewards a security practice, not a specific vendor's tool. Checks Scorecard could not determine are marked n/a and excluded from the security score (never counted as zero).Scorecard v5.5.0 · 2026-07-24 05:20 UTC

10	Binary-Artifacts	no binaries found in the repo
0	Branch-Protection	branch protection not enabled on development/release branches
10	CI-Tests	6 out of 6 merged PRs checked by a CI test -- score normalized to 10
0	CII-Best-Practices	no effort to earn an OpenSSF best practices badge detected
0	Code-Review	Found 0/29 approved changesets -- score normalized to 0
0	Contributors	project has 0 contributing companies or organizations -- score normalized to 0
10	Dangerous-Workflow	no dangerous workflow patterns detected
10	Dependency-Update-Tool	update tool detected
10	Fuzzing	project is fuzzed
10	License	license file detected
0	Maintained	project was created within the last 90 days. Please review its contents carefully
n/a	Packaging	packaging workflow not detected
0	Pinned-Dependencies	dependency not pinned by hash detected -- score normalized to 0
0	SAST	SAST tool is not run on all commits -- score normalized to 0
0	Security-Policy	security policy file not detected
n/a	Signed-Releases	no releases found
0	Token-Permissions	detected GitHub workflow tokens with excessive permissions
10	Vulnerabilities	0 existing vulnerabilities detected

Direct dependencies 2

Registry	Package	Version constraint	Manifest
Go	github.com/quasilyte/go-ruleguard/dsl	`v0.3.23`	go.mod
Go	github.com/tphakala/simd	`v1.3.0`	go.mod

All dependencies 3

Full resolved dependency set from the GitHub dependency graph: 2 direct and 1 indirect (transitive) packages. The transitive closure is complete when the repository commits a lockfile.

Registry	Package	Version	Relation
Go	github.com/quasilyte/go-ruleguard/dsl	`v0.3.23`	direct
Go	github.com/tphakala/simd	`v1.3.0`	direct
Go	golang.org/x/sys	`v0.45.0`	indirect

Dependency advisories 0

This repository publishes no package the index resolves, so its own dependency graph was assessed — 3 packages, which also include development and test pins that never ship: 0 carry known advisories, of which 0 are direct.

No known advisories affect the assessed dependencies.

An advisory means the version recorded in the dependency graph falls inside an advisory’s affected range. Reachability is not analysed, and the graph includes development and test pins — a finding may concern tooling rather than shipped software.

Raw JSON report machine-readable

{
  "data": {
    "repo": {
      "topics": [
        "audio",
        "audio-codec",
        "avx2",
        "cgo-free",
        "codec",
        "flac",
        "flac-decoder",
        "flac-encoder",
        "go",
        "golang",
        "lossless-audio",
        "neon",
        "pcm",
        "simd"
      ],
      "is_fork": false,
      "size_kb": 497,
      "has_wiki": true,
      "homepage": "https://pkg.go.dev/github.com/tphakala/go-flac",
      "languages": {
        "Go": 724362,
        "Shell": 5700,
        "Assembly": 103214
      },
      "pushed_at": "2026-07-23T09:24:45Z",
      "created_at": "2026-07-16T08:51:10Z",
      "owner_type": "User",
      "updated_at": "2026-07-23T14:06:08Z",
      "description": "Native, pure-Go SIMD-accelerated FLAC encoder and decoder",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "MIT",
      "default_branch": "main",
      "license_spdx_raw": "MIT",
      "primary_language": "Go",
      "significant_languages": [
        "Go",
        "Assembly"
      ]
    },
    "owner": {
      "blog": null,
      "name": "Tomi P. Hakala",
      "type": "User",
      "login": "tphakala",
      "company": null,
      "location": "Muurame, Finland",
      "followers": 78,
      "avatar_url": "https://avatars.githubusercontent.com/u/7030001?v=4",
      "created_at": "2014-03-22T09:31:18Z",
      "is_verified": null,
      "public_repos": 64,
      "account_age_days": 4506
    },
    "license": {
      "state": "standard",
      "spdx_id": "MIT",
      "raw_spdx": "MIT",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.4.3",
          "kind": "patch",
          "published_at": "2026-07-21T13:39:46Z"
        },
        {
          "tag": "v0.4.2",
          "kind": "patch",
          "published_at": "2026-07-21T13:05:23Z"
        },
        {
          "tag": "v0.4.1",
          "kind": "patch",
          "published_at": "2026-07-18T11:40:46Z"
        },
        {
          "tag": "v0.4.0",
          "kind": "minor",
          "published_at": "2026-07-16T08:52:17Z"
        },
        {
          "tag": "v0.3.1",
          "kind": "patch",
          "published_at": "2026-07-21T13:05:13Z"
        },
        {
          "tag": "v0.3.0",
          "kind": "minor",
          "published_at": "2026-07-16T08:52:16Z"
        },
        {
          "tag": "v0.2.1",
          "kind": "patch",
          "published_at": "2026-07-16T08:52:15Z"
        },
        {
          "tag": "v0.2.0",
          "kind": "minor",
          "published_at": "2026-07-16T08:52:15Z"
        },
        {
          "tag": "v0.1.0",
          "kind": "minor",
          "published_at": "2026-07-16T08:52:14Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "caf9109a81daaa6e88fa587986669f717d4937a1",
          "body": null,
          "is_bot": false,
          "headline": "release: bump flac.Version to 0.4.3",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-07-21T13:39:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0b275abd578ff9358a53cb5cb5abdd4051003948",
          "body": "* fix(pcm): invalidate the decoder when a seek fails part-way\n\nSeekToSample's error paths returned the error without disturbing the\ndecoder, leaving it live but desynced from its source. Every stage past\nthe argument checks repositions the shared d.rs cursor: probe seeks and\nreads directly into d.pr\n[…]\nt decode at the landing offset.\n\nAlso drop the claim that retrying \"on a healthy source\" clears the state,\nsince a bad landing frame is not a source condition.\n\nDocumentation only; no behavior change.",
          "is_bot": false,
          "headline": "fix(pcm): invalidate the decoder when a seek fails part-way (#18)",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-07-21T13:37:44Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "837762b6f462654fcbcadc0938d44d69e36be928",
          "body": "Bumps the github-actions group with 1 update: [actions/setup-go](https://github.com/actions/setup-go).\n\n\nUpdates `actions/setup-go` from 6 to 7\n- [Release notes](https://github.com/actions/setup-go/releases)\n- [Commits](https://github.com/actions/setup-go/compare/v6...v7)\n\n---\nupdated-dependencies:\n\n[…]\nsion-update:semver-major\n  dependency-group: github-actions\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "ci: bump actions/setup-go from 6 to 7 in the github-actions group (#7)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-21T13:05:47Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "dba427a54f34468f1acd92494e14569878a852a3",
          "body": null,
          "is_bot": false,
          "headline": "release: bump flac.Version to 0.4.2",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-07-19T15:50:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "303c5e24e7b619b1d0a390b27bb4166643601ebb",
          "body": "goconst flagged the Diff1..Diff4 and Restore1..Restore4 subtest name\nliterals, which were repeated across the fixed, restore and fuzz tables.\nIndex them from a single diffNames/restoreNames pair instead.",
          "is_bot": false,
          "headline": "test(i32): name the fixed-predictor helpers from one table",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-07-19T15:50:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "234ad90aaef087b5f7dfbd4f7819437780263e18",
          "body": "…le) (#17)\n\nAdd FrameEncoder and FrameDecoder plus meta.DecodeStreamInfo so an\nout-of-module container muxer (go-m4a's FLAC-in-MP4 fLaC/dfLa path) can\nencode and decode individual native FLAC frames and get the 34-byte\nSTREAMINFO body, reusing the existing internal frame coder rather than\nreimplemen\n[…]\nameDecoder decodes\none frame given the STREAMINFO, validating rate/channels/bit-depth against it.\n\nExtract validateConfig from Encoder.init so both encoders share it\n(behavior-preserving).\n\nCloses #14",
          "is_bot": false,
          "headline": "feat(pcm): public frame I/O for container muxing (fLaC/dfLa, Opus-sty…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-07-19T11:00:58Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "544764bf1604821a6b9e16397d3a8a30095b6a4f",
          "body": "The Status section credited the encoder's SIMD and allocation-light design but\nsaid nothing about decode. Record the decoder architecture (64-bit bulk-refill\nbit reader, no per-byte interface dispatch, one reusable read buffer per stream)\nthat landed in #10.",
          "is_bot": false,
          "headline": "docs: note the decoder's 64-bit bulk-refill bit reader in README",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-07-19T10:45:37Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0e888a5a01b25b98f17b19e3e2154cf49c89956f",
          "body": "Rewrites the FLAC bit reader from a single-byte buffer to a 64-bit bulk-refill accumulator with an owned 8 KiB block, removing the per-byte io.ByteReader dispatch that dominated decode. Decode is about 10 percent faster on BenchmarkDecodeSubset; output stays bit-exact (IETF conformance corpus, seek suite, differential oracle fuzzer). The resync scan threads one reusable reader so a seek probe does not allocate per candidate.\n\nCloses #10",
          "is_bot": false,
          "headline": "perf(bitio): 64-bit bulk-refill bit reader, ~10% faster decode (#16)",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-07-19T10:38:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "32d3b662877bc325d043c0a8edf7f0f9663943d6",
          "body": "Two low-risk performance improvements from the profiling session: a steady-state encode benchmark that reuses the Encoder (#11), and a pre-grown bit Writer with single-write flushWord via AppendUint64 (#12). Encode output stays byte-for-byte identical; BenchmarkEncodeRealisticStereo drops from 82 to 66 allocs/op.\n\nCloses #11\nCloses #12",
          "is_bot": false,
          "headline": "perf(bitio): pre-grow Writer and steady-state encode benchmark (#13)",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-07-19T09:32:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "48c0fcb6b1a883a7789f265928eeec512f47ff78",
          "body": null,
          "is_bot": false,
          "headline": "release: bump flac.Version to 0.4.1",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-07-18T11:40:25Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1a03b6abc21e5f4b57f0028cca25620d09363206",
          "body": "…e and short streams (#8)\n\nNon-seekable FLAC encodes (a bytes.Buffer / io.Pipe sink, e.g. birdnet-go's in-memory BirdWeather uploads) left STREAMINFO min_blocksize/max_blocksize at the 0 \"unknown\" sentinel because Close cannot seek back to patch them. RFC 9639 requires those fields to be in 16..6553\n[…]\nath, which this encoder can no longer produce as input, stays covered by synthesizing that fixture. Golden hashes were regenerated; only the STREAMINFO block-size bytes changed (audio byte-identical).",
          "is_bot": false,
          "headline": "fix(pcm): finalize a spec-legal STREAMINFO block size for non-seekabl…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-07-18T11:39:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8cd3236d45d594b380a8f5f398275ae7f99a3771",
          "body": "…ory (#35)\n\nBumps the github-actions group with 1 update in the / directory: [actions/checkout](https://github.com/actions/checkout).\n\n\nUpdates `actions/checkout` from 6 to 7\n- [Release notes](https://github.com/actions/checkout/releases)\n- [Changelog](https://github.com/actions/checkout/blob/main/C\n[…]\nsion-update:semver-major\n  dependency-group: github-actions\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "ci: bump actions/checkout in the github-actions group across 1 direct…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-09T19:14:31Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b61fc4682db5cda9989559d657e1df74f43cd1fa",
          "body": null,
          "is_bot": false,
          "headline": "release: bump flac.Version to 0.4.0",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-07-02T13:35:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a9e91586ddf95e5b773667bd83ca0e9c27ea0894",
          "body": "…rs (#38)\n\nWrite STREAMINFO total_samples up front for non-seekable writers via the new\nConfig.TotalSamples, and have EncodeInterleaved additionally finalize total_samples\nand MD5 from the whole buffer for any io.Writer, with no seek-back and no temp-file\nround trip. The one-shot MD5 pass is net-zero cost (it replaces the per-frame hash\nthat was previously discarded on the non-seekable path) and seekable output stays\nbyte-identical.\n\nFixes #36\nFixes #37",
          "is_bot": false,
          "headline": "pcm: finalize STREAMINFO total_samples and MD5 for non-seekable write…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-07-02T13:33:18Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "97004b3d6a30563972b36e1e3e05f380d5db0ecd",
          "body": null,
          "is_bot": false,
          "headline": "release: bump flac.Version to 0.3.1",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-15T14:44:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "097f63e8e4b5404329d96a1771292061a13b64e9",
          "body": "…dio FLAC playback) (#34)\n\n* fix(frame): write explicit sample rate and bit depth in frame headers\n\nEvery FLAC frame header go-flac wrote coded the sample rate and bit depth\nas 0 (\"read from STREAMINFO\"). That is spec-legal and libFLAC, ffmpeg,\nChrome and Firefox all tolerate it, but Apple CoreAudio\n[…]\nte with no dedicated code that is also outside the escape ranges\n(e.g. an odd rate above 65535 Hz). Output for all valid rates is unchanged,\nso the goldens are untouched. Adds a panic regression test.",
          "is_bot": false,
          "headline": "fix(frame): emit explicit sample rate and bit depth codes (iOS/CoreAu…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-15T14:40:52Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9d7cb5010c19955b9e104fe3d26f4eff74287977",
          "body": "…#25)\n\nBumps the github-actions group with 4 updates in the / directory: [codecov/codecov-action](https://github.com/codecov/codecov-action), [ossf/scorecard-action](https://github.com/ossf/scorecard-action), [actions/upload-artifact](https://github.com/actions/upload-artifact) and [github/codeql-ac\n[…]\nsion-update:semver-patch\n  dependency-group: github-actions\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "ci: bump the github-actions group across 1 directory with 4 updates (…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-13T19:58:28Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ee04f68d73ea510fe7cb0f131ad351c1d3d14780",
          "body": "The exported flac.Version constant (documented as the current library\nversion) was left at 0.1.0 through the v0.2.0 and v0.2.1 tags. Bump it to\n0.3.0 alongside the Encoder.Reset / EncodeInterleaved additions so the\nconstant matches the release tag again.",
          "is_bot": false,
          "headline": "release: bump flac.Version to 0.3.0 (#32)",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-13T16:50:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "945d19e6bf85db27fc9c9f83e38322f6c3a5056c",
          "body": "* pcm: add Encoder.Reset and EncodeInterleaved for pooled encoding\n\nReset(w, cfg) rebinds an existing *Encoder to a new sink and config,\nreusing the per-channel block buffers and frame workspace when the\nchannel count and LPC order are unchanged. This lets callers pool\nencoders (sync.Pool) across ma\n[…]\n error in init() and Close() is\nwrapped with the operation name. Wrap them with the op prefix and %w so\nNewEncoder/Reset header-write failures carry the same context and stay\nerrors.Is/As-unwrappable.",
          "is_bot": false,
          "headline": "pcm: add Encoder.Reset and EncodeInterleaved for pooled encoding (#31)",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-13T16:14:18Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "33a185c26c63d8682bab8df88b0aea09f2bd7937",
          "body": "simd v1.3.0 removes the FLAC-specific i32 kernels (now vendored in-tree under\ninternal/i32 since #27) and keeps its surface generic. go-flac only consumes the\nparts that stayed: simd/cpu (CPU feature detection), simd/f64 (LPC\nautocorrelation), and simd/crc (FLAC CRC-16). This moves the pin off the\nv\n[…]\nease candidate onto the slimmed stable release.\n\nVerified: build/vet on amd64 and arm64, go test -race ./..., and the libFLAC\n1.5.0 cross-validation, all green; encoded output is unchanged.\n\nRefs #26.",
          "is_bot": false,
          "headline": "deps: bump tphakala/simd to v1.3.0 (#28)",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-13T14:30:14Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3577d65f18b8fabf391ad4a708ec43f5ae7bb832",
          "body": "* chore: ignore .codegraph/ index database\n\n* i32: vendor FLAC integer kernels in-tree from tphakala/simd\n\nMove the FLAC-specific int32 SIMD kernels (Rice cost search, fixed\npredictors, quantized LPC encode/restore, stereo decorrelation) into\ninternal/i32 so the codec owns its integer hot path end-t\n[…]\ncorrelation, simd/crc for\nCRC-16). README.md: the integer kernels are in-tree; simd now supplies CPU\ndetection, autocorrelation, and CRC-16.\n\nFound during pre-push review of the kernel move. Refs #26.",
          "is_bot": false,
          "headline": "Vendor the FLAC int32 SIMD kernels in-tree (internal/i32) (#27)",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-13T12:25:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3268d69cf8329423b74ca0655228dc94bbd3d218",
          "body": "The action ran its own nested actions/checkout@v4.1.1 (repo-checkout\ndefault), which failed with git exit 128 / HTTP 400 and also pulled in a\ndeprecated Node 20 action. Replace it with an explicit checkout + setup-go\n+ go install + govulncheck run, matching the rest of the CI workflow.",
          "is_bot": false,
          "headline": "ci: run govulncheck directly instead of golang/govulncheck-action",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-09T10:42:37Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "fd191a8fadc2cd0c5fd5c5a1dd3f766cfa17545d",
          "body": "Expand the README badge row (Go Report Card, codecov, Go version, latest\ntag, OpenSSF Scorecard, GitHub Sponsors) and add a Sponsor section. Add\n.github/FUNDING.yml so the repo surfaces the Sponsor button.\n\nAdd scheduled maintenance automation: Dependabot for Go modules and\nGitHub Actions, a govulncheck workflow (push, PR, weekly), an OpenSSF\nScorecard workflow, and a tag-triggered draft Release workflow.",
          "is_bot": false,
          "headline": "docs: add README badges, sponsorship, and maintenance workflows",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-09T10:40:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "12138c97c78c99966f4b8bb2994b60cb5042580b",
          "body": "Remove the M1-M6/v0.2.0 milestone list from the Status section; the prose\nalready describes the codec's capabilities, and the milestone history lives in\nthe git log and release notes.\n\nAdd a measured encoder comparison (go-flac vs libFLAC, SoX, ffmpeg) on the\nscript's default 30-minute input at leve\n[…]\nore, on both amd64\n(i7-1260P) and arm64 (Cortex-A76). go-flac ties libFLAC's compression ratio\n(0.8523) and beats ffmpeg on throughput and ratio on both architectures;\nlibFLAC stays about 1.5x faster.",
          "is_bot": false,
          "headline": "docs: drop milestone log, add libFLAC/ffmpeg benchmark comparison (#24)",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-05T17:31:30Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b2cf2b7db8132cfafcad0800a96c795bb89f18e4",
          "body": "…ME (#23)\n\nThe Status milestone list stopped at the v0.2.0 SIMD integration (and still\nlabelled it '(next)' while marking it done). Add the byte-identical single-core\nthroughput work that followed (estimate-driven selection, 64-bit bit-writer,\nSIMD autocorrelation/estimate-path/finestMaxU, wider deinterleave, per-order\nfixed-predictor specialization, and the CRC-16 PCLMULQDQ/PMULL fold), and refresh\nthe benchmarking note that still described SIMD as a future track.",
          "is_bot": false,
          "headline": "docs: record the single-core throughput track and CRC-16 fold in READ…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-05T17:10:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6ee28f2e2824b55044b94ffc9603dcc10b62d7f0",
          "body": "…encode) (#22)\n\ninternal/crc.Checksum16 now delegates to simd/crc.Checksum16 (v1.2.0-rc.5),\nwhich folds the buffer 16 bytes at a time with PCLMULQDQ on amd64 and PMULL\non arm64, falling back to the same slice-by-16 table loop on other targets.\nThe local slice-by-16 implementation and its table16x ta\n[…]\n cpu.pmull=off fallback both bit-identical.\n\nEnd-to-end single-core encode throughput (pinned P-core, n=12, p=0.000):\n+6.5% mono / +4.2% stereo on amd64; +2.3% geomean on arm64. Allocations\nunchanged.",
          "is_bot": false,
          "headline": "crc: route Checksum16 through the SIMD PCLMULQDQ/PMULL kernel (~4-6% …",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-05T16:46:17Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2e3786aa64980d2b3a9639abe97c1d7dcfadf43c",
          "body": "…ingle-core, byte-identical) (#21)\n\n* encoder: specialize fixed-predictor residuals per order (~3% stereo single-core, byte-identical)\n\nComputeFixedResiduals (and its int64 wide-path analogue) computed the\nfixed-predictor prediction with an inner loop over a coefficient slice:\n`pred += c * int64(src\n[…]\nesidual funcs\n\nThe per-order specialization commit restated the existing summary\nparagraph above ComputeFixedResiduals and ComputeFixedResiduals64.\nKeep one copy plus the new specialization rationale.",
          "is_bot": false,
          "headline": "encoder: specialize fixed-predictor residuals per order (~3% stereo s…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-05T15:01:44Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "40eb82699459858dabc8d4b8fd2dee3bc1881052",
          "body": "….5% stereo single-core, byte-identical) (#20)\n\ndeinterleaveSamples unpacked interleaved little-endian PCM one byte at a\ntime through a nested sample/channel loop. 16-bit audio (CD, the 48 kHz\ncapture path) is the overwhelmingly common case, so specialize mono and\nstereo at that width: read four sam\n[…]\n41% B/s)\n  EncodeRealisticStereo  -2.44% sec/op  (+2.51% B/s)\n\nNew tests exhaustively verify sign extension across all 65536 16-bit\npatterns and exercise the unrolled-loop tail across odd block sizes.",
          "is_bot": false,
          "headline": "encoder: widen 16-bit PCM deinterleave to 64-bit loads (~5% mono / ~2…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-05T14:12:30Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2048e2355db4ef65937a11e50884424fc0d7248b",
          "body": "…ical, ~6% single-core) (#19)\n\nfinestMaxU's per-partition signed int32 min/max scan was the last scalar\nhot loop in the Rice planner (~6% cum of the stereo encode profile after\nPR #18). Replace the two inline lo/hi loops with simd v1.2.0-rc.4's new\ni32.MinMax, which reduces each partition with VPMIN\n[…]\nease\" warnings.\n\nPinned single-P-core benchstat (GOMAXPROCS=1, n=8): mono +5.3%, stereo\n+7.4%, geomean +6.4% throughput; allocs unchanged. finestMaxU drops\nfrom 6.1% to 0.3% cum in the stereo profile.",
          "is_bot": false,
          "headline": "encoder: SIMD-accelerate finestMaxU per-partition min/max (byte-ident…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-05T13:16:53Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5937da4bfaf8d7a647e5c64fffea0f9e8d10c804",
          "body": "…on maxima (~2.9% single-core, byte-identical) (#18)\n\n* encoder: drop redundant whole-block Rice scan by reducing per-partition maxima (~2.9% single-core, byte-identical)\n\nPlanResidualInt32 scanned the residual block for its min/max twice per call:\nonce globally to size ncols, and once per finest pa\n[…]\nols] reslice in rice planner sums parity test\n\nensure() sizes both sums slices to exactly P*ncols, so the explicit reslice\nin the sentinel-fill and clear was a no-op. Addresses review feedback on #18.",
          "is_bot": false,
          "headline": "encoder: drop redundant whole-block Rice scan by reducing per-partiti…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-05T10:22:09Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6d76221485891517c35deee134c2ec4252ec1e54",
          "body": "…s seekable (#17)\n\n* encoder: fix STREAMINFO min block size so fixed-blocksize output stays seekable\n\nThe encoder folded the final, short block into the STREAMINFO minimum block size,\nso any stream whose length is not a multiple of 4096 reported minBlock != maxBlock\n(e.g. 176 vs 4096). Decoders trea\n[…]\nn unequal pair always also mismatches the expected\nvalues) and only produced a second error line. Fold the invariant into the\nsingle want-based check and keep the seekability rationale in its message.",
          "is_bot": false,
          "headline": "encoder: fix STREAMINFO min block size so fixed-blocksize output stay…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-05T09:28:00Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1460fbc10e6da7a83a1e1fe603a7ec04268089b2",
          "body": "…t/remainder (~15% mono / ~13% stereo, byte-identical) (#16)\n\nThe bit-writer was ~13% of encode CPU. Two byte-identical changes knock it down:\n\n- bitio.Writer now accumulates MSB-first into a 64-bit register and flushes whole\n  8-byte words via binary.BigEndian.PutUint64, instead of appending one by\n[…]\nte identical to main\n(cmp clean). Zero new allocations.\n\nbenchstat (n=6, -benchtime=2s, i7-1260P):\n  EncodeRealistic        2.317m -> 1.970m  -14.99%\n  EncodeRealisticStereo  5.905m -> 5.122m  -13.25%",
          "is_bot": false,
          "headline": "encoder: widen bit-writer to 64-bit word flush + combine Rice quotien…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-05T09:01:58Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "cacdb8847c03a34c9844cce5dcc419e6701cce2b",
          "body": "…o / ~15% stereo) (#15)\n\nautocorrelateInto was the largest remaining single-core hotspot in the encoder\n(~16% mono, ~27% stereo self time): a naive scalar float64 double loop with no\nSIMD. This routes AnalyzeLPC through f64.Autocorrelate from tphakala/simd\nv1.2.0-rc.3, a lag-vectorized kernel (AVX2 \n[…]\ncodeRealistic -8.5%, EncodeRealisticStereo\n    -15.0% (both p=0.002); allocations unchanged.\n  - Profile: autocorrelation drops from the top self-time slot (~27% stereo) to\n    ~11% (the SIMD kernel).",
          "is_bot": false,
          "headline": "encoder: SIMD-accelerate LPC autocorrelation (byte-identical, ~9% mon…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-05T07:14:14Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e1c86a7c4d0abe0aa9883d4f55f7d176803520b0",
          "body": "…edAbsSums, widened RiceSums) (#14)\n\n* rice: SIMD-accelerate ZigzagSum via i32 kernel (byte-identical)\n\nRepin tphakala/simd to v1.2.0-rc.2 (adds the estimate-path i32 kernels) and\nswap the scalar rice.ZigzagSum body for i32.ZigzagSum (AVX2/NEON, pure-Go\nfallback). Bit-identical to the scalar referen\n[…]\nresiduals are coded, so the expected sum is the zero\nvalue of want; gate the reference branch on order < len(x) instead of allocating\nres and slicing res[min(order,len(x)):]. Test-only, same coverage.",
          "is_bot": false,
          "headline": "encoder: SIMD-accelerate the estimate-path primitives (ZigzagSum, Fix…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-05T06:17:52Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "fde6076ac1fd3203b51948a241bade1447c574cb",
          "body": "…ce-by-16) (#13)\n\nTwo byte-identical encoder optimizations:\n\n- Carry the LPC residual from the cost pass into the candidate slot instead of recomputing it with the scalar FIR (was ~15.5% of encode CPU). int32 and int64 paths.\n- CRC-16 slice-by-16 fold (16 bytes/iter, ~1.3x on Checksum16).\n\nLevel 5: \n[…]\ntereo ~39 -> ~48 MB/s, mono ~57 -> ~66 MB/s, allocations unchanged. Verified byte-identical across stereo+mono levels 0-8 and 16/24/32-bit inputs, and with GODEBUG=cpu.avx2=off for SIMD/scalar parity.",
          "is_bot": false,
          "headline": "encoder: byte-identical throughput wins (LPC residual carry + CRC sli…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-04T21:07:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7f87b8737cbd6269c0f155a3bc444acf09c7b998",
          "body": "… 5) (#12)\n\n* test: add realistic sine+noise encode benchmark (representative profile)\n\nThe existing BenchmarkEncode uses genPCM, a ramp whose order-2 residuals\nare near zero, making the Rice search trivial and inverting optimization\nresults. BenchmarkEncodeRealistic and BenchmarkEncodeRealisticSter\n[…]\nn on the scalar\n  fallback path. Suggested by Gemini Code Assist.\n- Add an EstimateRiceBits edge-case test for the n<=0 guard and the zz==0\n  contract, covering a previously-untested defensive branch.",
          "is_bot": false,
          "headline": "encoder: estimate-driven predictor selection (~1.8x single-core level…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-04T19:31:07Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "88db8833e438986037936606fffd434c730211d9",
          "body": "…~2.7x) (#11)\n\n* encoder: SIMD-accelerate Rice/fixed/LPC hot paths via tphakala/simd (~2.7x)\n\nWire the github.com/tphakala/simd i32 kernels into the three encoder hot\npaths the post-M5a profile identified (buildFinestTablesInt32 ~60%,\nComputeFixedResiduals ~12%, ComputeLPCResiduals ~5%):\n\n- Rice par\n[…]\nPartitionSumsParity: pre-fill the result with an all-ones sentinel so the\n  test actually exercises the full-overwrite contract the int32 planner now\n  relies on, including the n==0 case (CodeRabbit).",
          "is_bot": false,
          "headline": "encoder: SIMD-accelerate Rice/fixed/LPC hot paths via tphakala/simd (…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-04T14:37:48Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1dfa451724a1ede3f0b7350ddbbfd44e9f93b1ff",
          "body": "cmd/wav2flac encodes a PCM WAV to FLAC through the streaming pcm.Encoder: a\nrunnable example of the public API and the go-flac side of a reproducible\nencoder benchmark. The WAV header parser is factored out and unit-tested, with\nan end-to-end encode/decode round-trip test through go-flac's own decod\n[…]\n writes\noutputs to a private temp directory, never modifying the input.\n\nThis is the re-runnable basis for the v0.1.0 pre-SIMD performance baseline\n(tracked in the project's internal benchmark notes).",
          "is_bot": false,
          "headline": "Add wav2flac example CLI and encoder benchmark harness (#10)",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-04T13:24:50Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5ed22b3f5905cfb31d173765e271163683321e01",
          "body": "Final pre-release pass for the first tagged release. v0.1.0 ships pure-Go;\nSIMD stays deferred to the v0.2.0 track (no new dependency, kernels untouched).\n\nAPI and godoc:\n- Bump Version to 0.1.0.\n- Remove the unused ErrNotImplemented sentinel. It was dead exported surface\n  now that the codec is fea\n[…]\ndency.\n\nNo behavior change. Verified green: byte-identical golden, libFLAC 1.5.0\ncross-validation (64/64 corpus), LPC and wide-depth round-trip, full -race\nsuite, vet (amd64 and arm64), golangci-lint.",
          "is_bot": false,
          "headline": "M6: v0.1.0 release completeness (godoc/API review, docs sync) (#9)",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-04T13:01:55Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2357a1eadb16ad49cd0052ae37e5e6a0b66f7bd0",
          "body": "…ink write (#8)\n\nTwo forward-looking hardening fixes, byte-identical to current output on every\nsupported path.\n\nfeasiblePmax now clamps maxPartOrder to 15, the largest value the 4-bit FLAC\npartition-order field can hold. paramsForLevel only sets 3..6 today and encoder\nblocks are <= 4096 (2^12), so \n[…]\nhat a failed sink write\nleaves the MD5 reflecting only durably written frames; success-path MD5\nround-trip guard. Full suite, byte-identical golden, libFLAC cross-validation,\nand fuzz seeds all green.",
          "is_bot": false,
          "headline": "encoder: clamp Rice partition order to 15 and defer MD5 ingest past s…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-04T12:14:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7ba6dc8173d558fb924ff7e993a2635a79cbc010",
          "body": null,
          "is_bot": false,
          "headline": "docs: update README for M5a (encoder workspace + merge-upward Rice)",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-04T11:34:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0541f9e9f647cbbeb862cb9497538a6d039d9709",
          "body": "Per-encoder reusable Workspace + libFLAC merge-upward Rice partition search, plus finest-pass bounds-check/shift-guard removal. Byte-identical output (golden + libFLAC cross-validation + fuzz). Allocations 2726 -> ~0/block; BenchmarkEncode ~25.5ms -> ~15.3ms (-40%, +65% throughput). Public pcm API unchanged.",
          "is_bot": false,
          "headline": "M5a: encoder workspace + merge-upward Rice (byte-identical) (#7)",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-04T11:29:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9a85b8c2a5fb5c3f39b62e619f04af36c1933d6c",
          "body": "…ection, opt-in SEEKTABLE) (#6)\n\nDecode side: sample-accurate pcm.Decoder.SeekToSample over a retained io.ReadSeeker (byte-offset binary search with CRC-16-verified probes; a present SEEKTABLE narrows it), an internal CRC-16 frame finder for seek landing, and truncated-stream detection (ErrTruncated\n[…]\nnged, and SEEKTABLE seeks are about 3x faster than binary search.\n\nAlso makes the pre-push git hook a fast build+vet check, leaving the full race suite, fuzz seeds, and libFLAC cross-validation to CI.",
          "is_bot": false,
          "headline": "M4: streaming hardening (sample-accurate SeekToSample, truncation det…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-03T22:46:59Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "0beec21d966f95ac8559b5759ca7a4b9a72eb879",
          "body": "The encoder now supports bit depths 4-32 with quantized LPC. Mark M3b and M3c\ndone in the milestone list, note the int32 (<= 24 bps) vs int64 (25-32 bps)\npaths and the byte-identical <= 24 bps output, and drop the stale (M3) and\n4-24 references.",
          "is_bot": false,
          "headline": "docs: update README for M3b (LPC) and M3c (25-32 bps) completion",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-03T17:32:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f81da3e471d6fded12b4080e354aded2960a3575",
          "body": "…completion) (#5)\n\n* test: wide-depth helpers and int32 golden baseline capture\n\n* feat(rice): int64 residual encode path and wide-residual escape fix\n\n* feat(lpc): int64 fixed and LPC residual kernels (exact inverse anchor)\n\n* refactor(lpc): make AnalyzeLPC generic over Sample for the int64 path\n\n*\n[…]\neds 2^31, which overflows a 32-bit\n  int constant and fails to compile on 386/arm; compute it in uint32.\n\nVerified: golden hashes unchanged, parity test passes, both packages compile\nunder GOARCH=386.",
          "is_bot": false,
          "headline": "M3c: 25-32 bps wide bit-depth encoding (int64 path, decoder dispatch …",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-03T17:31:00Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d7d781bb2ff060e9c109831bbeb8da30b5fdcc08",
          "body": "* feat(lpc): add ComputeLPCResiduals, the integer inverse of RestoreLPC\n\n* feat(frame): add LPC params (MaxLPCOrder, LPCPrecision, Apodization)\n\n* feat(lpc): add Tukey window for LPC apodization\n\n* feat(lpc): add autocorrelation\n\n* feat(lpc): add Levinson-Durbin recursion\n\n* feat(lpc): add coefficie\n[…]\nng 1<<(precision-1) or emitting the\n  reserved 4-bit code 15.\n- CI: raise the race and coverage test timeout to 20m; the LPC-active pcm\n  suite exceeds the default 10m per-package limit on CI runners.",
          "is_bot": false,
          "headline": "M3b: quantized LPC encoding (SUBFRAME_LPC, compression levels 3-8) (#4)",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-03T13:38:32Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "54a2aa6d0708b76524139f4d4cf8a75344e5ea47",
          "body": "… hot-loop perf (#3)\n\n* M3 hardening: int64 Rice cost accumulator + bounded carry buffer\n\nTwo low-risk follow-ups from the M3 encoder gate review. No public API\nchange and no bitstream change for any valid input.\n\n1. Rice bit-cost search (internal/rice/encode.go): widen the cost\n   accumulator and p\n[…]\nchmarkEncode: a further -6.3% sec/op, +6.7% B/s (p=0.009, n=6) on top of the\nshift-count mask. Round-trip and libFLAC cross-validation stay green on amd64\nand GOARCH=386. Suggested in review on PR #3.",
          "is_bot": false,
          "headline": "M3 hardening: int64 Rice cost accumulator, bounded carry buffer, Rice…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-03T09:43:43Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f576662500efd607c30d3afae617b277b95e84aa",
          "body": "…der) (#2)\n\n* feat(flac): add ErrEncoderClosed sentinel\n\n* feat(bitio): add MSB-first bit Writer\n\n* feat(rice): add partitioned Rice residual encoder with parameter search\n\nImplements EncodeResidual (inverse of DecodeResidual) and CostResidual\nin internal/rice/encode.go. Uses a zigzag forward transf\n[…]\nemaining hot spots (rice.riceBits, the per-call zz and partPlan buffers,\nthe per-frame side/mid buffers) need a cross-package scratch workspace and are\nleft to the M5 performance track per the design.",
          "is_bot": false,
          "headline": "M3: pure-Go FLAC encoder (fixed predictors, four-way stereo, pcm.Enco…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-02T22:21:37Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4de619476c09a0cee17e100203b836a598d804e9",
          "body": null,
          "is_bot": false,
          "headline": "docs: add badges, install, and a runnable decoder example to README",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-02T18:02:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c578aa44d1e48be0a5fea83f3f4c02cc8fb32380",
          "body": "* feat(flac): add decoder sentinel errors\n\nAdd ErrSeekUnsupported, ErrMissingStreamInfo, ErrCRCMismatch,\nErrMD5Mismatch, and ErrUnsupported alongside the existing\nErrNotImplemented. All are distinct errors.Is-testable sentinels\ncovering the core decoder error vocabulary for M2.\n\n* feat(bitio): MSB-f\n[…]\n t.Context() and surfaces its stderr on failure.\n- README clarifies SeekToSample (ErrSeekUnsupported for non-seekable sources,\n  ErrNotImplemented otherwise); the validate task notes its requirements.",
          "is_bot": false,
          "headline": "M2: pure-Go FLAC decoder (bitstream, frames, pcm.Decoder) (#1)",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-02T17:58:01Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "43deafb62378159ca7ad8f066d1406ea707cea12",
          "body": null,
          "is_bot": false,
          "headline": "test: wire IETF flac-test-files submodule and small-corpus placeholder",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-02T13:51:52Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "16c2ac3bcd68147bca9cf6d30f38c7bf82bacb0e",
          "body": null,
          "is_bot": false,
          "headline": "ci: add GitHub Actions workflow (build, test, vet, lint; amd64+arm64)",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-02T13:50:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a17e792d4d3e09b3a31bcf68827ac8e4d0584096",
          "body": null,
          "is_bot": false,
          "headline": "build: add pre-commit and pre-push git hooks",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-02T13:49:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b8ae53d287cc154e36bdada1a911504c0c6003c4",
          "body": "golangci-lint config adapted from tphakala/birdnet-go for a shared\nlinting standard, with gocritic's ruleguard wired to rules/*.go for\nmodern-Go pattern enforcement (errors.AsType, min/max builtins, slices\nhelpers, etc.). The 12 rule files carry the //go:build ruleguard tag so\nthe normal toolchain i\n[…]\nexclusion, the\nbirdnet-go-specific forbidigo logger patterns, and the gosec settings\nblock (gosec not enabled). modernize stays disabled (it panics on\nGo 1.26 + atomic types in golangci-lint v2.11.4).",
          "is_bot": false,
          "headline": "build: add Taskfile and golangci-lint config with ruleguard",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-02T13:49:05Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1f6c2bdaeaeec4d3c690b8b4719fd5b411fb7669",
          "body": "Decoder exposes SeekToSample(int64) for sample-accurate seeking rather\nthan Seek; the name Seek is reserved by go vet stdmethods for the\nio.Seeker signature Seek(int64, int).",
          "is_bot": false,
          "headline": "feat: add pcm public API stubs (Encoder, Decoder, Config)",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-02T13:41:18Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4c1840516faeaba0b35374bb063968a8454791fc",
          "body": "…ame, meta)",
          "is_bot": false,
          "headline": "feat: add internal codec package skeletons (bitio, crc, rice, lpc, fr…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-02T13:37:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c4045a32dde78dfef33ddf2e22ea691ccc57733d",
          "body": "…mented)",
          "is_bot": false,
          "headline": "feat: add root package shared types (StreamInfo, Version, ErrNotImple…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-02T13:37:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9766777cf8a711f91d3035acafaa6f41bc1ee157",
          "body": null,
          "is_bot": false,
          "headline": "docs: add MIT license, third-party provenance, and README",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-02T13:35:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c1fb5a96ab424390b6c64826939a7bba95fd8876",
          "body": null,
          "is_bot": false,
          "headline": "chore: initialize go-flac module (go 1.26)",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-02T13:35:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        }
      ],
      "releases_count": 9,
      "commits_last_year": 59,
      "latest_release_at": "2026-07-21T13:39:46Z",
      "latest_release_tag": "v0.4.3",
      "releases_from_tags": false,
      "days_since_last_push": 0,
      "active_weeks_last_year": 6,
      "days_since_latest_release": 2,
      "mean_days_between_releases": 0.6
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": false,
      "health_percentage": 42,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "github.com/tphakala/go-flac",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": true,
          "registry_url": "https://pkg.go.dev/github.com/tphakala/go-flac",
          "is_deprecated": false,
          "latest_version": "v0.4.3",
          "repository_url": "https://github.com/tphakala/go-flac",
          "versions_count": 9,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-21T13:39:04Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 2
        }
      ]
    },
    "popularity": {
      "forks": 1,
      "stars": 1,
      "watchers": 0,
      "fork_history": {
        "days": [
          {
            "date": "2026-07-23",
            "count": 1
          }
        ],
        "complete": true,
        "collected": 1,
        "total_forks": 1
      },
      "star_history": null,
      "open_issues_and_prs": 2
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [],
      "has_llms_txt": false,
      "has_dockerfile": false,
      "has_mcp_signal": false,
      "bootstrap_files": [
        "Taskfile.yml"
      ],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [
        "go.mod"
      ],
      "largest_source_bytes": 23830,
      "source_files_sampled": 163,
      "oversized_source_files": 0,
      "agent_instruction_files": [],
      "agent_instruction_max_bytes": null
    },
    "dependencies": {
      "manifests": [
        "go.mod"
      ],
      "advisories": {
        "error": null,
        "scope": "repository_graph",
        "source": "osv",
        "findings": [],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {},
        "advisory_count": 0,
        "affected_count": 0,
        "assessed_count": 3,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "go"
      ],
      "dependencies": [
        {
          "name": "github.com/quasilyte/go-ruleguard/dsl",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.3.23"
        },
        {
          "name": "github.com/tphakala/simd",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.3.0"
        }
      ],
      "all_dependencies": {
        "error": null,
        "source": "github-sbom",
        "packages": [
          {
            "name": "github.com/quasilyte/go-ruleguard/dsl",
            "direct": true,
            "version": "v0.3.23",
            "ecosystem": "go"
          },
          {
            "name": "github.com/tphakala/simd",
            "direct": true,
            "version": "v1.3.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sys",
            "direct": false,
            "version": "v0.45.0",
            "ecosystem": "go"
          }
        ],
        "collected": true,
        "truncated": false,
        "total_count": 3,
        "direct_count": 2,
        "indirect_count": 1
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 1,
        "merged_prs": 6,
        "open_issues": 1,
        "closed_ratio": 0.917,
        "closed_issues": 11,
        "closed_unmerged_prs": 0
      },
      "bus_factor": 1,
      "bot_contributors": 1,
      "top_contributors": [
        {
          "type": "User",
          "login": "tphakala",
          "commits": 56,
          "avatar_url": "https://avatars.githubusercontent.com/u/7030001?v=4"
        }
      ],
      "contributors_sampled": 1,
      "top_contributor_share": 1
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "ci.yml",
        "govulncheck.yml",
        "release.yml",
        "scorecard.yml"
      ],
      "has_docs_dir": false,
      "linter_configs": [
        ".golangci.yaml"
      ],
      "has_editorconfig": false,
      "has_linter_config": true,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "go.sum"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 10,
            "reason": "6 out of 6 merged PRs checked by a CI test -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/29 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 0,
            "reason": "project has 0 contributing companies or organizations -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 10,
            "reason": "update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 10,
            "reason": "project is fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 0,
            "reason": "project was created within the last 90 days. Please review its contents carefully",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": null,
            "reason": "packaging workflow not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 0,
            "reason": "dependency not pinned by hash detected -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "SAST tool is not run on all commits -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 0,
            "reason": "security policy file not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": null,
            "reason": "no releases found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 10,
            "reason": "0 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "caf9109a81daaa6e88fa587986669f717d4937a1",
        "ran_at": "2026-07-24T05:20:23Z",
        "aggregate_score": 4.6,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": false,
      "has_dependabot_config": true
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-23T09:24:50Z",
      "oldest_open_prs": [
        {
          "number": 19,
          "created_at": "2026-07-23T09:24:46Z",
          "last_comment_at": "2026-07-23T09:35:12Z",
          "last_comment_author": "codecov"
        }
      ],
      "last_merged_pr_at": "2026-07-21T13:37:44Z",
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": [
        {
          "number": 9,
          "created_at": "2026-07-18T11:22:58Z",
          "last_comment_at": null,
          "last_comment_author": null
        }
      ]
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/tphakala/go-flac",
    "host": "github.com",
    "name": "go-flac",
    "owner": "tphakala"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "moderate",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 60,
      "inputs": {
        "security": 57,
        "vitality": 74,
        "community": 24,
        "governance": 58,
        "engineering": 80
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "good",
        "name": "Vitality",
        "value": 74,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "moderate",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 56,
            "inputs": {
              "commits_last_year": 59,
              "human_commit_share": 0.949,
              "days_since_last_push": 0,
              "active_weeks_last_year": 6
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 0 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 0
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "6/52 weeks with commits",
                "points": 4.2,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 6
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "59 commits in the last year",
                "points": 16,
                "status": "partial",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 59
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "releases_count": 9,
              "latest_release_tag": "v0.4.3",
              "releases_from_tags": false,
              "days_since_latest_release": 2,
              "mean_days_between_releases": 0.6
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "9 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 9
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 2 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 2
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~0.6 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 0.6
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "critical",
        "name": "Community & Adoption",
        "value": 24,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 1,
            "inputs": {
              "forks": 1,
              "stars": 1,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "1 stars",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "1 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "moderate",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 50,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": false,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (MIT)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "MIT"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "moderate",
        "name": "Sustainability & Governance",
        "value": 58,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 10,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 1,
              "top_contributor_share": 1
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 100% of commits",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 100
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "1 contributors",
                "points": 1.4,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 0 contributing companies or organizations -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "good",
            "name": "Issue & PR responsiveness",
            "note": null,
            "notes": [],
            "value": 81,
            "inputs": {
              "merged_prs": 6,
              "open_issues": 1,
              "closed_issues": 11,
              "issue_closed_ratio": 0.917,
              "closed_unmerged_prs": 0
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "92% of issues closed",
                "points": 42.9,
                "status": "partial",
                "details": [
                  {
                    "code": "issues_closed_share",
                    "params": {
                      "share": 92
                    }
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "6/6 decided PRs merged",
                "points": 38.2,
                "status": "met",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 6,
                      "decided": 6
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/29 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "moderate",
            "name": "Ownership & stewardship",
            "note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "verified_domain"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 61,
            "inputs": {
              "followers": 78,
              "owner_type": "User",
              "is_verified": null,
              "owner_login": "tphakala",
              "public_repos": 64,
              "account_age_days": 4506
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "personal (user) account",
                "points": 10,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_personal",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": "not applicable to user accounts",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_applicable_to_user_accounts",
                    "params": {}
                  }
                ],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "78 followers of tphakala",
                "points": 13.6,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 78,
                      "login": "tphakala"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "64 public repos, account ~12 yr old",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 64
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 12
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "github.com/tphakala/go-flac"
              ],
              "ecosystems": "go",
              "any_deprecated": false,
              "min_days_since_publish": 2
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on go",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "go"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 2 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 2
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "9 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 9
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "good",
        "name": "Engineering Quality",
        "value": 80,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "good",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 84,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": true,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "4 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 4
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": ".golangci.yaml",
                "points": 16,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yaml"
                    }
                  }
                ],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "6 out of 6 merged PRs checked by a CI test -- score normalized to 10",
                "points": 20,
                "status": "met",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "good",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 75,
            "inputs": {
              "topics": [
                "audio",
                "audio-codec",
                "avx2",
                "cgo-free",
                "codec",
                "flac",
                "flac-decoder",
                "flac-encoder",
                "go",
                "golang",
                "lossless-audio",
                "neon",
                "pcm",
                "simd"
              ],
              "has_wiki": true,
              "homepage": "https://pkg.go.dev/github.com/tphakala/go-flac",
              "has_readme": true,
              "has_docs_dir": false,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": "https://pkg.go.dev/github.com/tphakala/go-flac",
                "points": 15,
                "status": "met",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": "14 topics",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "topics_count",
                    "params": {
                      "count": 14
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "moderate",
        "name": "Security",
        "value": 57,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "at_risk",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): Packaging, Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "packaging",
                    "signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 46,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 16,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 2,
              "scorecard_aggregate": 4.6
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "6 out of 6 merged PRs checked by a CI test -- score normalized to 10",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/29 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 0 contributing companies or organizations -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "update tool detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is fuzzed",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow not detected",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool is not run on all commits -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file not detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "0 existing vulnerabilities detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "excellent",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 3 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "indirect_dependencies_free_of_known_advisories",
                    "no_advisories_left_outstanding"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_repository",
                "params": {
                  "assessed": 3
                }
              },
              {
                "code": "advisories_repo_graph_caveat",
                "params": {}
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "source": "osv",
              "advisories": 0,
              "affected_packages": 0,
              "assessed_packages": 3,
              "unassessed_packages": 0,
              "affected_by_severity": "none",
              "direct_affected_packages": 0
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "no direct dependency carries a known advisory",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "no_direct_advisories",
                    "params": {}
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "transitive set not separable from development and test dependencies in this scope",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_scope_not_separable",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory carries a publication date",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_no_publication_date",
                    "params": {}
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 3,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 2
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "moderate",
        "name": "AI Readiness",
        "value": 69,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "at_risk",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 1,
              "agent_instruction_files": [],
              "agent_instruction_max_bytes": null
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "no CLAUDE.md / AGENTS.md / editor rules",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_instructions",
                    "params": {}
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "56 of 56 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 56,
                      "sampled": 56
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "good",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 80,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "go.sum"
              ],
              "has_dockerfile": false,
              "typed_language": true,
              "bootstrap_files": [
                "Taskfile.yml"
              ],
              "has_devcontainer": false,
              "has_linter_config": true,
              "typecheck_configs": [],
              "agent_commit_share": 0,
              "toolchain_manifests": [
                "go.mod"
              ],
              "dependency_bot_commit_share": 0.051
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "Taskfile.yml",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Taskfile.yml"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": ".golangci.yaml",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yaml"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "Go (statically typed)",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "no agent-authored commits among the last 59",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_authored_commits",
                    "params": {
                      "sampled": 59
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "3 of the last 59 commits are automated dependency updates",
                "points": 8,
                "status": "met",
                "details": [
                  {
                    "code": "dependency_bot_commits",
                    "params": {
                      "count": 3,
                      "sampled": 59
                    }
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "Go",
              "largest_source_bytes": 23830,
              "source_files_sampled": 163,
              "oversized_source_files": 0
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Go (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "0/163 source files over 60KB",
                "points": 55,
                "status": "met",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 163,
                      "oversized": 0
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-24T05:20:31.721544Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/t/tphakala/go-flac.svg",
  "full_name": "tphakala/go-flac",
  "license_state": "standard",
  "license_spdx": "MIT"
}

Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.

Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v1.13.0, schema v0.27.0 — full methodology · metrics wiki.

How one result sits in the wider record: aggregate statistics — Go.

Software health index

Score profile

Ownership

Package ecosystems

Metrics by category

Key facts

Data collection warnings

More detail

Related records