akua-dev / akua

Не вдалося зібрати розв'язаний набір залежностей для цього звіту: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository

Встановлення npm:@akua-dev/sdk@0.8.25 тягне 16 пакетів, прямих і транзитивних: 0 мають відомі сповіщення, з них 0 — прямі залежності.

Жодне відоме сповіщення не стосується оцінених залежностей.

Сповіщення означає, що версія, записана в графі залежностей, потрапляє в уражений діапазон. Досяжність не аналізується, а граф містить піниї розробки й тестування — знахідка може стосуватися інструментів, а не поставленого коду.

{
  "data": {
    "repo": {
      "topics": [
        "devops",
        "helm",
        "infrastructure-as-code",
        "kcl",
        "kubernetes",
        "kustomize",
        "rust",
        "security",
        "webassembly",
        "agentic-infra",
        "aumakua"
      ],
      "is_fork": false,
      "size_kb": 22145,
      "has_wiki": true,
      "homepage": "https://cli.akua.dev",
      "languages": {
        "Go": 10777,
        "KCL": 5485,
        "HTML": 1658098,
        "Rust": 1744189,
        "Shell": 28709,
        "Dockerfile": 829,
        "JavaScript": 29217,
        "PowerShell": 4421,
        "TypeScript": 182905
      },
      "pushed_at": "2026-07-24T12:49:32Z",
      "created_at": "2026-04-17T10:49:09Z",
      "owner_type": "Organization",
      "updated_at": "2026-07-26T16:28:01Z",
      "description": "Replace bureaucratic YAML mass with high-energy, deterministic contracts. The Deno of Infra",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "Apache-2.0",
      "default_branch": "main",
      "license_spdx_raw": "Apache-2.0",
      "primary_language": "Rust",
      "significant_languages": [
        "Rust",
        "HTML"
      ]
    },
    "owner": {
      "blog": "https://akua.dev",
      "name": "Akua - Build autonomous companies ",
      "type": "Organization",
      "login": "akua-dev",
      "company": null,
      "location": "Germany",
      "followers": 11,
      "avatar_url": "https://avatars.githubusercontent.com/u/173261869?v=4",
      "created_at": "2024-06-19T11:06:33Z",
      "is_verified": null,
      "public_repos": 15,
      "account_age_days": 769
    },
    "license": {
      "state": "standard",
      "spdx_id": "Apache-2.0",
      "raw_spdx": "Apache-2.0",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.8.25",
          "kind": "patch",
          "published_at": "2026-07-11T23:50:28Z"
        },
        {
          "tag": "v0.8.24",
          "kind": "patch",
          "published_at": "2026-07-07T20:08:53Z"
        },
        {
          "tag": "v0.8.23",
          "kind": "patch",
          "published_at": "2026-06-23T12:14:59Z"
        },
        {
          "tag": "v0.8.22",
          "kind": "patch",
          "published_at": "2026-06-18T15:35:19Z"
        },
        {
          "tag": "v0.8.21",
          "kind": "patch",
          "published_at": "2026-06-12T18:19:39Z"
        },
        {
          "tag": "v0.8.20",
          "kind": "patch",
          "published_at": "2026-06-09T07:05:39Z"
        },
        {
          "tag": "v0.8.19",
          "kind": "patch",
          "published_at": "2026-06-01T08:55:56Z"
        },
        {
          "tag": "v0.8.18",
          "kind": "patch",
          "published_at": "2026-05-29T19:31:15Z"
        },
        {
          "tag": "v0.8.17",
          "kind": "patch",
          "published_at": "2026-05-29T17:37:06Z"
        },
        {
          "tag": "v0.8.16",
          "kind": "patch",
          "published_at": "2026-05-29T15:30:50Z"
        },
        {
          "tag": "v0.8.15",
          "kind": "patch",
          "published_at": "2026-05-29T14:22:03Z"
        },
        {
          "tag": "v0.8.14",
          "kind": "patch",
          "published_at": "2026-05-29T12:39:28Z"
        },
        {
          "tag": "v0.8.13",
          "kind": "patch",
          "published_at": "2026-05-20T19:44:51Z"
        },
        {
          "tag": "v0.8.11",
          "kind": "patch",
          "published_at": "2026-05-19T18:18:33Z"
        },
        {
          "tag": "v0.8.10",
          "kind": "patch",
          "published_at": "2026-05-16T15:06:57Z"
        },
        {
          "tag": "v0.8.8",
          "kind": "patch",
          "published_at": "2026-05-07T20:20:19Z"
        },
        {
          "tag": "v0.8.7",
          "kind": "patch",
          "published_at": "2026-05-07T13:33:15Z"
        },
        {
          "tag": "akua-v0.8.6",
          "kind": "other",
          "published_at": "2026-05-06T12:47:59Z"
        },
        {
          "tag": "akua-v0.8.5",
          "kind": "other",
          "published_at": "2026-05-04T22:42:25Z"
        },
        {
          "tag": "akua-v0.8.4",
          "kind": "other",
          "published_at": "2026-05-04T21:47:55Z"
        },
        {
          "tag": "akua-v0.8.3",
          "kind": "other",
          "published_at": "2026-04-29T17:45:12Z"
        },
        {
          "tag": "akua-v0.8.1",
          "kind": "other",
          "published_at": "2026-04-29T14:50:30Z"
        },
        {
          "tag": "akua-v0.8.0",
          "kind": "other",
          "published_at": "2026-04-29T12:12:18Z"
        },
        {
          "tag": "akua-v0.7.0",
          "kind": "other",
          "published_at": "2026-04-28T22:43:00Z"
        },
        {
          "tag": "akua-v0.6.0",
          "kind": "other",
          "published_at": "2026-04-28T09:04:03Z"
        },
        {
          "tag": "akua-v0.1.0",
          "kind": "other",
          "published_at": "2026-04-18T19:28:49Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "1b87537aaa2f3b1aa8f6bf5d8d41313511aee6ef",
          "body": "* fix(ci): stop napi prePublish from writing to the immutable Release\n\nThe `native-publish` job's `@akua-dev/native` publish runs its\n`prepublishOnly` hook (`napi prepublish`), which — beyond injecting the\nper-platform `optionalDependencies` and copying addons — attempted to\nupload the per-platform \n[…]\neak\ninstallation). Add a guard comment in the workflow and an AGENTS.md note\nso the hook is never \"fixed\" back to `--ignore-scripts`.\n\n* no-mistakes(document): Document native prepublish release guard",
          "is_bot": false,
          "headline": "fix(napi): prevent prepublish uploads to immutable releases (#83)",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-07-21T10:30:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "275b0d38dfaa5517e068f604660e7d8ac9356462",
          "body": "* fix(release): harden immutable tag recovery\n\n* no-mistakes(review): Bind release publication to immutable source and workflow SHAs\n\n* no-mistakes(document): Refresh release documentation and lint guards\n\n* fix(release): remove Akua core Homebrew ownership\n\n* no-mistakes(review): Harden SHA-bound r\n[…]\ncredential, or provider action was dispatched or used.\n\n* no-mistakes(review): Correct release artifact handoff documentation\n\n* no-mistakes(document): Document immutable assets and clean release lint",
          "is_bot": false,
          "headline": "fix: harden immutable release recovery (#69)",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-07-21T07:08:07Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "25ee8f73abccf1d4a8bc158ce6a76c518d376e5d",
          "body": "* fix(core): use canonical CLI error documentation URLs\n\n* test(site): keep error docs deployment triggers aligned\n\n* no-mistakes(review): fix CLI contract inputs error documentation route\n\n* no-mistakes(document): Refresh authoritative CLI and generated documentation",
          "is_bot": false,
          "headline": "fix(cli): use canonical error documentation URLs (#70)",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-07-13T07:12:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6452eb662445d2ad7c108128f93b9c55138729bb",
          "body": "…uth flows (#68)\n\n* fix(git): preserve configured CA with TLS verification\n\n* no-mistakes(review): Preserve Git CA without leaking ambient HTTP configuration\n\n* no-mistakes(document): Document Git HTTPS CA preservation\n\n* no-mistakes: apply CI fixes\n\n* no-mistakes: apply CI fixes\n\n* no-mistakes: apply CI fixes\n\n* no-mistakes: apply CI fixes\n\n* no-mistakes: apply CI fixes\n\n* no-mistakes: apply CI fixes",
          "is_bot": false,
          "headline": "fix(core): preserve configured Git HTTPS CA bundles during vendored a…",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-07-11T21:02:37Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c40aef40e911067340ed582071f56838a87bc402",
          "body": "Rationale: Package dependency stubs are compiled in the consumer render context. Keeping body-only imports and Akua UI decorators in those stubs can force consumers to resolve upstream render dependencies such as k8s, or fail on render-only decorators, before the real child package render runs. Code\n[…]\nll package_k module tests require helm-engine.wasm in this fresh worktree; package_k::tests::typed_chart_values_reach_helm_template_wrapper previously failed with the documented missing-artifact path.",
          "is_bot": false,
          "headline": "fix(core): keep package stubs schema-only (#66)",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-07-07T19:30:36Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d2ea88780195f315091eb4de46209e60b2d19740",
          "body": "Rationale: Move the SDK OCI inspection entry from Unreleased into the 0.8.23 section before tagging the release that CNAP will consume.\\n\\nRisk: Docs-only release metadata change; no runtime code paths changed.\\n\\nTested:\\n- mise exec -- task release:validate\\n- mise exec -- task sdk:check\\n- mise e\n[…]\nlease:check-workflows\\n\\nNot-tested: Full GitHub release workflow dry-run was not manually dispatched; release.yml already passed on main for the code commit and local release packaging checks passed.",
          "is_bot": false,
          "headline": "docs: prepare 0.8.23 release notes [skip ci]",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-23T11:39:07Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "21884a22e35ea3fcb9fb6eca3ccaf5485e49707f",
          "body": "Adds a server-callable SDK/NAPI path for inspecting published Akua OCI package artifacts without shelling out, extracting to disk, or reading ambient Docker/Akua credential files.\n\nRationale:\nExpose a stable SDK-first OCI package inspection contract before CNAP expands package import/create-version \n[…]\n.test.ts\n- cargo test -p akua-cli inspect_oci_package -- --nocapture\n- GitHub CI: Rust (fmt + clippy + test), SDK (bun + node WASI)\n\nNot-tested:\n- SDK/native package publish was intentionally not run.",
          "is_bot": false,
          "headline": "feat(sdk): inspect published OCI packages",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-23T10:19:36Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "dd71215fd6773a4db24ce98e8a4a53baa017ed51",
          "body": "fix: export KCL boolean defaults as JSON booleans",
          "is_bot": false,
          "headline": "Merge pull request #63 from cnap-tech/codex/export-boolean-defaults",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-18T14:10:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5995dfda4222a4c2905ad1dd64ffc151ba6bf057",
          "body": "Rationale: Codezero package input schemas use KCL boolean defaults for UI controls, and the exported JSON Schema must expose those defaults as JSON booleans rather than strings.\n\nRejected: Treating every KCL default as JSON text first leaves True/False as strings because KCL boolean literals are cap\n[…]\n/input.schema.json\\n- jq '{runtime_enabled: .properties.runtime_enabled.default, velorum_enabled: .properties.velorum_enabled.default}' /tmp/codezero-fixed-schema/input.schema.json\\n- git diff --check",
          "is_bot": false,
          "headline": "fix: export KCL boolean defaults as JSON booleans",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-18T13:38:11Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9f3ac47dd95a3044057b4b6ddf9a9226e1d61bb3",
          "body": "Rationale: release validation uses a live Helm repository example whose manifest and docs promise that a bare chart version is an exact pin. The resolver was passing bare versions directly to semver::VersionReq, which widened them to caret ranges and let newer upstream charts move the lock under the\n[…]\nching the public lockfile contract.\n\nTested: mise exec -- cargo test -p akua-core --lib --features helm-fetch helm_repo_fetcher::tests\n\nTested: mise exec -- cargo fmt --check\n\nTested: git diff --check",
          "is_bot": false,
          "headline": "fix(helm): treat bare repo versions as exact pins",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-12T17:31:28Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2d0ce8eaed976eef1d1192ad3a38c8d5f7cef3ca",
          "body": "Rationale: release validation hit a Bun install race because sdk:test ran sdk:install in parallel with native:install through native:build. Keeping sdk:install as a command preserves package availability before bun test without concurrent Bun workspace installs.\n\nRejected: leaving sdk:install as a d\n[…]\n release-gate failure.\n\nRisk: sdk:test may be slightly slower; behavior is otherwise unchanged.\n\nTested: mise exec -- task sdk:test; mise exec -- task --dry sdk:test; git diff --check -- Taskfile.yml.",
          "is_bot": false,
          "headline": "fix(task): serialize sdk test bun installs",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-12T17:02:58Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d38a8ab15c7daf4d993b03e83895b2b90b7c7fc3",
          "body": "Rationale: task ci runs clippy with -D warnings before release, and clippy rejects the explicit lifetime on resolve_required_token as needless.\n\nRisk: signature-only lifetime elision; Rust infers the same borrow from the only borrowed input.\n\nTested: cargo fmt --check; cargo test -p akua-cli api_config; cargo clippy -p akua-cli --all-targets -- -D warnings.\n\nNot-tested: full task ci after this commit; running next.",
          "is_bot": false,
          "headline": "fix(cli): elide hosted API token lifetime",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-12T16:41:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "adb9970c370e7b4ff46c1e30e867e5fc7fdf7820",
          "body": null,
          "is_bot": false,
          "headline": "docs: prepare 0.8.21 release notes [skip ci]",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-12T16:36:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3f9d064e2cc42e275f57a61fd221a35a66ff80fe",
          "body": "Rationale: publish public-safe CLI docs for akua api/api spec and record the OSS guardrail that local package workflows remain cloud-independent.\n\nRejected: no CodeZero production proof, secret/deploy notes, or internal cloud launch details in OSS docs.\n\nRisk: docs-only plus AGENTS guardrail; no run\n[…]\npackage examples/01-hello-webapp/package.k --format=openapi --json; cargo fmt --check; git diff --check -- AGENTS.md docs/cli.md; git diff --cached --check.\n\nNot-tested: full task ci / task preflight.",
          "is_bot": false,
          "headline": "docs: document hosted API bridge [skip ci]",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-12T12:53:51Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3916a26e0a089d764c87c52da35485606d9c8675",
          "body": "Rationale: complete the first bridge convenience command by routing akua api spec through the same hosted API request machinery as version-relative paths.\n\nRejected: no local filtering for partner, admin, or internal OpenAPI audiences; those remain unsupported until the platform serves authorized au\n[…]\n only.\n\nTested: cargo test -p akua-cli api_spec; cargo test -p akua-cli api; cargo fmt --check; git diff --check; git diff --cached --check.\n\nNot-tested: full task ci and real api.akua.dev spec fetch.",
          "is_bot": false,
          "headline": "feat(cli): fetch hosted API spec",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-12T12:44:12Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e1bd3d6e71b599fe3db85c3a6f2f3352b914c7b6",
          "body": "Rationale: complete the first executable akua api bridge slice by sending planned requests to the configured API base URL and mapping platform error envelopes to the CLI contract.\n\nRejected: no api spec implementation, hosted profile/login storage, or SDK binding in this slice; api spec remains the \n[…]\nkua-cli api; cargo fmt --check; git diff --check; git diff --cached --check.\n\nNot-tested: full task ci and real api.akua.dev calls; integration coverage uses httpmock to avoid production dependencies.",
          "is_bot": false,
          "headline": "feat(cli): execute hosted API requests",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-12T12:36:40Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ab2bfa8105f4a04638dcd479a12855410990a192",
          "body": "Rationale: add the first request-construction layer for the single akua CLI hosted API bridge before wiring network execution.\n\nRejected: no HTTP execution, no stored hosted login/profile state, and no NAPI or TypeScript SDK binding in this slice; the bridge remains CLI-only until the API execution \n[…]\n-token test-token; cargo run -q -p akua-cli -- api /workspaces --token test-token.\n\nNot-tested: full task ci and hosted API HTTP execution; execution is intentionally deferred to the next bridge task.",
          "is_bot": false,
          "headline": "feat(cli): plan hosted API requests",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-12T12:16:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "950c842a549c96309b6b5270e9c1ef65663c8c78",
          "body": "Rationale: establish token, base URL, workspace context, and hosted API error codes before wiring akua api request execution.\n\nRejected: no stored login/profile state, no OCI auth reuse, and no HTTP command execution in this slice; those would expand the first bridge beyond its planned foundation.\n\n\n[…]\nuild:render-worker; cargo fmt --check; git diff --check; git diff --cached --check.\n\nNot-tested: full task ci and end-to-end akua api HTTP execution; the command path is not implemented in this slice.",
          "is_bot": false,
          "headline": "feat(cli): add hosted API config resolution",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-12T11:42:02Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "20ff9b0248301e0b56913020a5e07668b2f72812",
          "body": "Rationale: Close the OSS-safe launch-readiness slice by keeping public SDK docs, generated site output, large render/export regressions, CLI/NAPI/SDK drift guards, and render-worker schema-default coverage aligned on one branch.\n\nRejected: Did not fold the contradictory-defaults render case into the\n[…]\nn; cargo fmt --check; git diff --check; git diff --cached --check.\n\nNot-tested: Full task ci / release:validate not run; this was scoped to focused OSS launch-hardening regressions and generated docs.",
          "is_bot": false,
          "headline": "test: finish Akua OSS launch hardening",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-12T11:10:35Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d32b9df64bc430d3265afbdf2b0c8956c257fdf7",
          "body": "Rationale: Some Helm values.schema.json files publish defaults that contradict their declared type. Akua lowered those defaults directly into generated KCL, which can create schema/default contradictions such as 'field: str = 80' and abort the KCL evaluator during render.\n\nRejected: Did not attempt \n[…]\nrgo test -p akua-cli --features cosign-verify,dev-watch --test helm_union_schema -- renders_chart_with_union_typed_schema_default --nocapture\n\nTested: cargo test -p akua-core\n\nTested: git diff --check",
          "is_bot": false,
          "headline": "fix(core): omit unsafe chart schema defaults",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-12T10:45:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "33048b54d4d7f63abb35fd05ff193b8fb07f457f",
          "body": "Rationale: Keep the public OSS SDK surface aligned with implemented package/render/export behavior before the Akua Cloud launch bridge work. The SDK docs now describe the current NAPI-backed package SDK instead of future cloud/client APIs, and regression coverage locks down large render summaries, e\n[…]\nrc/render.test.ts packages/sdk/src/ciGates.test.ts\n\nTested: bun test packages/sdk/src/ciGates.test.ts -t drift\n\nTested: bunx tsc --noEmit --project packages/sdk/tsconfig.json\n\nTested: git diff --check",
          "is_bot": false,
          "headline": "test: harden Akua SDK launch surface",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-12T10:45:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6101afa17e89b19ea1cdfe9d9db83830c8d51a3a",
          "body": null,
          "is_bot": false,
          "headline": "docs: point CLI docs at cli subdomain [skip ci]",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-10T07:54:46Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f83ddc608edad38181ba6660303919909f850784",
          "body": "Rationale: Publish the verified render timeout/stale-engine fix so downstream CNAP can depend on a durable @akua-dev SDK/native package instead of local overrides.\n\nRisk: This triggers the normal Akua release path once tagged. The code changes were already merged via PR #62 with Rust and SDK CI green; this commit only stamps version metadata and changelog.\n\nTested: git diff --check; cargo metadata --locked --format-version 1 --no-deps; cargo check -p source-hash.",
          "is_bot": false,
          "headline": "release: 0.8.20 — refresh render budget handling",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-09T06:27:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "df05f4e4d7468d635e405e352596ed87dfdb77cc",
          "body": "Rationale: CNAP platform renders exposed persistent nested engine sessions reusing expired Wasmtime epoch deadlines, and worker interrupt traps surfaced as generic KCL errors instead of timeout budget failures.\n\nThis refreshes per-call nested engine deadlines, routes interrupt traps to E_RENDER_BUDGET_DEADLINE with timeout exit code, and includes CI lint cleanups required by the current toolchain.\n\nTested: Akua CI Rust (fmt + clippy + test) and SDK (bun + node WASI) passed on PR #62.",
          "is_bot": false,
          "headline": "fix(render): refresh wasm engine deadlines",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-09T06:24:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b00ae6c7eafa58b46e9dc279a9d6c38bc0bf0629",
          "body": null,
          "is_bot": false,
          "headline": "Add higher quality logo (#61)",
          "author_name": "Marcus Klingler",
          "author_login": "marcus-klingler",
          "committed_at": "2026-06-08T22:56:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0f261d8d0c27228c7093a28362dc56026cf3da8b",
          "body": null,
          "is_bot": false,
          "headline": "release: 0.8.19 — helm-repo resolver tolerates v-prefixed chart versions",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-01T07:47:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "42aee1910ae09aea96d17675eb44a51c82208ffb",
          "body": "…skip only truly-malformed entries",
          "is_bot": false,
          "headline": "fix(helm-repo): tolerate leading-v chart versions (Helm-compatible), …",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-06-01T07:47:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0a21cc3958083991d535f7f5159418a7b6da2266",
          "body": null,
          "is_bot": false,
          "headline": "release: 0.8.18 — akua cache manages the helm chart cache",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T18:54:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d14c4f12b8499c9e95f850f8478231bcd0f2ec85",
          "body": "akua cache list, clear, and path now cover the helm chart cache\n($XDG_CACHE_HOME/akua/helm/) added with the helm-repo dep source.\nPreviously the cache grew unmanaged across deploys.\n\nChanges:\n- cache_inventory: add helm_root to CacheInventory, collect_helm\n  (layout: <helm_root>/<hex>/<chart-name>/ \n[…]\nua cache clear`; cache_scope ArgGroup\n  extended; ClearScope::All wired for the no-flag default.\n- docs/roadmap.md: update cache line to {oci,git,helm}.\n- CHANGELOG.md: fixed entry under [Unreleased].",
          "is_bot": false,
          "headline": "feat(cache): inventory + clear the helm chart cache",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T18:20:31Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "76ed8b7c9fdc171efca074ac9548b6fc1c90fccc",
          "body": "Match the accurate model (already in CLAUDE.md/security-model.md after\naudit #9): digest-pin is the universal verified-before-write gate;\ncosign/SLSA verification engages fail-closed when a key is configured.",
          "is_bot": false,
          "headline": "docs: reconcile 'verify by default' signing claim across README + docs",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T18:05:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "24881ff73ad0046fc7f06cf6d8022b4e12d1ef11",
          "body": "…ld/feature wiring, release batching",
          "is_bot": false,
          "headline": "docs(agents): capture session gotchas — napi 3-place sync, engine-bui…",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T18:01:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d9551caa8744bfafecc34f7bd8e2266175050d3c",
          "body": "AGENTS.md is the cross-tool standard; CLAUDE.md → AGENTS.md so Claude\nCode and other agents read one source.",
          "is_bot": false,
          "headline": "docs: make AGENTS.md canonical, CLAUDE.md a symlink to it",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T17:58:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "93d0d584cadb0910f2dcbac4aee73eac97134873",
          "body": null,
          "is_bot": false,
          "headline": "release: 0.8.17 — honor helm subchart condition/tags disabling",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T17:02:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "fd3732caaa94d0a6c6f4592cfc6fff9e92a117b3",
          "body": "…Dependencies\n\nrenderInternal went load -> ToRenderValues -> engine.Render and never\ncalled chartutil.ProcessDependencies, the Helm step that reads each\ndependency's condition/tags from the values and prunes disabled\nsubcharts. Upstream Helm runs it in pkg/action/install.go before\nToRenderValues. Be\n[…]\nional\nsubchart: sub.enabled=false omits sub-cm, sub.enabled=true includes it.\nFailed before the fix (sub-cm leaked), passes after.\n\nThe generated assets/helm-engine.wasm is gitignored; CI rebuilds it.",
          "is_bot": false,
          "headline": "fix(helm-engine): honor subchart condition/tags disabling via Process…",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T16:50:01Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ac9ce346a62c39adec8ea71209c43ed5dc088148",
          "body": null,
          "is_bot": false,
          "headline": "release: 0.8.16 — security audit hardening (all 17 findings remediated)",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T14:57:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "79aa75bd3bc0bf79bb404a599af212a861d18f6c",
          "body": "… fix stale preopen comment\n\nCloses the last 3 audit follow-ups (#9, #16, #17). --timeout now derives\nthe render worker's epoch deadline (was always the 6s default), with a\nunit test. CLAUDE.md's 'verify by default' wording now states the real\nmodel (digest-pin universal; cosign engages when a key is configured).\nWorker preopen doc comment corrected (preopens are read-only).",
          "is_bot": false,
          "headline": "fix(security): --timeout bounds worker epoch; reconcile signing docs;…",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T14:48:50Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ddb9087fd46833c2c2147d4cdf016f6a5c37ea1c",
          "body": null,
          "is_bot": false,
          "headline": "docs(security): mark audit findings remediated + changelog",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T14:36:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e92db226cea184d320769ccc1fdab9da14583e7c",
          "body": "…ifest\n\n`akua publish` previously appended the workspace `akua.toml` byte-for-byte\ninto the tarball that is digested, cosign-signed, and SLSA-attested. A\npublisher's `replace = { path = \"...\" }` (or replace on an oci/git dep) — a\nlocal fast-iteration override — therefore survived into the signed art\n[…]\nso dropping the local redirect removes\nnothing the consumer needs.\n\npublish.rs is unchanged — it already packs via\npack_workspace_with_vendored_deps, so the strip applies centrally before\ndigest/sign.",
          "is_bot": false,
          "headline": "fix(security): strip replace directives from the published+signed man…",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T14:28:56Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "df5de413bd0704a60795c19c125a103306e65bc1",
          "body": "…date helm chart name + OCI userinfo\n\n- Drop `Serialize` from `BasicAuth` (unused — `auth_parse` only deserializes\n  INTO `HostAuthMap`; nothing serializes it back out) and implement manual\n  `Debug` that replaces the password with `[REDACTED]`. Prevents any `{:?}`\n  on a containing struct (e.g. `Ve\n[…]\nuser:pass@host/...`) are\n  now rejected at parse time, completing the symmetry with the existing\n  git and helm-repo userinfo guards.\n\nAll four changes are covered by new TDD tests; 74 lib tests pass.",
          "is_bot": false,
          "headline": "fix(security): redact BasicAuth, canonicalize vendor source_ref, vali…",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T14:28:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "24e7a4ad797093ab2cc123e64d0dbdd3a2862f14",
          "body": "… reject scheme downgrade\n\nHarden the OCI/Helm/git fetch paths against malicious registries and\npoisoned environments:\n\n- oci_transport: char-boundary-safe error-body truncation (was a byte\n  slice that panicked when a multibyte char straddled byte 300); cap\n  response bodies via a streamed counting\n[…]\non tree-entry names before dest.join.\n\nFinding #5 was fixed in code (force_tls_verification), not merely\ndocumented — gix exposes per-connection transport options that win over\nthe env-derived config.",
          "is_bot": false,
          "headline": "fix(security): bound fetch buffering + decompression, fix utf8 panic,…",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T14:28:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6c4f5fc317daf23b63fa3503d4892afd4d108190",
          "body": "Engine Sessions (helm, kustomize) were created with no StoreLimits and\nset_epoch_deadline(i64::MAX as u64), making them effectively uncapped.\nA declared malicious chart with pathological templating could consume\nup to ~4 GiB of linear memory and run indefinitely on a shared host.\nNot a sandbox escap\n[…]\n_generous,\nengine_epoch_deadline_is_finite_and_generous), and a well-formed module\nwith the full allocator ABI still initializes under the new caps\n(init_with_resource_caps_succeeds_for_valid_module).",
          "is_bot": false,
          "headline": "fix(security): bound helm/kustomize engine memory + wall-clock",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T14:28:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "aad5b4f4bc9fbc1a094fe73cb347788898c52393",
          "body": "…KCL codegen\n\nA malicious values.schema.json could inject KCL via verbatim property\nnames or an unescaped triple-quote in descriptions. Validate names\nagainst the KCL identifier grammar and neutralize \"\"\" in descriptions.",
          "is_bot": false,
          "headline": "fix(security): escape untrusted chart schema names + descriptions in …",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T14:28:46Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7ebba58ccd9d9c238540fe43ddf3758ea1059691",
          "body": null,
          "is_bot": false,
          "headline": "docs(security): 2026-05-29 multi-reviewer security audit report",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T14:04:36Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e0d059a66729cdeed7a463339938c8a65c8b6944",
          "body": "Nested/inner-render scopes now build resolved_pkgs via enter_for_render\n(the path-removal work landed that); the 'nested deps resolution is a\nfollow-up' note was stale.",
          "is_bot": false,
          "headline": "docs(kcl_plugin): correct stale resolved_pkgs comment",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T13:46:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c74c3810b49aa56ca5e0d85f88459b0031a21a47",
          "body": null,
          "is_bot": false,
          "headline": "release: 0.8.15 — typed-only composition + Bun engine loader",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T13:43:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "23c396be4c166333d8ec68cfe30287d217cf2b78",
          "body": "The SDK's helm/kustomize rendering failed under Bun with\n'helm-engine.wasm not built': loader.js set process.env\nAKUA_NATIVE_ENGINES_DIR, but Bun doesn't propagate process.env writes\nto the OS environment that the addon's std::env::var_os reads (Node\ndoes). Add a programmatic engines-dir override (R\n[…]\nxposed as napi\nsetEnginesDir and called by loader.js with the resolved\n@akua-dev/native-engines dir. Verified: helm renders under Bun with no\nshell env var. Env var path retained for Node back-compat.",
          "is_bot": false,
          "headline": "fix(napi): load engines via programmatic setEnginesDir (Bun-safe)",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T13:39:25Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "bc118d4b035c6e673a129dda97b4bc53bedbf9c3",
          "body": "…form\n\nNested renders now resolve typed dep aliases against the frame's own\nakua.toml: render_opts enters each frame via RenderScope::enter_for_render,\nwhich derives both allowed_roots and the resolved_pkgs alias map from the\nframe's resolved charts (budget inheritance preserved). This lets a compos\n[…]\nher engines (kustomize.build, helm chart paths)\nare untouched.\n\nBREAKING CHANGE: pkg.render no longer accepts path; declare the sub-package\nunder [dependencies] and compose it via package = \"<alias>\".",
          "is_bot": false,
          "headline": "feat(pkg-render)!: typed-alias-only composition; remove untyped path …",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T13:01:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e9b019ccfaab0a822e2cccceb8fe22aee3b41055",
          "body": "… fixes",
          "is_bot": false,
          "headline": "docs(changelog): 0.8.14 — helm-repo deps, sub-package context, render…",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T12:36:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d21dbf7b1c3789ddb3c76c401e358f369927e84f",
          "body": "The SDK Akua.add() calls napi.add(), but NapiAddon (the hand-maintained\ntyped view of the addon in napi.ts) never declared it, so the release\nsdk-build's tsc --emitDeclarationOnly failed with TS2339. Add the\nsignature mirroring the napi NapiAddArgs shape.",
          "is_bot": false,
          "headline": "fix(sdk): declare add() on the NapiAddon interface",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T12:14:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d9605b58575dc094543c80e51123483ead51df95",
          "body": "…itory\n\nDemonstrates the `repo`/`chart`/`version` dependency source: podinfo 6.12.0\npulled from stefanprodan.github.io/podinfo, sha256-pinned in akua.lock.\nE2e test mirrors examples_kcl_ecosystem — #[ignore]-gated by default (live\nnetwork pull), wired into task release:validate alongside the other online\nexamples.",
          "is_bot": false,
          "headline": "docs(examples): add 14-helm-repo-dep — chart from an HTTPS Helm repos…",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T11:55:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "db92db846827b2d93b9aca4058f57e1d3d0dc354",
          "body": "… chart\n\nDemonstrates and regression-tests that `charts.*` context now propagates\ninto `pkgs.<alias>`-composed sub-packages: the root Package composes a\n`webserver` sub-package (via `import pkgs.webserver`) whose own `akua.toml`\ndeclares a local Helm chart dep (`nginx = { path = \"./vendor/nginx\" }`)\n[…]\nynthesized package stubs — those per-render synthetic modules only\nexist in the rendering package's context, never in the consumer's stub\ncompilation context. Adds a unit test that pins the behaviour.",
          "is_bot": false,
          "headline": "docs(examples): add 13-subpackage-helm — sub-package composing a Helm…",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T11:37:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "254e28fba1977da7df013a3956c46e53e005647c",
          "body": "Union JSON-Schema types now generate `T1 | T2` KCL annotations\n(nullable -> optional) instead of collapsing to the first member with a\npossibly-mismatched default, which aborted the evaluator. A field like\n{\"type\":[\"string\",\"integer\",\"null\"],\"default\":8080} previously\nemitted `port: str = 8080` — a contradictory annotation that packed the\nint default against a str type at schema instantiation and triggered a\nwasm abort even with values = {}.",
          "is_bot": false,
          "headline": "fix(values-schema): emit KCL unions for multi-type schema fields",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T11:15:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a71356592569e1d4999039b43b91d2f859a4d597",
          "body": "…ckages\n\n`pkg.render` (and the typed `import pkgs.x; x.render(...)` form that\ndispatches to it) now resolves the composed CHILD package's own\n`akua.toml` deps — Helm `charts.*` and KCL-ecosystem imports like\n`import k8s.api.apps.v1` — and registers them for the child eval.\nPreviously the handler cal\n[…]\nhe child's OWN `akua.lock`, not the parent's. Missing child\n`akua.toml` falls back to empty charts, preserving the pure-KCL\nsub-package path. Cycle/depth/wall-clock guards still run before\nresolution.",
          "is_bot": false,
          "headline": "feat(render): propagate external-package context into composed sub-pa…",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T11:05:47Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3a9df6b56ca1d2002ac03bafea9a52adc97f0850",
          "body": "…al identifier",
          "is_bot": false,
          "headline": "fix(render): prefix digit-leading dep names so kcl_ident yields a leg…",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T10:43:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9bcd8a35ab974a3e6c768c1513cead58bce48c60",
          "body": "The render worker wrote its entire JSON+YAML response to a host stdout pipe\ncapped at 1 MiB (MemoryOutputPipe::new(1 << 20)). Real charts overflow it —\nargo-cd 7.7.0 renders ~1.36 MB — so the guest's write_all failed with errno 29,\nsurfacing as an opaque `os error 29` (exit 3). traefik (~7 KB) and t\n[…]\nENDER_OUTPUT_TOO_LARGE code via the KclEval\nmarker table, with a split-the-Package suggestion — instead of os error 29.\n\nThe 64 KiB stderr cap is left as-is (deliberately small for structured errors).",
          "is_bot": false,
          "headline": "fix(worker): raise render-output cap above 1MiB + typed overflow error",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T10:34:49Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b7aa32140ca321b077aff99a631dab145bfe7c73",
          "body": "A dep keyed with a hyphen in akua.toml (e.g. [dependencies.cnpg-operator])\nmade akua write the synthetic chart/pkg module file under the literal name\n(cnpg-operator.k). KCL binds that module's symbols under cnpg-operator, but\n`-` is not a legal KCL identifier, so `import charts.cnpg_operator` resolv\n[…]\nerwriting one module.\n\nThe pkg-stub `package = \"...\"` lookup string keeps the original dep key\n(pkg.render keys its resolved-pkg map on the raw name); only the filename and\nimport alias are sanitized.",
          "is_bot": false,
          "headline": "fix(render): sanitize hyphenated dep names to KCL identifiers",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T10:34:36Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3aa7968e290a5107efda5d87cebd73e86d93962a",
          "body": null,
          "is_bot": false,
          "headline": "chore(gitignore): ignore .akua/cache resolver artifact",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T10:11:08Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e23bbef27524f895d495551f20ca0baca90cbb9c",
          "body": "Without this the shipped binary + napi addon compiled the\n`#[cfg(not(feature=\"helm-fetch\"))]` resolve_helm stub, so repo deps\nerrored at runtime despite passing feature-gated tests. Wired the same\nway git-fetch is (unconditional on the akua-core dep).",
          "is_bot": false,
          "headline": "build(cli,napi): enable helm-fetch feature on akua-core",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T09:53:46Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a3faead8e1fe612a55bb3b32c4fd694035b755c8",
          "body": "- docs/cli.md: rewrite `akua add` section to match the real CLI (flag-\n  based, not positional subcommand); add four-source table including\n  `--repo`/`--chart`; update `vendor add` note to mention helm deps.\n- docs/lockfile-format.md: add Helm-repo row to the dependency forms\n  table; update `sourc\n[…]\nsingle-line dep-shape sentence\n  with a four-source table and a `akua add --repo` usage example.\n- CHANGELOG.md: add `### Added` entry under `[Unreleased]` for the\n  HTTPS helm-repo dependency source.",
          "is_bot": false,
          "headline": "docs(helm-repo): document repo/chart dependency source",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T09:48:24Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c0d7f0e0a8c06d3258f9802c024d2d3e264ed8f7",
          "body": "Extend `akua add` with a fourth dependency source: HTTPS Helm repository.\n\n- clap: add `--repo` / `--chart` to `Commands::Add`; include `repo` in\n  the `source` ArgGroup so exactly-one-source validation holds.\n- `AddSource::Repo { repo, chart }` variant; `build_dependency`,\n  `source_label` (\"helm\")\n[…]\nclaration.\n- SDK: `AddOptions` / `AddOutput` types; `Akua.add(name, opts)` method.\n- Tests: `adds_helm_repo_dep_with_repo_chart_version` and\n  `helm_repo_source_label_is_helm` (all 10 add tests pass).",
          "is_bot": false,
          "headline": "feat(add): akua add --repo --chart helm-repo form + SDK",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T09:46:40Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "00e9753208456a2fbbf7cdfaf9a1eac327690a03",
          "body": null,
          "is_bot": false,
          "headline": "test(helm-repo): online fetch over local HTTP server + digest-pin guard",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T09:33:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "aa4ce83ea975daaff2f7e895a50d0ead92fafa3a",
          "body": "Verify a helm+<repo>#<chart> source string with a sha256 digest\nsurvives a TOML round-trip and passes digest validation — no\nLockedPackage schema change.",
          "is_bot": false,
          "headline": "test(lockfile): helm-repo source round-trip",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T09:28:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f7742859b95c781394156f11879c64f970ed3932",
          "body": "Take the chart dir name and locate the unpacked root at\n<dest>/<chart>/ (with an archive-root fallback) instead of scanning\nfor the single subdir holding Chart.yaml.",
          "is_bot": false,
          "headline": "fix(helm-repo): deterministic fetch_from_cache by chart dir name",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T09:28:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0670f83e0af109a53da69ea3fd4227a86f210c03",
          "body": "Route helm-repo deps through a new resolve_helm that mirrors resolve_oci:\nthe .tgz sha256 is the cache key, lockfile pin, and fetcher-verified\ndigest. Helm skips vendor-first (vendored-helm embedding is deferred).\nAdds the ChartResolveError::HelmFetch variant and an offline-from-cache\nresolver test.",
          "is_bot": false,
          "headline": "feat(helm-repo): ResolvedSource::Helm + resolver arm",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T09:28:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5a155899cba707962b2efa02ed2fbad973d4e710",
          "body": "…cache",
          "is_bot": false,
          "headline": "feat(helm-repo): http fetch + extract + content-digest pin + offline …",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T09:16:37Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "aa1e8ab9c5770e12965155c1dca287d15ba2b177",
          "body": null,
          "is_bot": false,
          "headline": "feat(helm-repo): resolve relative/absolute tarball URLs",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T09:15:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9099a9c8a442201be9dc6747db1b09fc3b920cb9",
          "body": null,
          "is_bot": false,
          "headline": "feat(helm-repo): semver version selection against index",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T09:14:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9ff4be93a5d0edabb0e41a082eff25dd0431b644",
          "body": null,
          "is_bot": false,
          "headline": "feat(helm-repo): index.yaml types + parser",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T09:13:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a26f20e36d07b6be23fb7bcc0b5091ed46f016ca",
          "body": "Adds `repo`/`chart` fields to `Dependency`, `DependencySource::Helm`,\n`DependencySpec::Helm { repo, chart, version }`, and three new\n`ManifestError` variants with stable error codes. Validation rejects\nmissing `chart`, missing `version`, and embedded userinfo in the repo\nURL. Exhaustiveness gaps in \n[…]\n-fetch returns\n`UnsupportedSource` until Tasks 4-9 wire the helm_repo_fetcher;\n`vendor_lock_source` panics (unreachable pre-fetcher); `resolve_source`\nreturns the new `VendorError::UnsupportedSource`.",
          "is_bot": false,
          "headline": "feat(manifest): repo/chart helm-repo dependency source + validation",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T09:11:26Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f1502949bc35182a38bf038ed42d9789a3338faf",
          "body": null,
          "is_bot": false,
          "headline": "feat(cli-contract): error codes for helm-repo dep validation",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T08:50:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9a1f1bdb89a43ebeeec77ce7a66d274c88263aaa",
          "body": null,
          "is_bot": false,
          "headline": "build(akua-core): add semver dep + helm-fetch feature",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T08:48:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9b4a5a750917b3f06f65f911c12a46b14f72656a",
          "body": null,
          "is_bot": false,
          "headline": "docs(plan): HTTPS helm-repo dependency implementation plan",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T08:44:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8854aa5fec3c01f7febcfc299a78c97670227193",
          "body": "Fourth akua.toml dependency source alongside oci/git/path: classic HTTPS\nHelm repositories (index.yaml + .tgz). Content-pinned like git deps\n(sha256 in akua.lock, verify-on-pull, no cosign), full scope including\nsemver-range resolution against index.yaml. Reuses the reqwest+rustls\ntransport, host_auth map, content-addressed cache, and vendor machinery.",
          "is_bot": false,
          "headline": "docs(spec): HTTPS helm-repo dependency source design",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T08:34:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "064c6f184877185521d91b910d3346f8121064d4",
          "body": "The embedded helm engine returns NOTES.txt (top-level and per-subchart)\namong its rendered files, but those are free-form usage prose, not\nmanifests — helm template keeps them out of the YAML stream. akua parsed\nevery returned file as YAML, so any chart whose notes contain lines like\n'kubectl logs .\n[…]\n.\n\nAdds parse_manifests + is_notes_file with a regression test, plus\nmulti-doc parser guards (block-scalar-with-empty-line, real 59-doc helm\nfixture) and propagates the 0.8.14 version into Cargo.lock.",
          "is_bot": false,
          "headline": "fix(helm): skip NOTES.txt instead of parsing it as YAML",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T08:17:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2972b28ae70cf17355e23a572966cae4ffc32f49",
          "body": "The release pipeline bumped package.json from the tag but never the Rust\nworkspace Cargo.toml, so binaries compiled with the committed version\n(0.8.8) regardless of tag. That string feeds akua -V, SLSA provenance,\nOCI annotations, and the HTTP user-agent — all stale on 0.8.9..0.8.13.\n\n- scripts/set-\n[…]\n with the detect-version tag.\n- cli-build smoke-test asserts akua -V == tag, failing the release on\n  any future injection regression.\n- bump committed Cargo.toml placeholder to 0.8.14 (next release).",
          "is_bot": false,
          "headline": "ci(release): derive Cargo version from git tag",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-29T07:28:42Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2641857b3528ae343533a79ed679d5613dfeaf41",
          "body": "Keep gix on curl transport for Git TLS config support, but enable vendored OpenSSL for git-fetch so release cross-builds do not depend on target system OpenSSL packages.",
          "is_bot": false,
          "headline": "fix(core): vendor curl OpenSSL for git transport",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-20T17:05:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f696d2477c6465fa6832f53bfa08f654b28b90d3",
          "body": "Switch gix Git fetches to the curl transport so Git-compatible TLS config is applied, and keep pre-push lightweight by default.",
          "is_bot": false,
          "headline": "Fix Git TLS trust for vendored sources",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-20T14:39:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4882d33509fd83c7cf6bf032f449ac1caecfa2c8",
          "body": "* fix(core): refresh stale git dependency caches\n\n* fix(core): allow gix credential callback lint",
          "is_bot": false,
          "headline": "fix(core): refresh stale git dependency caches (#58)",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-19T17:02:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "458398458ab77c58b954e6a14748d6fa73b33eec",
          "body": "* fix(core): render helm values schemas as valid kcl\n\n* fix(core): make helm values schema test render a resource",
          "is_bot": false,
          "headline": "fix(core): render Helm values schemas as valid KCL (#56)",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-19T17:02:37Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ecc1fe3e98b0e5d7d790d9ce21af658976825574",
          "body": "Install release deps before mutating package manifests to tag-pinned versions, and add release workflow ordering checks.",
          "is_bot": false,
          "headline": "fix(release): install deps before tag manifest pins",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-16T14:33:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9d603df28c778c7444481eacab5469847c7744b5",
          "body": "Allow Akua-published OCI package layers to resolve through vendor dependency fetches.",
          "is_bot": false,
          "headline": "fix(oci): let vendor fetch akua packages",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-16T13:32:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4ade6ec3a041eebe88b7fe9c80a592af4006beaa",
          "body": "* docs(readme): replace hero gif with motion piece + scrubbable terminal embed\n\nSix-scene composition at docs/assets/hero.mp4 (3.2 MB, 52 s, 1920×1080)\nwith a docs/assets/hero.gif fallback (1.9 MB, 960×540) for renderers\nthat don't support <video>. Scenes:\n\n  1. Wordmark + Typed/Signed/Sandboxed tag\n[…]\ne structural fact.\n- design/handoff/README.md: flag as historical artifact pointing at\n  the current production README; the inline \"replace with hero.gif\"\n  hint pre-dates the embedded-video approach.",
          "is_bot": false,
          "headline": "docs(readme): hero motion piece — Typed. Signed. Sandboxed. (#53)",
          "author_name": "Robin Brämer",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-13T13:28:42Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2de793c8cdf9bdedb0a935253acead4da7e01e04",
          "body": "The 0.8.8 release run failed sdk-build because crates/akua-napi/index.d.ts\nwas committed before NapiVendorAddArgs gained its `auth` field. tsc\ncaught it on the SDK call site at packages/sdk/src/mod.ts:433.\n\n- Regenerated index.d.ts via `task native:build` — picks up\n  NapiBasicAuth + auth?: Record<s\n[…]\n.8.8 (was 0.8.7-rc4 — stale from\n  a prior local napi build).\n- packages/sdk/src/napi.ts hand-mirrors the napi shape (deliberately,\n  per the file's own comment); added `auth` to vendorAdd's arg type.",
          "is_bot": false,
          "headline": "fix(napi): regenerate index.d.ts + sync sdk napi shim for vendor auth",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T19:51:38Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1733f36a45a1ea80920e81f01d59077109354e7a",
          "body": "- gix HTTPS transport: closure-based credential helper installed in\n  clone_bare runs host_auth::lookup on 401 retries; longest-prefix\n  match selects the credential, gix serializes it as Authorization:\n  Basic <b64> on the retry. Arc-shared map for cheap reuse across\n  configure_connection / set_cr\n[…]\n wrong-auth 401, longest-prefix\n  selection. No real network — fully hermetic.\n- New error page docs/errors/E_AUTH_PARSE.md covering all four CLI\n  --auth / --auth-file shape errors with remediations.",
          "is_bot": false,
          "headline": "release: 0.8.8 — host-keyed HTTPS basic auth for vendor add",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T19:07:12Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8d3e5b5773f182f2cade03212effb7491d0b2813",
          "body": "…dedicated E_AUTH_PARSE, drop stale TODO\n\n- Move url_has_userinfo from mod_file (private) to host_auth (pub)\n  and have mod_file::Dependency::validate call it. One implementation\n  of 'does this URL embed user:pass@'.\n- New error code E_AUTH_PARSE for --auth / --auth-file shape errors.\n  Was previou\n[…]\nrs it.\n\nFindings deferred to follow-ups: BasicAuth ↔ oci_auth::Credentials\nconsolidation (cross-feature-gate refactor), generic load_toml<T>\nhelper to absorb 4 open-coded loaders, HostAuthMap newtype.",
          "is_bot": false,
          "headline": "refactor(host-auth): simplify findings — dedupe url-userinfo helper, …",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T17:45:50Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7d3983bb12917ab6b289a3bcc8ecb05b3f546fd7",
          "body": "- docs/cli.md gains an \"Auth flags\" subsection under `akua vendor`\n  with --auth / --auth-file syntax, --auth-file TOML shape, and the\n  lockfile-canonicalization guarantee.\n- docs/sdk.md gains a \"Credentials — auth\" universal-option section\n  with longest-prefix examples (single-host + per-org scop\n[…]\nents the new auth surface,\n  lockfile canonicalization, and manifest hardening.\n\nSite regenerated via task site:gen — link checker green\n(101 pages, 0 broken links). Includes minor cargo fmt cleanups.",
          "is_bot": false,
          "headline": "docs(host-auth): cli.md, sdk.md, error page, CHANGELOG",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T17:34:31Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7b21f3d2ab9a7e8189262974e307b802f893103f",
          "body": "- New crates/akua-cli/src/auth_parse.rs: parses repeatable\n  `--auth <prefix>=<user>:<password>` strings + optional\n  `--auth-file <path>` (TOML, `[auth]` keyed by URL prefix).\n  Flag values override file entries on conflict (helm/docker\n  convention).\n- `akua vendor add` gains --auth (repeatable) +\n[…]\ng longest-prefix-match resolution.\n- 10 auth_parse unit tests cover pair parsing (incl. passwords\n  with `:` / `=`), empty-prefix / empty-username rejection,\n  TOML file loading, and merge precedence.",
          "is_bot": false,
          "headline": "feat(cli/napi): --auth flag, --auth-file, SDK auth parameter",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T17:27:37Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "70de755e820fc973e2ba3eb2e4ac9d9abcf9f5f7",
          "body": "Threads `auth: Option<&HostAuthMap>` through the public verb surface\ndown into git_fetcher::fetch and the gix transport. When the URL\nmatches an entry in the map (longest-prefix), the credential is sent\nas `Authorization: Basic <b64>` via gix's in-memory config override\n(`http.extraHeader`). Anonymo\n[…]\n7 lib tests + integration tests pass.\n\nbase64 + host_auth moved from feature-gated to always-built (~12 KB\non linker output) — host_auth::BasicAuth needs to be reachable from\nnon-git-fetch builds too.",
          "is_bot": false,
          "headline": "feat(git_fetcher): host-keyed HTTPS basic auth",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T17:19:53Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e3e776d4f0b0f2aef176da3823cff677523341c7",
          "body": "akua.toml is version-controlled; embedding 'user:pass@host' in a git\ndep URL would persist the credential into the lockfile + git\nhistory. Reject at parse time with a typed error.\n\n- New error code E_MANIFEST_GIT_USERINFO with rich message pointing\n  callers to the SDK auth parameter / CLI --auth fl\n[…]\nstructured_code() lets to_structured() route this\n  variant to the dedicated code instead of the generic\n  E_MANIFEST_PARSE bucket\n\nTwo new tests: rejects user:pass@ in authority; accepts '@' in path.",
          "is_bot": false,
          "headline": "feat(mod_file): reject git URLs with embedded credentials",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T17:01:45Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "bd959c70db246a35d3c69c80da403be12d4e7355",
          "body": "New module crates/akua-core/src/host_auth.rs:\n- BasicAuth { username, password } + to_authorization_header()\n- HostAuthMap = HashMap<String, BasicAuth>\n- lookup() — longest-URL-prefix match (path-segment-aware), matches\n  git's credential-helper / .npmrc resolution rule\n- canonicalize_url() — strips\n[…]\nso credentials never leak into akua.lock\n\nGated on the git-fetch feature; base64 dep activated alongside.\n13 unit tests covering prefix selection, path-segment boundaries,\ncanonicalization edge cases.",
          "is_bot": false,
          "headline": "feat(host_auth): URL-prefix-keyed credential map + canonicalization",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T17:01:36Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5c6f2e0bc13a2aa7e3ba8420515194361d513396",
          "body": "The sdk-staged tarball already contains dist/ pre-built by sdk-build in\nrelease.yml. Without --ignore-scripts, npm fires the package's\nprepublishOnly hook which re-runs `bun run build`, requiring bun on\nPATH and a fully-installed node_modules tree (transitive deps like\nfast-uri, fast-deep-equal). All wasted work, since the tarball is\nalready what we want to publish.",
          "is_bot": false,
          "headline": "fix(release-publish): npm publish --ignore-scripts for the SDK",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T15:14:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d647027a0c2b02e87078475e51b7fb947f30a447",
          "body": "…eds it)",
          "is_bot": false,
          "headline": "fix(release-publish): add bun setup to sdk-publish (prepublishOnly ne…",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T15:11:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7f215db3b66e72182914bcb64ccab885b1a5e5c2",
          "body": "`gh release download` was failing with 'not a git repository' because\nthe sdk-publish job has no actions/checkout step (intentional — the\nsdk staging tree is fully reconstructed from the asset tarball).\nExplicit --repo flag bypasses the git-config inference path.",
          "is_bot": false,
          "headline": "fix(release-publish): pass --repo so sdk-publish doesn't need a checkout",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T15:09:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a7096bb1b477810130c7b1617ae360642cbfe29a",
          "body": "…lease-publish.yml\n\nThe job's 'gh workflow run release-publish.yml' got HTTP 403:\n'Resource not accessible by integration' because the job-level\nGITHUB_TOKEN inherits the workflow permissions block, which only\nlisted contents/packages/id-token. Per Actions docs, dispatching a\nworkflow_dispatch event\n[…]\n step was right that the\nworkflow_dispatch event itself is exempt from the no-recursion\nrule — but the API call to register the dispatch still needs\nactions:write on the token. Fix in run 25497355509.",
          "is_bot": false,
          "headline": "fix(release): grant actions: write so trigger-publish can dispatch re…",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T13:35:21Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a850be6166c393cebe6b13dbcfb0fb33d6184344",
          "body": "…ploads\n\nRefactor commit ff5f076 used 'cli-*' as a defensive download-artifact\nfilter, but the cli-build job uploads with name 'akua-${{ matrix.target }}'.\nPattern matched zero artifacts → github-release + docker + homebrew-tap\nall failed with no matches found / file not found.\n\nConfirmed by run 25495656081 logs: 'Found 13 artifact(s); Filtering by\npattern cli-*; Total of 0 artifact(s) downloaded'.",
          "is_bot": false,
          "headline": "fix(release): pattern 'akua-*' (not 'cli-*') matches what cli-build u…",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T13:00:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c898e17bcb9c7cc6c7d3f5e3e4422154cec665b2",
          "body": null,
          "is_bot": false,
          "headline": "ci: skip CI on changes to scripts/check-site-links.ts (site-only)",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T12:53:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7dff06f8a0ed447a7c3a178e9b820fc07587821e",
          "body": "The `cli-contract.md §1.5` link (and similar) 404'd because the markdown\nrewriter only matched `.md$`, missing URLs with `#fragment`. While\nfixing that, audited every internal link in the generated site and found\n24 more broken — examples-gallery cross-links, agent-usage skill paths,\ncli.md `#akua-r\n[…]\nth filter so dead links fail the deploy.\n- `docs/sdk.md` — transport table rewritten. The SDK is NAPI-only;\n  the WASM + shell-out tiers were aspirational. Lists the 14 verbs\n  actually exposed today.",
          "is_bot": false,
          "headline": "fix(site): kill dead links + add a checker that fails CI on regression",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T12:47:48Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "397e9ce182e478ada2cd50ada6854b32606c1280",
          "body": null,
          "is_bot": false,
          "headline": "fix(docs/sdk): npm link missing @akua scope (was /package/-dev/sdk)",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T12:36:33Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "09530b3921fa1d04f2c65022b00910dbf544965a",
          "body": "…links\n\nThree design fixes:\n\n1. Landing is back to a tight, vertical-centered single column. The\n   prior \"logo hero + giant tagline\" pushed the install command well\n   below the fold; now `akua` headline + tagline sit ~6px apart and\n   the install pre block is the second visible element. Footer + D\n[…]\ne click target is consistent and the\n   text sits dead-center. Brand img dropped from 28→26 to better match\n   the text x-height.\n\nSidebar `top: 76px → 24px` since the topnav no longer reserves space.",
          "is_bot": false,
          "headline": "fix(site): tighter centered landing, scroll-fade topnav, aligned nav …",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T12:35:09Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ff5f076874f2fa78dd5b2e275e0af5622aee7aaa",
          "body": "`npm publish` is the most failure-prone step in the release pipeline\n(OIDC config drift, registry hiccups, version-pin mismatch, …). When\nit fails today, the only recovery path is to push a workflow fix and\nre-tag, which re-runs the full build matrix — hours of CI time for a\n3-line YAML fix.\n\nThis s\n[…]\nublish failure — without a pattern,\ndownload-artifact also pulls the docker job's auto-attached\n`cnap-tech~akua~<id>.dockerbuild` provenance artifact, whose\n`~`-containing name fails path validation).",
          "is_bot": false,
          "headline": "refactor(release): split publish into separately-dispatchable workflow",
          "author_name": "Robin",
          "author_login": "robinbraemer",
          "committed_at": "2026-05-07T12:25:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        }
      ],
      "releases_count": 26,
      "commits_last_year": 523,
      "latest_release_at": "2026-07-11T23:50:28Z",
      "latest_release_tag": "v0.8.25",
      "releases_from_tags": false,
      "days_since_last_push": 4,
      "active_weeks_last_year": 13,
      "days_since_latest_release": 17,
      "mean_days_between_releases": 4.8
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": true,
      "health_percentage": 87,
      "has_issue_template": false,
      "has_code_of_conduct": true,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "@akua-dev/sdk",
          "exists": true,
          "license": "Apache-2.0",
          "keywords": [],
          "ecosystem": "npm",
          "matches_repo": true,
          "registry_url": "https://www.npmjs.com/package/@akua-dev/sdk",
          "is_deprecated": false,
          "latest_version": "0.8.25",
          "repository_url": "https://github.com/akua-dev/akua",
          "versions_count": 26,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": 1,
          "monthly_downloads": 2005,
          "first_published_at": "2026-04-27T12:42:24.932000Z",
          "latest_published_at": "2026-07-21T08:15:17.042000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 7
        },
        {
          "name": "@akua-dev/native",
          "exists": true,
          "license": "Apache-2.0",
          "keywords": [
            "akua",
            "napi-rs",
            "NAPI",
            "node-addon",
            "helm",
            "kustomize",
            "kcl"
          ],
          "ecosystem": "npm",
          "matches_repo": true,
          "registry_url": "https://www.npmjs.com/package/@akua-dev/native",
          "is_deprecated": false,
          "latest_version": "0.8.25",
          "repository_url": "https://github.com/akua-dev/akua",
          "versions_count": 26,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": 1,
          "monthly_downloads": 2109,
          "first_published_at": "2026-04-27T12:42:19.969000Z",
          "latest_published_at": "2026-07-21T08:15:02.097000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 7
        }
      ]
    },
    "popularity": {
      "forks": 0,
      "stars": 5,
      "watchers": 0,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 0
      },
      "star_history": null,
      "open_issues_and_prs": 25
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [
        "examples"
      ],
      "has_llms_txt": false,
      "has_dockerfile": true,
      "has_mcp_signal": false,
      "bootstrap_files": [
        ".mise.toml",
        "Taskfile.yml",
        "docs/hero-source/Taskfile.yml"
      ],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [
        "packages/sdk/tsconfig.json"
      ],
      "toolchain_manifests": [
        "Cargo.toml",
        "crates/akua-cli/Cargo.toml",
        "crates/akua-core/Cargo.toml",
        "crates/akua-napi/Cargo.toml",
        "crates/akua-render-worker/Cargo.toml",
        "crates/engine-host-wasm/Cargo.toml",
        "crates/helm-engine-wasm/Cargo.toml",
        "crates/helm-engine-wasm/go-src/go.mod",
        "crates/kustomize-engine-wasm/Cargo.toml",
        "crates/kustomize-engine-wasm/go-src/go.mod",
        "crates/source-hash/Cargo.toml"
      ],
      "largest_source_bytes": 84955,
      "source_files_sampled": 194,
      "oversized_source_files": 4,
      "agent_instruction_files": [
        "AGENTS.md",
        "CLAUDE.md"
      ],
      "agent_instruction_max_bytes": 18329
    },
    "dependencies": {
      "manifests": [
        "Cargo.toml",
        "package.json"
      ],
      "advisories": {
        "error": null,
        "scope": "published_package",
        "source": "osv",
        "findings": [],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {},
        "advisory_count": 0,
        "affected_count": 0,
        "assessed_count": 16,
        "malicious_count": 0,
        "assessed_package": "npm:@akua-dev/sdk@0.8.25",
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "crates",
        "npm"
      ],
      "dependencies": [
        {
          "name": "akua-core",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "clap",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde_json",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde_yaml",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "thiserror",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "toml",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "reqwest",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "ctrlc",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "3"
        },
        {
          "name": "ts-rs",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "12"
        },
        {
          "name": "schemars",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "1"
        },
        {
          "name": "wasmtime",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "43"
        },
        {
          "name": "wasmtime-wasi",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "43"
        },
        {
          "name": "engine-host-wasm",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "tracing",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "tracing-subscriber",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "tracing-opentelemetry",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "opentelemetry",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "opentelemetry_sdk",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "opentelemetry-otlp",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "tokio",
          "manifest": "crates/akua-cli/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "1"
        },
        {
          "name": "serde",
          "manifest": "crates/akua-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde_json",
          "manifest": "crates/akua-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde_yaml",
          "manifest": "crates/akua-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "toml",
          "manifest": "crates/akua-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "thiserror",
          "manifest": "crates/akua-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "base64",
          "manifest": "crates/akua-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.22"
        },
        {
          "name": "kcl-lang",
          "manifest": "crates/akua-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "sha2",
          "manifest": "crates/akua-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.10"
        },
        {
          "name": "tempfile",
          "manifest": "crates/akua-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "3"
        },
        {
          "name": "ts-rs",
          "manifest": "crates/akua-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "12"
        },
        {
          "name": "schemars",
          "manifest": "crates/akua-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "1"
        },
        {
          "name": "semver",
          "manifest": "crates/akua-core/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "1"
        },
        {
          "name": "akua-cli",
          "manifest": "crates/akua-napi/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "akua-core",
          "manifest": "crates/akua-napi/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "napi",
          "manifest": "crates/akua-napi/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "3"
        },
        {
          "name": "napi-derive",
          "manifest": "crates/akua-napi/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "3"
        },
        {
          "name": "serde",
          "manifest": "crates/akua-napi/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde_json",
          "manifest": "crates/akua-napi/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde_yaml",
          "manifest": "crates/akua-napi/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "@akua-dev/native-engines",
          "manifest": "crates/akua-napi/package.json",
          "ecosystem": "npm",
          "version_constraint": "0.8.8"
        },
        {
          "name": "akua-core",
          "manifest": "crates/akua-render-worker/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde",
          "manifest": "crates/akua-render-worker/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde_json",
          "manifest": "crates/akua-render-worker/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde_yaml",
          "manifest": "crates/akua-render-worker/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "tracing",
          "manifest": "crates/akua-render-worker/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "tracing-subscriber",
          "manifest": "crates/akua-render-worker/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.3"
        },
        {
          "name": "wasmtime",
          "manifest": "crates/engine-host-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "43"
        },
        {
          "name": "wasmtime-wasi",
          "manifest": "crates/engine-host-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "43"
        },
        {
          "name": "thiserror",
          "manifest": "crates/engine-host-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "engine-host-wasm",
          "manifest": "crates/helm-engine-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde",
          "manifest": "crates/helm-engine-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde_json",
          "manifest": "crates/helm-engine-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "base64",
          "manifest": "crates/helm-engine-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.22"
        },
        {
          "name": "thiserror",
          "manifest": "crates/helm-engine-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "flate2",
          "manifest": "crates/helm-engine-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "1"
        },
        {
          "name": "tar",
          "manifest": "crates/helm-engine-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.4"
        },
        {
          "name": "engine-host-wasm",
          "manifest": "crates/kustomize-engine-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde",
          "manifest": "crates/kustomize-engine-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde_json",
          "manifest": "crates/kustomize-engine-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "base64",
          "manifest": "crates/kustomize-engine-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.22"
        },
        {
          "name": "thiserror",
          "manifest": "crates/kustomize-engine-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "flate2",
          "manifest": "crates/kustomize-engine-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "1"
        },
        {
          "name": "tar",
          "manifest": "crates/kustomize-engine-wasm/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.4"
        },
        {
          "name": "sha2",
          "manifest": "crates/source-hash/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.10"
        },
        {
          "name": "@akua-dev/native",
          "manifest": "packages/sdk/package.json",
          "ecosystem": "npm",
          "version_constraint": "0.8.8"
        },
        {
          "name": "@standard-schema/spec",
          "manifest": "packages/sdk/package.json",
          "ecosystem": "npm",
          "version_constraint": "^1.1.0"
        },
        {
          "name": "ajv",
          "manifest": "packages/sdk/package.json",
          "ecosystem": "npm",
          "version_constraint": "^8.18.0"
        },
        {
          "name": "yaml",
          "manifest": "packages/sdk/package.json",
          "ecosystem": "npm",
          "version_constraint": "^2.8.3"
        }
      ],
      "all_dependencies": {
        "error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
        "source": null,
        "packages": [],
        "collected": false,
        "truncated": false,
        "total_count": null,
        "direct_count": null,
        "indirect_count": null
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 14,
        "merged_prs": 46,
        "open_issues": 11,
        "closed_ratio": 0.214,
        "closed_issues": 3,
        "closed_unmerged_prs": 15
      },
      "bus_factor": 1,
      "bot_contributors": 1,
      "top_contributors": [
        {
          "type": "User",
          "login": "robinbraemer",
          "commits": 517,
          "avatar_url": "https://avatars.githubusercontent.com/u/22003767?v=4"
        },
        {
          "type": "User",
          "login": "marcus-klingler",
          "commits": 1,
          "avatar_url": "https://avatars.githubusercontent.com/u/181632184?v=4"
        }
      ],
      "contributors_sampled": 2,
      "top_contributor_share": 0.998
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "ci.yml",
        "pages.yml",
        "release-publish.yml",
        "release.yml"
      ],
      "has_docs_dir": true,
      "linter_configs": [],
      "has_editorconfig": false,
      "has_linter_config": false,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "Cargo.lock"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 9,
            "reason": "9 out of 10 merged PRs checked by a CI test -- score normalized to 9",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 1/29 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 10,
            "reason": "project has 4 contributing companies or organizations",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 10,
            "reason": "update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 10,
            "reason": "30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": 10,
            "reason": "packaging workflow detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 0,
            "reason": "dependency not pinned by hash detected -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "SAST tool is not run on all commits -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 10,
            "reason": "security policy file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": 0,
            "reason": "Project has not signed or included provenance with any releases.",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 0,
            "reason": "89 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "1b87537aaa2f3b1aa8f6bf5d8d41313511aee6ef",
        "ran_at": "2026-07-29T07:41:12Z",
        "aggregate_score": 4.7,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": true,
      "has_dependabot_config": false
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-21T10:30:47Z",
      "oldest_open_prs": [
        {
          "number": 5,
          "created_at": "2026-04-18T05:52:46Z",
          "last_comment_at": "2026-07-24T05:17:43Z",
          "last_comment_author": "akua-renovate"
        },
        {
          "number": 8,
          "created_at": "2026-04-18T13:26:21Z",
          "last_comment_at": "2026-07-24T05:17:42Z",
          "last_comment_author": "akua-renovate"
        },
        {
          "number": 25,
          "created_at": "2026-04-26T03:46:15Z",
          "last_comment_at": "2026-05-07T21:12:53Z",
          "last_comment_author": "akua-renovate"
        },
        {
          "number": 28,
          "created_at": "2026-04-26T06:24:19Z",
          "last_comment_at": "2026-07-24T05:17:44Z",
          "last_comment_author": "akua-renovate"
        },
        {
          "number": 29,
          "created_at": "2026-04-26T06:24:27Z",
          "last_comment_at": "2026-07-24T05:17:45Z",
          "last_comment_author": "akua-renovate"
        },
        {
          "number": 30,
          "created_at": "2026-04-27T14:19:36Z",
          "last_comment_at": "2026-07-24T05:17:41Z",
          "last_comment_author": "akua-renovate"
        },
        {
          "number": 31,
          "created_at": "2026-04-27T14:19:57Z",
          "last_comment_at": "2026-05-07T21:12:51Z",
          "last_comment_author": "akua-renovate"
        },
        {
          "number": 52,
          "created_at": "2026-05-07T21:14:46Z",
          "last_comment_at": "2026-05-08T03:40:55Z",
          "last_comment_author": "akua-renovate"
        },
        {
          "number": 84,
          "created_at": "2026-07-24T05:17:34Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 85,
          "created_at": "2026-07-24T05:17:39Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 86,
          "created_at": "2026-07-24T09:08:19Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 87,
          "created_at": "2026-07-24T09:08:25Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 88,
          "created_at": "2026-07-24T12:47:38Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 89,
          "created_at": "2026-07-24T12:49:29Z",
          "last_comment_at": null,
          "last_comment_author": null
        }
      ],
      "last_merged_pr_at": "2026-07-21T10:30:05Z",
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": [
        {
          "number": 67,
          "created_at": "2026-07-07T22:28:32Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 73,
          "created_at": "2026-07-13T16:40:34Z",
          "last_comment_at": "2026-07-14T07:01:46Z",
          "last_comment_author": "robinbraemer"
        },
        {
          "number": 74,
          "created_at": "2026-07-13T16:41:36Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 75,
          "created_at": "2026-07-13T16:44:22Z",
          "last_comment_at": "2026-07-14T07:01:58Z",
          "last_comment_author": "robinbraemer"
        },
        {
          "number": 76,
          "created_at": "2026-07-13T16:56:08Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 77,
          "created_at": "2026-07-13T16:58:28Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 78,
          "created_at": "2026-07-13T16:58:39Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 79,
          "created_at": "2026-07-13T16:58:51Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 80,
          "created_at": "2026-07-13T17:03:38Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 81,
          "created_at": "2026-07-13T17:03:55Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 82,
          "created_at": "2026-07-13T17:04:24Z",
          "last_comment_at": null,
          "last_comment_author": null
        }
      ]
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/akua-dev/akua",
    "host": "github.com",
    "name": "akua",
    "owner": "akua-dev"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "moderate",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 63,
      "inputs": {
        "security": 58,
        "vitality": 80,
        "community": 49,
        "governance": 49,
        "engineering": 80
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "good",
        "name": "Vitality",
        "value": 80,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "good",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 73,
            "inputs": {
              "commits_last_year": 523,
              "human_commit_share": 1,
              "days_since_last_push": 4,
              "active_weeks_last_year": 13
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 4 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 4
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "13/52 weeks with commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 13
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "523 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 523
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": null,
            "notes": [],
            "value": 90,
            "inputs": {
              "releases_count": 26,
              "latest_release_tag": "v0.8.25",
              "releases_from_tags": false,
              "days_since_latest_release": 17,
              "mean_days_between_releases": 4.8
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "26 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 26
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 17 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 17
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~4.8 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 4.8
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "at_risk",
        "name": "Community & Adoption",
        "value": 49,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 10,
            "inputs": {
              "forks": 0,
              "stars": 5,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "5 stars",
                "points": 9.8,
                "status": "partial",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 5
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "0 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "excellent",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": true,
              "has_issue_template": false,
              "has_code_of_conduct": true,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (Apache-2.0)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "Apache-2.0"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 18,
                "status": "met",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 13.5,
                "status": "met",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          },
          {
            "key": "ecosystem_adoption",
            "band": "moderate",
            "name": "Ecosystem adoption (downloads)",
            "note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "registry_dependents"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 60,
            "inputs": {
              "packages": [
                "@akua-dev/sdk",
                "@akua-dev/native"
              ],
              "dependents": null,
              "ecosystems": "npm",
              "total_downloads": null,
              "monthly_downloads": 4114
            },
            "components": [
              {
                "key": "monthly_downloads",
                "name": "Monthly downloads",
                "detail": "4,114 downloads/month across npm",
                "points": 48.2,
                "status": "partial",
                "details": [
                  {
                    "code": "downloads_monthly",
                    "params": {
                      "count": 4114,
                      "ecosystems": "npm"
                    }
                  }
                ],
                "max_points": 80
              },
              {
                "key": "registry_dependents",
                "name": "Registry dependents",
                "detail": "not reported by this ecosystem",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_reported_by_this_ecosystem",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "at_risk",
        "name": "Sustainability & Governance",
        "value": 49,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 22,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 2,
              "top_contributor_share": 0.998
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 100% of commits",
                "points": 0,
                "status": "partial",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 100
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "2 contributors",
                "points": 2.7,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 4 contributing companies or organizations",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "at_risk",
            "name": "Issue & PR responsiveness",
            "note": null,
            "notes": [],
            "value": 39,
            "inputs": {
              "merged_prs": 46,
              "open_issues": 11,
              "closed_issues": 3,
              "issue_closed_ratio": 0.214,
              "closed_unmerged_prs": 15
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "21% of issues closed",
                "points": 10,
                "status": "partial",
                "details": [
                  {
                    "code": "issues_closed_share",
                    "params": {
                      "share": 21
                    }
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "46/61 decided PRs merged",
                "points": 28.8,
                "status": "partial",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 46,
                      "decided": 61
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 1/29 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "moderate",
            "name": "Ownership & stewardship",
            "note": null,
            "notes": [],
            "value": 51,
            "inputs": {
              "followers": 11,
              "owner_type": "Organization",
              "is_verified": null,
              "owner_login": "akua-dev",
              "public_repos": 15,
              "account_age_days": 769
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "organization-owned",
                "points": 30,
                "status": "met",
                "details": [
                  {
                    "code": "owner_organization",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "11 followers of akua-dev",
                "points": 7.8,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 11,
                      "login": "akua-dev"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "15 public repos, account ~2 yr old",
                "points": 13,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 15
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 2
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "@akua-dev/sdk",
                "@akua-dev/native"
              ],
              "ecosystems": "npm",
              "any_deprecated": false,
              "min_days_since_publish": 7
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "2 package(s) on npm",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 2,
                      "ecosystems": "npm"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 7 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 7
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "26 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 26
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "good",
        "name": "Engineering Quality",
        "value": 80,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "moderate",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 66,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": false,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "4 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 4
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "9 out of 10 merged PRs checked by a CI test -- score normalized to 9",
                "points": 18,
                "status": "partial",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "excellent",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "topics": [
                "devops",
                "helm",
                "infrastructure-as-code",
                "kcl",
                "kubernetes",
                "kustomize",
                "rust",
                "security",
                "webassembly",
                "agentic-infra",
                "aumakua"
              ],
              "has_wiki": true,
              "homepage": "https://cli.akua.dev",
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": "https://cli.akua.dev",
                "points": 15,
                "status": "met",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": "11 topics",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "topics_count",
                    "params": {
                      "count": 11
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "moderate",
        "name": "Security",
        "value": 58,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "at_risk",
            "name": "Security posture",
            "note": null,
            "notes": [],
            "value": 47,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 18,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 0,
              "scorecard_aggregate": 4.7
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "9 out of 10 merged PRs checked by a CI test -- score normalized to 9",
                "points": 2.2,
                "status": "partial",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 1/29 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 4 contributing companies or organizations",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "update tool detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool is not run on all commits -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "89 existing vulnerabilities detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "excellent",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): No advisories left outstanding. Remaining weights renormalized. Matched the npm:@akua-dev/sdk@0.8.25 runtime dependency closure — what installing the published package pulls in — 16 packages. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "no_advisories_left_outstanding"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_published",
                "params": {
                  "package": "npm:@akua-dev/sdk@0.8.25",
                  "assessed": 16
                }
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "source": "osv",
              "advisories": 0,
              "affected_packages": 0,
              "assessed_packages": 16,
              "unassessed_packages": 0,
              "affected_by_severity": "none",
              "direct_affected_packages": 0
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "no direct dependency carries a known advisory",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "no_direct_advisories",
                    "params": {}
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "no indirect dependency carries a known advisory",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "no_indirect_advisories",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory carries a publication date",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_no_publication_date",
                    "params": {}
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 16,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 5
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "good",
        "name": "AI Readiness",
        "value": 71,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "excellent",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 1,
              "agent_instruction_files": [
                "AGENTS.md",
                "CLAUDE.md"
              ],
              "agent_instruction_max_bytes": 18329
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "AGENTS.md, CLAUDE.md",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "AGENTS.md, CLAUDE.md"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "100 of 100 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 100,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "moderate",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 61,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "Cargo.lock"
              ],
              "has_dockerfile": true,
              "typed_language": true,
              "bootstrap_files": [
                ".mise.toml",
                "Taskfile.yml",
                "docs/hero-source/Taskfile.yml"
              ],
              "has_devcontainer": false,
              "has_linter_config": false,
              "typecheck_configs": [
                "packages/sdk/tsconfig.json"
              ],
              "agent_commit_share": 0,
              "toolchain_manifests": [
                "Cargo.toml",
                "crates/akua-cli/Cargo.toml",
                "crates/akua-core/Cargo.toml",
                "crates/akua-napi/Cargo.toml",
                "crates/akua-render-worker/Cargo.toml",
                "crates/engine-host-wasm/Cargo.toml",
                "crates/helm-engine-wasm/Cargo.toml",
                "crates/helm-engine-wasm/go-src/go.mod",
                "crates/kustomize-engine-wasm/Cargo.toml",
                "crates/kustomize-engine-wasm/go-src/go.mod",
                "crates/source-hash/Cargo.toml"
              ],
              "dependency_bot_commit_share": 0
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": ".mise.toml, Taskfile.yml, docs/hero-source/Taskfile.yml",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".mise.toml, Taskfile.yml, docs/hero-source/Taskfile.yml"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "packages/sdk/tsconfig.json",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "packages/sdk/tsconfig.json"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "Dockerfile, lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Dockerfile, lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "no agent-authored commits among the last 100",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_authored_commits",
                    "params": {
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "no automated dependency updates observed",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_dependency_automation",
                    "params": {}
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 99,
            "inputs": {
              "primary_language": "Rust",
              "largest_source_bytes": 84955,
              "source_files_sampled": 194,
              "oversized_source_files": 4
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Rust (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Rust"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "4/194 source files over 60KB",
                "points": 53.9,
                "status": "partial",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 194,
                      "oversized": 4
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "at_risk",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "example_dirs": [
                "examples"
              ],
              "has_mcp_signal": false,
              "api_schema_files": []
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": "examples",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "examples"
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
    "Could not fetch crates package 'akua-cli' from its registry",
    "Could not fetch crates package 'akua-core' from its registry",
    "Could not fetch crates package 'akua-napi' from its registry",
    "Could not fetch crates package 'source-hash' from its registry",
    "Could not fetch crates package 'engine-host-wasm' from its registry",
    "Could not fetch crates package 'helm-engine-wasm' from its registry",
    "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-29T07:41:23.917526Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/a/akua-dev/akua.svg",
  "full_name": "akua-dev/akua",
  "license_state": "standard",
  "license_spdx": "Apache-2.0"
}