coilyco-flight-deck / cli-guard

Повний розв'язаний набір залежностей із графа залежностей GitHub: 9 прямих і 27 непрямих (транзитивних) пакетів. Транзитивне замикання є повним, коли в репозиторії закомічено lockfile.

Цей репозиторій не публікує пакета, який розпізнає індекс, тож оцінено його власний граф залежностей — 36 пакетів, серед яких є й піниї розробки та тестування, що ніколи не постачаються: 2 мають відомі сповіщення, з них 1 прямі.

Сповіщення означає, що версія, записана в графі залежностей, потрапляє в уражений діапазон. Досяжність не аналізується, а граф містить піниї розробки й тестування — знахідка може стосуватися інструментів, а не поставленого коду.

{
  "data": {
    "repo": {
      "topics": [
        "argv-validation",
        "lockdown-writer",
        "scope-tokens"
      ],
      "is_fork": false,
      "size_kb": 2146,
      "has_wiki": false,
      "homepage": null,
      "languages": {
        "Go": 1329047,
        "Shell": 787,
        "Makefile": 811
      },
      "pushed_at": "2026-07-22T22:34:17Z",
      "created_at": "2026-05-13T11:20:48Z",
      "owner_type": "Organization",
      "updated_at": "2026-07-14T23:15:04Z",
      "description": "urfave/cli v3 extension: scope-tokens, audit log, lockdown writer, argv-validation framework. Intended for the urfave/cli ecosystem.",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "MIT",
      "default_branch": "main",
      "license_spdx_raw": "MIT",
      "primary_language": "Go",
      "significant_languages": [
        "Go"
      ]
    },
    "owner": {
      "blog": "https://coilysiren.me",
      "name": null,
      "type": "Organization",
      "login": "coilyco-flight-deck",
      "company": null,
      "location": null,
      "followers": 1,
      "avatar_url": "https://avatars.githubusercontent.com/u/288480294?v=4",
      "created_at": "2026-05-28T00:23:33Z",
      "is_verified": null,
      "public_repos": 29,
      "account_age_days": 60
    },
    "license": {
      "state": "standard",
      "spdx_id": "MIT",
      "raw_spdx": "MIT",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.100.0",
          "kind": "minor",
          "published_at": "2026-07-14T09:29:39Z"
        },
        {
          "tag": "v0.99.0",
          "kind": "minor",
          "published_at": "2026-07-14T09:17:38Z"
        },
        {
          "tag": "v0.98.0",
          "kind": "minor",
          "published_at": "2026-07-13T23:18:41Z"
        },
        {
          "tag": "v0.97.0",
          "kind": "minor",
          "published_at": "2026-07-13T02:25:57Z"
        },
        {
          "tag": "v0.96.0",
          "kind": "minor",
          "published_at": "2026-07-12T21:38:39Z"
        },
        {
          "tag": "v0.95.0",
          "kind": "minor",
          "published_at": "2026-07-12T06:39:11Z"
        },
        {
          "tag": "v0.94.0",
          "kind": "minor",
          "published_at": "2026-07-10T22:37:59Z"
        },
        {
          "tag": "v0.93.0",
          "kind": "minor",
          "published_at": "2026-07-10T22:12:53Z"
        },
        {
          "tag": "v0.92.0",
          "kind": "minor",
          "published_at": "2026-07-10T22:12:20Z"
        },
        {
          "tag": "v0.91.0",
          "kind": "minor",
          "published_at": "2026-07-10T11:56:21Z"
        },
        {
          "tag": "v0.90.0",
          "kind": "minor",
          "published_at": "2026-07-10T08:21:01Z"
        },
        {
          "tag": "v0.89.0",
          "kind": "minor",
          "published_at": "2026-07-09T22:54:34Z"
        },
        {
          "tag": "v0.88.0",
          "kind": "minor",
          "published_at": "2026-07-09T21:45:26Z"
        },
        {
          "tag": "v0.87.0",
          "kind": "minor",
          "published_at": "2026-07-09T18:15:55Z"
        },
        {
          "tag": "v0.86.0",
          "kind": "minor",
          "published_at": "2026-07-09T15:51:38Z"
        },
        {
          "tag": "v0.85.0",
          "kind": "minor",
          "published_at": "2026-07-08T17:17:08Z"
        },
        {
          "tag": "v0.84.0",
          "kind": "minor",
          "published_at": "2026-07-08T10:27:44Z"
        },
        {
          "tag": "v0.83.0",
          "kind": "minor",
          "published_at": "2026-07-08T10:15:26Z"
        },
        {
          "tag": "v0.82.0",
          "kind": "minor",
          "published_at": "2026-07-07T23:04:31Z"
        },
        {
          "tag": "v0.81.0",
          "kind": "minor",
          "published_at": "2026-07-07T22:46:05Z"
        },
        {
          "tag": "v0.80.0",
          "kind": "minor",
          "published_at": "2026-07-07T09:28:30Z"
        },
        {
          "tag": "v0.79.0",
          "kind": "minor",
          "published_at": "2026-07-07T09:13:33Z"
        },
        {
          "tag": "v0.78.0",
          "kind": "minor",
          "published_at": "2026-07-07T08:59:25Z"
        },
        {
          "tag": "v0.77.0",
          "kind": "minor",
          "published_at": "2026-07-07T07:51:26Z"
        },
        {
          "tag": "v0.76.0",
          "kind": "minor",
          "published_at": "2026-07-07T06:27:54Z"
        },
        {
          "tag": "v0.75.0",
          "kind": "minor",
          "published_at": "2026-07-06T17:07:41Z"
        },
        {
          "tag": "v0.74.0",
          "kind": "minor",
          "published_at": "2026-07-06T16:59:27Z"
        },
        {
          "tag": "v0.73.0",
          "kind": "minor",
          "published_at": "2026-07-06T16:54:54Z"
        },
        {
          "tag": "v0.72.0",
          "kind": "minor",
          "published_at": "2026-07-04T09:22:05Z"
        },
        {
          "tag": "v0.71.0",
          "kind": "minor",
          "published_at": "2026-07-03T22:17:49Z"
        },
        {
          "tag": "v0.70.0",
          "kind": "minor",
          "published_at": "2026-07-03T21:04:50Z"
        },
        {
          "tag": "v0.69.0",
          "kind": "minor",
          "published_at": "2026-07-03T19:57:31Z"
        },
        {
          "tag": "v0.68.0",
          "kind": "minor",
          "published_at": "2026-07-03T19:10:21Z"
        },
        {
          "tag": "v0.67.0",
          "kind": "minor",
          "published_at": "2026-07-02T17:19:31Z"
        },
        {
          "tag": "v0.66.0",
          "kind": "minor",
          "published_at": "2026-07-01T16:32:40Z"
        },
        {
          "tag": "v0.65.0",
          "kind": "minor",
          "published_at": "2026-07-01T08:40:44Z"
        },
        {
          "tag": "v0.64.0",
          "kind": "minor",
          "published_at": "2026-07-01T05:03:46Z"
        },
        {
          "tag": "v0.63.0",
          "kind": "minor",
          "published_at": "2026-07-01T04:53:35Z"
        },
        {
          "tag": "v0.62.0",
          "kind": "minor",
          "published_at": "2026-07-01T04:50:14Z"
        },
        {
          "tag": "v0.61.0",
          "kind": "minor",
          "published_at": "2026-06-26T07:38:46Z"
        },
        {
          "tag": "v0.60.0",
          "kind": "minor",
          "published_at": "2026-06-25T18:44:05Z"
        },
        {
          "tag": "v0.59.0",
          "kind": "minor",
          "published_at": "2026-06-25T10:47:16Z"
        },
        {
          "tag": "v0.58.0",
          "kind": "minor",
          "published_at": "2026-06-25T10:34:59Z"
        },
        {
          "tag": "v0.57.0",
          "kind": "minor",
          "published_at": "2026-06-25T09:56:51Z"
        },
        {
          "tag": "v0.56.0",
          "kind": "minor",
          "published_at": "2026-06-25T05:24:59Z"
        },
        {
          "tag": "v0.55.0",
          "kind": "minor",
          "published_at": "2026-06-25T05:10:35Z"
        },
        {
          "tag": "v0.54.0",
          "kind": "minor",
          "published_at": "2026-06-25T05:09:03Z"
        },
        {
          "tag": "v0.53.0",
          "kind": "minor",
          "published_at": "2026-06-25T04:58:50Z"
        },
        {
          "tag": "v0.52.0",
          "kind": "minor",
          "published_at": "2026-06-25T04:55:05Z"
        },
        {
          "tag": "v0.51.0",
          "kind": "minor",
          "published_at": "2026-06-24T09:01:04Z"
        },
        {
          "tag": "v0.50.0",
          "kind": "minor",
          "published_at": "2026-06-24T08:49:46Z"
        },
        {
          "tag": "v0.49.0",
          "kind": "minor",
          "published_at": "2026-06-24T07:08:57Z"
        },
        {
          "tag": "v0.48.0",
          "kind": "minor",
          "published_at": "2026-06-24T06:15:11Z"
        },
        {
          "tag": "v0.47.0",
          "kind": "minor",
          "published_at": "2026-06-24T05:52:09Z"
        },
        {
          "tag": "v0.46.0",
          "kind": "minor",
          "published_at": "2026-06-24T04:52:12Z"
        },
        {
          "tag": "v0.45.0",
          "kind": "minor",
          "published_at": "2026-06-24T04:50:18Z"
        },
        {
          "tag": "v0.44.0",
          "kind": "minor",
          "published_at": "2026-06-18T09:34:18Z"
        },
        {
          "tag": "v0.43.0",
          "kind": "minor",
          "published_at": "2026-06-18T08:52:16Z"
        },
        {
          "tag": "v0.42.0",
          "kind": "minor",
          "published_at": "2026-06-18T08:38:54Z"
        },
        {
          "tag": "v0.41.0",
          "kind": "minor",
          "published_at": "2026-06-18T07:56:52Z"
        },
        {
          "tag": "v0.40.0",
          "kind": "minor",
          "published_at": "2026-06-18T07:55:37Z"
        },
        {
          "tag": "v0.39.0",
          "kind": "minor",
          "published_at": "2026-06-18T07:51:06Z"
        },
        {
          "tag": "v0.38.0",
          "kind": "minor",
          "published_at": "2026-06-18T07:49:43Z"
        },
        {
          "tag": "v0.37.0",
          "kind": "minor",
          "published_at": "2026-06-18T07:45:15Z"
        },
        {
          "tag": "v0.36.0",
          "kind": "minor",
          "published_at": "2026-06-18T07:36:47Z"
        },
        {
          "tag": "v0.35.0",
          "kind": "minor",
          "published_at": "2026-06-18T07:33:21Z"
        },
        {
          "tag": "v0.34.0",
          "kind": "minor",
          "published_at": "2026-06-18T03:40:40Z"
        },
        {
          "tag": "v0.33.0",
          "kind": "minor",
          "published_at": "2026-06-18T02:41:43Z"
        },
        {
          "tag": "v0.32.0",
          "kind": "minor",
          "published_at": "2026-06-18T00:50:55Z"
        },
        {
          "tag": "v0.31.0",
          "kind": "minor",
          "published_at": "2026-06-17T23:20:55Z"
        },
        {
          "tag": "v0.30.0",
          "kind": "minor",
          "published_at": "2026-06-17T23:03:04Z"
        },
        {
          "tag": "v0.29.0",
          "kind": "minor",
          "published_at": "2026-06-17T22:02:45Z"
        },
        {
          "tag": "v0.28.0",
          "kind": "minor",
          "published_at": "2026-06-17T20:54:40Z"
        },
        {
          "tag": "v0.27.0",
          "kind": "minor",
          "published_at": "2026-06-17T19:53:53Z"
        },
        {
          "tag": "v0.26.0",
          "kind": "minor",
          "published_at": "2026-06-17T18:58:32Z"
        },
        {
          "tag": "v0.25.0",
          "kind": "minor",
          "published_at": "2026-06-17T18:23:10Z"
        },
        {
          "tag": "v0.24.0",
          "kind": "minor",
          "published_at": "2026-06-17T18:10:43Z"
        },
        {
          "tag": "v0.23.0",
          "kind": "minor",
          "published_at": "2026-06-17T16:01:54Z"
        },
        {
          "tag": "v0.22.0",
          "kind": "minor",
          "published_at": "2026-06-17T11:37:43Z"
        },
        {
          "tag": "v0.21.0",
          "kind": "minor",
          "published_at": "2026-06-17T11:29:04Z"
        },
        {
          "tag": "v0.20.0",
          "kind": "minor",
          "published_at": "2026-06-16T01:19:40Z"
        },
        {
          "tag": "v0.19.0",
          "kind": "minor",
          "published_at": "2026-06-16T00:45:26Z"
        },
        {
          "tag": "v0.18.0",
          "kind": "minor",
          "published_at": "2026-06-15T19:03:15Z"
        },
        {
          "tag": "v0.17.0",
          "kind": "minor",
          "published_at": "2026-06-15T18:42:44Z"
        },
        {
          "tag": "v0.16.0",
          "kind": "minor",
          "published_at": "2026-06-15T18:15:37Z"
        },
        {
          "tag": "v0.15.0",
          "kind": "minor",
          "published_at": "2026-06-15T14:08:29Z"
        },
        {
          "tag": "v0.14.0",
          "kind": "minor",
          "published_at": "2026-06-12T05:10:05Z"
        },
        {
          "tag": "v0.13.0",
          "kind": "minor",
          "published_at": "2026-06-11T01:08:09Z"
        },
        {
          "tag": "v0.12.0",
          "kind": "minor",
          "published_at": "2026-06-10T18:52:28Z"
        },
        {
          "tag": "v0.11.0",
          "kind": "minor",
          "published_at": "2026-06-10T18:20:46Z"
        },
        {
          "tag": "v0.10.0",
          "kind": "minor",
          "published_at": "2026-06-10T18:13:05Z"
        },
        {
          "tag": "v0.9.0",
          "kind": "minor",
          "published_at": "2026-06-10T18:02:48Z"
        },
        {
          "tag": "v0.8.0",
          "kind": "minor",
          "published_at": "2026-06-10T17:58:02Z"
        },
        {
          "tag": "v0.7.0",
          "kind": "minor",
          "published_at": "2026-06-10T17:34:58Z"
        },
        {
          "tag": "v0.6.0",
          "kind": "minor",
          "published_at": "2026-06-08T05:57:40Z"
        },
        {
          "tag": "v0.5.0",
          "kind": "minor",
          "published_at": "2026-06-08T01:15:45Z"
        },
        {
          "tag": "v0.4.0",
          "kind": "minor",
          "published_at": "2026-06-07T16:26:29Z"
        },
        {
          "tag": "v0.3.0",
          "kind": "minor",
          "published_at": "2026-06-04T00:17:27Z"
        },
        {
          "tag": "v0.2.0",
          "kind": "minor",
          "published_at": "2026-06-03T23:24:56Z"
        },
        {
          "tag": "v0.1.0",
          "kind": "minor",
          "published_at": "2026-05-28T07:06:26Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "b28749551c897f8b55f5ba2bfe2614b0bc8b98c1",
          "body": "…ec symlink' (#227) from issue-185-sandbox-leakfree into main\n\nReviewed-on: https://forgejo.coilysiren.me/coilyco-flight-deck/cli-guard/pulls/227",
          "is_bot": false,
          "headline": "Merge pull request 'sandbox: leak-free placement for the .cliguard ex…",
          "author_name": "Kai Siren",
          "author_login": "coilysiren",
          "committed_at": "2026-07-14T09:29:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "97a01ccfba2c96a69902d1fec3d84dedad07fde6",
          "body": "Signed-off-by: Codex <noreply@openai.com>",
          "is_bot": false,
          "headline": "sandbox: reduce jail setup complexity",
          "author_name": "example-bot",
          "author_login": null,
          "committed_at": "2026-07-14T09:24:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f64e4cc35e93a6609bafb87073efcb7ba527ac5d",
          "body": null,
          "is_bot": false,
          "headline": "ci: tame golangci-lint scratch use",
          "author_name": "example-bot",
          "author_login": null,
          "committed_at": "2026-07-14T09:19:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "af3306bd63c5766765d60d7032dcc31dfe02b77b",
          "body": "…d passthroughs' (#228) from issue-214 into main",
          "is_bot": false,
          "headline": "Merge pull request 'MCP KDL: add upstream MCP proxy grants for guarde…",
          "author_name": "Coilyco Robotic Operations Division",
          "author_login": null,
          "committed_at": "2026-07-14T09:17:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ba0a2e246b7382049150138b6cdd36d80094632f",
          "body": null,
          "is_bot": false,
          "headline": "Add inline MCP proxy grants",
          "author_name": "example-bot",
          "author_login": null,
          "committed_at": "2026-07-14T09:14:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d1057cd33fef75680c7db3fbcdae2b2f424c1c89",
          "body": "Configure Go build, module, and golangci-lint scratch through GITHUB_ENV so Forgejo and GitHub runners can use the runner temp volume without relying on unsupported job-level expressions.",
          "is_bot": false,
          "headline": "ci: export Go scratch through runner env",
          "author_name": "example-bot",
          "author_login": null,
          "committed_at": "2026-07-14T09:12:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d13a169c9a18779cda0c516a8a9daeac56449ef0",
          "body": "Use runner.temp for Go build, module, and golangci-lint caches so the CI jobs do not fill the container overlay during typecheck.",
          "is_bot": false,
          "headline": "ci: route Go scratch to runner temp",
          "author_name": "example-bot",
          "author_login": null,
          "committed_at": "2026-07-14T09:11:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d4bb2a10624356103b90c2d214154cc7401b91b0",
          "body": "closes #185",
          "is_bot": false,
          "headline": "sandbox: keep exec symlink off host filesystem",
          "author_name": "example-bot",
          "author_login": null,
          "committed_at": "2026-07-14T09:05:20Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "99b33bcaa16a26afa42304bf1fdd0ea8fbc707f7",
          "body": "…every matching binary' (#226) from issue-225 into main\n\nReviewed-on: https://forgejo.coilysiren.me/coilyco-flight-deck/cli-guard/pulls/226",
          "is_bot": false,
          "headline": "Merge pull request 'Enforce lockdown targets by exec basename across …",
          "author_name": "Kai Siren",
          "author_login": "coilysiren",
          "committed_at": "2026-07-13T23:18:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c5f8e8e6644a4119ec55f5f7eee1a0cf6af10a45",
          "body": null,
          "is_bot": false,
          "headline": "enforce basename-wide lockdown targets",
          "author_name": "example-bot",
          "author_login": null,
          "committed_at": "2026-07-13T23:01:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4ef2eb837a174ed73fcf4c9bba72a40f430a1d83",
          "body": "Kai's call: promote.yml already runs the full repo gate on the exact\nsha it fast-forwards, so re-running the suite on the release branch\nonly lets a flaky rerun fail an already-vouched promotion. Drop the\nrelease.yml front test job and stop ci.yml triggering on release\npushes. Same change lands in aos and ward.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_014kxueVB8mcAnrxmHr7KTqZ",
          "is_bot": false,
          "headline": "feat(release): trust the promote gate - release pushes skip CI",
          "author_name": "kai [she]",
          "author_login": "coilysiren",
          "committed_at": "2026-07-13T02:25:57Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "e023958b1d53b8333be1a64aee8ac8a2ac8d0cf4",
          "body": "…promote push\n\nactions/checkout stores the job token as an http extraheader in the local\ngit config, and that Authorization header overrides the oauth2 PAT in the\npromote push URL. The release push therefore authenticated as the internal\nActions user, whose pushes Forgejo deliberately skips workflow\n[…]\ne as the\nCI_RELEASE_TOKEN user so release.yml enqueues.\n\nRefs ward#1117.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01MecEr36ZCE4WytNvRAXPrX",
          "is_bot": false,
          "headline": "fix(promote): stop checkout's persisted job token from hijacking the …",
          "author_name": "kai [she]",
          "author_login": "coilysiren",
          "committed_at": "2026-07-12T21:38:39Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "c35076c7b935a93e35f97c8ee81a27c027c71643",
          "body": "…ed release branch\n\npromote.yml (stage 1) re-runs the full repo gate on every main push and\nfast-forwards release only when green, pushing with CI_RELEASE_TOKEN (the\ncoilyco-ops PAT with write:repository + read:user - without read:user Forgejo\ndrops the enqueue, ward#1117). release.yml (stage 2) now\n[…]\nh.\n\nSame flow ward and aos landed (ward#1126, aos#475).\n\nRefs ward#1117.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01MecEr36ZCE4WytNvRAXPrX",
          "is_bot": false,
          "headline": "feat(release): two-stage release - gate-green main promotes to a queu…",
          "author_name": "kai [she]",
          "author_login": "coilysiren",
          "committed_at": "2026-07-12T21:15:28Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "97daf7607902baeee8761bc25d2e220a50faca75",
          "body": "…cause that fired' (#224) from fix/refusal-names-the-actual-gate into main",
          "is_bot": false,
          "headline": "Merge pull request 'fix(gittree): match the refusal rationale to the …",
          "author_name": "Kai Siren",
          "author_login": "coilysiren",
          "committed_at": "2026-07-12T06:39:11Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1456b77d661a9ad9ac4ba187a572796280285398",
          "body": "…rd#1129)\n\nThe refusal boilerplate quoted the clean-tree rule for every cause, so\nan operator whose branch simply had no upstream was told \"Repo verbs\nrequire a clean tree\" - a wrong diagnosis on a clean checkout. The\nrationale now names the property that actually failed: clean tree for\ndirty states\n[…]\n\nRefs https://forgejo.coilysiren.me/coilyco-flight-deck/ward/issues/1129\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_016Cym37PsLtA61parAQyeAw",
          "is_bot": false,
          "headline": "fix(gittree): match the refusal rationale to the cause that fired (wa…",
          "author_name": "kai [she]",
          "author_login": "coilysiren",
          "committed_at": "2026-07-12T06:36:18Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "fd538da5aa3697521073e57b07e8e07b44eec786",
          "body": "…e scope' (#205) from issue-204 into main",
          "is_bot": false,
          "headline": "Merge pull request 'Remove cli-guard mcporter integration from releas…",
          "author_name": "Coilyco Robotic Operations Division",
          "author_login": null,
          "committed_at": "2026-07-10T22:37:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "75d2b28df056379dbc0f881cd355c10d5f8bb548",
          "body": null,
          "is_bot": false,
          "headline": "merge main to refresh mcporter removal",
          "author_name": "example-bot",
          "author_login": null,
          "committed_at": "2026-07-10T22:36:30Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a2c87054a72edf5fd870c5e5bc6a501163a117a6",
          "body": "…) from issue-203 into main",
          "is_bot": false,
          "headline": "Merge pull request 'Remove legacy cli-guard dispatch subsystem' (#207…",
          "author_name": "Coilyco Robotic Operations Division",
          "author_login": null,
          "committed_at": "2026-07-10T22:12:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "25d058c673d09b59ac873b06c80336694503fd36",
          "body": "…guardfile' (#220) from issue-219 into main",
          "is_bot": false,
          "headline": "Merge pull request 'Rename fleetconfig syntax to agents and singular …",
          "author_name": "Coilyco Robotic Operations Division",
          "author_login": null,
          "committed_at": "2026-07-10T22:12:36Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f2d4e73b660631e486c1ce2a6a434e1ed7367296",
          "body": "…from issue-216 into main",
          "is_bot": false,
          "headline": "Merge pull request 'Add fetch overlays and first input sugar' (#221) …",
          "author_name": "Coilyco Robotic Operations Division",
          "author_login": null,
          "committed_at": "2026-07-10T22:12:20Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f8d2fccbd185be579620733ff80bbff3ff4fa2d9",
          "body": "Adds reject cases for mixing new singular guardfile nodes with the\nlegacy guardfiles alias in both orders, and for a duplicated legacy\nguardfiles alias node.\n\ncloses #219\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "test(fleetconfig): cover guardfile/guardfiles mixing rejection",
          "author_name": "claude-linux-f6f16ee4cae5-fe92-she-her",
          "author_login": null,
          "committed_at": "2026-07-10T21:54:45Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "e212ede9d0d16319a1c52a5b67f76ef47111457f",
          "body": "closes #216",
          "is_bot": false,
          "headline": "Add fetch overlays and first input sugar",
          "author_name": "example-bot",
          "author_login": null,
          "committed_at": "2026-07-10T17:14:05Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "079afa03f775e12ef75cdad98990277a79830d6e",
          "body": null,
          "is_bot": false,
          "headline": "merge main to refresh dispatch removal",
          "author_name": "example-bot",
          "author_login": null,
          "committed_at": "2026-07-10T16:58:08Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f6063aa7395eb159a6b5e4f67648e1cc102b2d66",
          "body": null,
          "is_bot": false,
          "headline": "feat: rename fleetconfig syntax to agents",
          "author_name": "example-bot",
          "author_login": null,
          "committed_at": "2026-07-10T16:55:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3b7e936a2429af3c6783d8194c781e966a476ba1",
          "body": null,
          "is_bot": false,
          "headline": "fix(ci): use published dev-base image",
          "author_name": "example-bot",
          "author_login": null,
          "committed_at": "2026-07-10T11:56:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "06a2ae92538d1df6efa686763f4f1f257d6ed598",
          "body": "…pare' (#218) from issue-217 into main\n\nReviewed-on: https://forgejo.coilysiren.me/coilyco-flight-deck/cli-guard/pulls/218",
          "is_bot": false,
          "headline": "Merge pull request 'Inline cli-guard Telegram alerts so workflows pre…",
          "author_name": "Kai Siren",
          "author_login": "coilysiren",
          "committed_at": "2026-07-10T08:21:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d21d9688692e7279f2ab55cb32c302bd72a069ce",
          "body": null,
          "is_bot": false,
          "headline": "fix(workflows): inline telegram alerts",
          "author_name": "example-bot",
          "author_login": null,
          "committed_at": "2026-07-10T08:17:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3c361fc18237c14a3994270f47dfeb618cf6f10c",
          "body": null,
          "is_bot": false,
          "headline": "chore(ci): add Telegram main-failure alerts",
          "author_name": "example-bot",
          "author_login": null,
          "committed_at": "2026-07-10T04:47:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "94f56731217edda07eca50a45a5501cfa5d5ddbe",
          "body": "Add recursive inline body fields and truthy schema emission for object and array bodies, preserve flat shorthand compatibility, and enforce nested required fields at request assembly.\n\ncloses #212",
          "is_bot": false,
          "headline": "feat(opcore): support nested inline body schema",
          "author_name": "coilyco-ops",
          "author_login": null,
          "committed_at": "2026-07-09T22:54:34Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "41e5a4d49f79f50181392736568ea66f41ece4fd",
          "body": "closes #213",
          "is_bot": false,
          "headline": "clean up issue-reference guard hits",
          "author_name": "coilyco-ops",
          "author_login": null,
          "committed_at": "2026-07-09T21:45:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "bf1163a3f33c3202033e32a476897e98b8124450",
          "body": null,
          "is_bot": false,
          "headline": "Merge issue-124: export issue ref parser",
          "author_name": "coilyco-ops",
          "author_login": null,
          "committed_at": "2026-07-09T18:15:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ab7e707fc08d88bd2c5dca35b4ce0e67267ae46e",
          "body": "… issue-209 into main",
          "is_bot": false,
          "headline": "Merge pull request 'Run release workflow in aos dev-base' (#210) from…",
          "author_name": "Coilyco Robotic Operations Division",
          "author_login": null,
          "committed_at": "2026-07-09T15:51:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "760ac37980338131dc13df1d900b574891ba1aaf",
          "body": null,
          "is_bot": false,
          "headline": "fix: pin release workflow to dev-base",
          "author_name": "coilyco-ops",
          "author_login": null,
          "committed_at": "2026-07-09T03:55:47Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "05e8b788468f4804bde28dca458dc904da12feea",
          "body": null,
          "is_bot": false,
          "headline": "remove legacy dispatch subsystem",
          "author_name": "coilyco-ops",
          "author_login": null,
          "committed_at": "2026-07-09T02:32:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "18b20c23fd52adc3cd1ab285cec31a29e817ef0b",
          "body": null,
          "is_bot": false,
          "headline": "drop mcporter release surface",
          "author_name": "coilyco-ops",
          "author_login": null,
          "committed_at": "2026-07-09T02:31:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4744df17086f807d944cd83b72e9a12f2631ce89",
          "body": null,
          "is_bot": false,
          "headline": "feat: export issue ref parser",
          "author_name": "coilyco-ops",
          "author_login": null,
          "committed_at": "2026-07-09T00:20:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a90604c56b176d48d168628ab5cc664cff97ccd0",
          "body": "closes #196",
          "is_bot": false,
          "headline": "feat(specverb): route live leaf assembly through opcore",
          "author_name": "coilyco-ops",
          "author_login": null,
          "committed_at": "2026-07-08T17:17:08Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3c2b9176d960d6d7355a87e6e0f66ffe13a3406b",
          "body": "closes #201",
          "is_bot": false,
          "headline": "ci: pin workflows to dev-base image",
          "author_name": "coilyco-ops",
          "author_login": null,
          "committed_at": "2026-07-08T10:27:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e771405d38bb58ff555188b083b9aafc67c50474",
          "body": null,
          "is_bot": false,
          "headline": "accept sparse fleet agents",
          "author_name": "coilyco-ops",
          "author_login": null,
          "committed_at": "2026-07-08T10:15:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "748ef9976de049931c853044302f01d6c02c8284",
          "body": null,
          "is_bot": false,
          "headline": "Merge remote-tracking branch 'origin/main' into issue-179",
          "author_name": "claude-linux-fed933e26618-fe01-she-her",
          "author_login": null,
          "committed_at": "2026-07-07T23:04:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "843560cc0a79028021ca2cc23e88320851d8035d",
          "body": "…lect\n\nAdd a first-class top-level `description \"...\"` node to the KDL grammar so a\nspec's standing \"what/why\" context is queryable contract data, not prose smuggled\nthrough the code-comments top-of-file header exemption. This is Layer 1 of the\nthree-layer fix in #179 (cli-guard grammar -> ward-kdl \n[…]\n: new docs/kdl-description.md (the grammar walkthrough); pointers from\nkdl-specs.md, fleetconfig.md, and FEATURES.md.\n\ncloses #179\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(kdl): first-class top-level `description` node on every .kdl dia…",
          "author_name": "claude-linux-fed933e26618-fe01-she-her",
          "author_login": null,
          "committed_at": "2026-07-07T23:04:12Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "b94dba722a5b160912b73157c3aa6864066d482f",
          "body": null,
          "is_bot": false,
          "headline": "chore: drop committed lockdown settings",
          "author_name": "coilyco-ops",
          "author_login": null,
          "committed_at": "2026-07-07T22:46:05Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "09d7b46f298c358287fe15caad190c29e66dfac0",
          "body": null,
          "is_bot": false,
          "headline": "Merge remote-tracking branch 'origin/main' into issue-199",
          "author_name": "claude-linux-1371de1669fe-fb31-she-her",
          "author_login": null,
          "committed_at": "2026-07-07T09:28:30Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9b1acbfadefae7b69448d97ae12d13071fc35451",
          "body": "…or the ward-mcp grammar\n\nAdd opcore.ParseInline, a second Descriptor source that STATES a descriptor\nfrom inline KDL instead of resolving it against an OpenAPI spec, mirroring how\nexecverb.Parse authors exec commands with no spec. It lives in http/opcore\n(urfave/cli-free) so MCP never re-couples to\n[…]\nd, and\nthe fail-closed grammar surface. No urfave/cli import in opcore. Grammar walkthrough\nin docs/opcore-inline.md.\n\ncloses #199\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(opcore) [PR3/3 of #196]: inline-operation source (ParseInline) f…",
          "author_name": "claude-linux-1371de1669fe-fb31-she-her",
          "author_login": null,
          "committed_at": "2026-07-07T09:28:09Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "2acbd83b4eaee1eeb9c1299424ceba9adecf76a0",
          "body": "…ema/Property (+ JSONSchema emitter)\n\nAdd the transport-neutral input-schema surface to http/opcore: Schema /\nProperty, Descriptor.InputSchema(), and a draft-07 Schema.JSONSchema()\nemitter. Path params lower to required strings at Location=path; query /\nbody / form fields take type, array element ty\n[…]\ntSchema). The neutral Property.Location hint has\nno JSON-schema equivalent and is omitted from the emitted document; a\nconsumer reads the Schema struct for it. No urfave/cli import added.\n\ncloses #198",
          "is_bot": false,
          "headline": "feat(opcore) [PR2/3 of #196]: Descriptor.InputSchema() -> neutral Sch…",
          "author_name": "claude-linux-19d7c2c14158-ee66-she-her",
          "author_login": null,
          "committed_at": "2026-07-07T09:13:33Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5ec479b9058e74a2834ca6fee3b2b4e4ad48953d",
          "body": "…elf-guarding Operation.Execute\n\nMove the spec-driven verb engine core out from behind the urfave/cli\nprojection into a new package http/opcore that imports NO urfave/cli, so a\nnon-CLI consumer (ward-mcp) can drive it. Zero behavior change: every existing\nspecverb/execverb test stays green.\n\nMoved i\n[…]\nExecute (deferred to keep\nPR1 byte-identical) and route multipart/form through opcore once Args grows a\nform surface.\n\ncloses #197\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(opcore) [PR1/3 of #196]: extract urfave/cli-free engine core + s…",
          "author_name": "claude-linux-543f353903a9-eb60-she-her",
          "author_login": null,
          "committed_at": "2026-07-07T08:59:25Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "ecf0520599eb2d4aa9b201cf400d3d440c22f571",
          "body": "The operationId fallback treated an exact word-set match and a strict\nsuperset match as equal candidates, so a grant that exactly names one\noperationId still failed closed when another was a superset of its words,\nforcing a needless `op` pin.\n\nThree interlocking fixes let the skillsmp shape (paths /\n[…]\ns.\n\nRemoves a whole class of needless `op` pins and lives up to the\n\"op is rarely needed\" promise. No grammar change.\n\ncloses #195\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(specverb): exact operationId word-set match beats a superset",
          "author_name": "claude-linux-f50cee118f4e-aa09-she-her",
          "author_login": null,
          "committed_at": "2026-07-07T07:51:26Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "d9e805eddf605e9b6741576bccd873a2176bba35",
          "body": "Add pkg/agentid, the verified Go port of aos' canonical short agent-id\ngenerator (agentic_os/agent_id.py). Ids are 2 dictatable letters + 2\ndigits over the confusable-free alphabet; NewID is crypto/rand-backed\nand uniform, SeededID is the deterministic parity anchor.\n\nVendors aos' agent_id_vectors.j\n[…]\nabet fields in TestVectorContract, so any drift\nfrom the cross-language contract fails CI. Scope is name-minting only:\nthe audit SessionID and CLAUDE_SESSION_ID identifiers are untouched.\n\ncloses #177",
          "is_bot": false,
          "headline": "feat(agentid): Go port of the canonical o2r agent-id generator",
          "author_name": "claude-linux-e4dfc4793fea-eb13-she-her",
          "author_login": null,
          "committed_at": "2026-07-07T06:27:54Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b41964703b75ed5d210f5b0239bec0b5e7d33a78",
          "body": "pid 1 is init and alive inside a Linux container, so kill(1, 0)\nreports it present. The liveness filter kept the RUNNING entry,\nbreaking TestRegistryListFiltersDeadPIDs (leftover PID 1 write never\nremoved) and TestStatus_List_WindowFiltersOld (RUNNING dispatches\nalways show, so the window fallback n\n[…]\na shared deadPID = 2_000_000_000 const so\nno future dispatch test reaches for 1 again. Test-only, no behavior\nchange.\n\ncloses #194\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(dispatch): stop seeding PID 1 as a dead pid in tests",
          "author_name": "claude-linux-08306d0c8f9c-af99-she-her",
          "author_login": null,
          "committed_at": "2026-07-06T17:07:41Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "41664e47c323fa9ff7fa2b018525505faffd74f0",
          "body": "# Conflicts:\n#\tcli/execverb/action.go\n#\tcli/execverb/action_run.go\n#\tcli/execverb/action_test.go\n#\tgodoc-current.txt\n#\tpkg/stepflow/stepflow.go",
          "is_bot": false,
          "headline": "Merge remote-tracking branch 'origin/main' into issue-193",
          "author_name": "claude-linux-ed70b8ea180e-ac25-she-her",
          "author_login": null,
          "committed_at": "2026-07-06T16:59:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b8e3e63ff0247949f1924b229d9564b0df991f26",
          "body": "Add OpLabelIssue to the broker's write-tier surface so a ward director\nread-only surface can relabel an issue through the credential broker without\nholding the bot token - the load-bearing case being adding \"headless\" to raise\na freshly-filed issue's dispatch ceiling, which today forces a --force fa\n[…]\ncommits, blocking any new commit. Trims are\nbehavior-neutral wording changes; godoc-current.txt regenerated to match.\n\ncloses #193\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(broker): issue-label mutation op for in-tier director labeling",
          "author_name": "claude-linux-ed70b8ea180e-ac25-she-her",
          "author_login": null,
          "committed_at": "2026-07-06T16:58:19Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "0206ce4e7daf3398b7601b88d2541b05e5d3c42b",
          "body": "Extend the fleet `role { }` grammar so a startup role can retune a top-level\nagent's launch knobs, e.g. the engineer runs a heavier model at higher\nreasoning effort than the advisor. Previously `parseRole` accepted only a\n`guardfiles` child and hard-errored on anything else, so a per-role config\nblo\n[…]\n and the\nstructural-knob and permission-token rejections. Docs updated in\ndocs/fleetconfig.md within the layout caps.\n\ncloses #192\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(fleetconfig): per-role agent config overrides in the Role grammar",
          "author_name": "claude-linux-4a4f3637861f-ad36-she-her",
          "author_login": null,
          "committed_at": "2026-07-06T16:54:54Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "caeeb8aeb41235342e32b5434670e6905bfb2aca",
          "body": "The catalog code-comments hook (agentic-os v0.65.0) caps contiguous comment\nblocks at two lines; the execverb and stepflow feature commits predate that\ntightening and carried several 3-4 line blocks, so `pre-commit run --all-files`\nfails on a clean tree. Trim each flagged block to two lines (detail already\nlives in docs/), leaving behaviour untouched, so the tree lands green.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "style(comments): trim over-length comment blocks to the 2-line cap",
          "author_name": "claude-linux-4a4f3637861f-ad36-she-her",
          "author_login": null,
          "committed_at": "2026-07-06T16:54:25Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "bfa700fec22c7a8e45b9f72835b74f2373b94d08",
          "body": "Refuse a dispatch surface above an issue's automation mode. Order\nheadless > interactive > consult; rule surface <= mode. An issue with no\nrecognized mode label fails closed to consult, so nothing auto-runs\nheadless until a deliberate promotion (agentic-os#246 Phase 2).\n\n- Issue gains Labels []strin\n[…]\nical CI platform): picks up\n  the new field and the prior specverb/execverb/jail landing.\n\nRefs coilyco-flight-deck/agentic-os#246\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(dispatch): automation-mode ceiling gate on the shared chokepoint",
          "author_name": "claude-linux-2d9bcbef3445-db43-she-her",
          "author_login": null,
          "committed_at": "2026-07-04T09:22:05Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "19138a03d3fd02930bd5b64a5439ce42d85d83fe",
          "body": "Extract the sequence/compensate/canary engine out of specverb into\npkg/stepflow behind a transport-agnostic Leaf/Runner seam (the cli-guard#187\nfollow-up), and grow the exec dialect actions on top of it:\n\n- pkg/stepflow: the engine (ordered steps, reverse-order compensation, the\n  canary verdict loo\n[…]\n\nconsumer. Docs: execverb-actions.md, specverb-rollback.md, FEATURES.md.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01EhhbVnfMYp44wTo77qjZUX",
          "is_bot": false,
          "headline": "feat(execverb): exec-dialect complex actions on a shared stepflow engine",
          "author_name": "kai [she]",
          "author_login": "coilysiren",
          "committed_at": "2026-07-03T22:17:49Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "9bc79a27d018e3a960e7264d608573da2958b671",
          "body": "…+ canary watch\n\nGrow the complex-action engine with three guarded-rollback primitives so a\n`wrap`-block action can express a health-gated ops pipeline without a compiled\nstate machine:\n\n- A `stepRunner` seam decouples the sequence/rollback/canary engine from the\n  transport. The runtime is the ship\n[…]\nnsate, Action.Canary fields) and the describe surface.\n\nward ops eco {test,promote} (ward#585) is the first consumer.\n\ncloses #187\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(specverb): transport-agnostic step seam + compensating rollback …",
          "author_name": "claude-linux-6d8316ae67b0-ae78-she-her",
          "author_login": null,
          "committed_at": "2026-07-03T21:04:50Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "8886aeebad6a85a237125f573d478fba7f7213f4",
          "body": "…its realpath\n\ninstallToolShim resolved a symlinked tool (e.g. brew) with EvalSymlinks\nand stashed the realpath as the gate's exec target. For a $0-sensitive\ntool that derives its install root from the invoked path, this is wrong:\nbrew computes HOMEBREW_PREFIX as the grandparent of $0, so exec'ing\n/\n[…]\n leak-free placement (overlay/tmpfs) is worth a follow-up.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01FuAPU5noJna6KJiK6B3UEK",
          "is_bot": false,
          "headline": "fix(sandbox): exec a symlinked tool via a canonical-dir symlink, not …",
          "author_name": "Kai Siren",
          "author_login": "coilysiren",
          "committed_at": "2026-07-03T19:57:31Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "05d604201e602b5110edd1935587d73ef188ff94",
          "body": "…#578)",
          "is_bot": false,
          "headline": "Merge issue-578: per-role capability roster in fleetconfig (refs ward…",
          "author_name": "claude-linux-6ebace487ab8-de28-she-her",
          "author_login": null,
          "committed_at": "2026-07-03T19:10:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5d95188ac779ef1054997075aaa8281bfe935f70",
          "body": "…refix)\n\nAdd an optional `roles` block to the dialect-2 fleet grammar: each\n`role <name>` names the guardfile set that role holds, EITHER a flat list\nof guardfile names OR a single `prefix=\"...\"`, never both. The entries are\ndescriptive guardfile-name references, never inline grants - a guardfile's\n\n[…]\nat membership descriptively. New exported types:\nRole, Guardfiles (List | Prefix), Fleet.Roles.\n\nRefs coilyco-flight-deck/ward#578\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(fleetconfig): per-role capability roster (roles block, list-or-p…",
          "author_name": "claude-linux-6ebace487ab8-de28-she-her",
          "author_login": null,
          "committed_at": "2026-07-03T19:10:02Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "c3306640f374d937f82389e0bba8fdcf629289c9",
          "body": "…node (refs ward#309)",
          "is_bot": false,
          "headline": "Merge branch 'issue-doc-link-footer': generated  footer via doc-link …",
          "author_name": "claude-linux-9729af223bd4-cb58-she-her",
          "author_login": null,
          "committed_at": "2026-07-02T17:19:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0c12c51c830b61350264dd93af2ae9d22283614b",
          "body": "…node\n\nBoth describe surfaces - exec-dialect `execverb.Surface.Markdown` and\nspec-dialect `specverb`'s `renderProse` - now render a `## See also` footer\nfrom one or more wrap-level `doc-link` nodes:\n\n    doc-link \"../ward-kdl.md\" \"ward-kdl.md\" \"the build-time authoring layer\"\n    doc-link \"ward-kdl-\n[…]\ndoc-current.txt refreshed.\n`applyNode`'s wrap-body dispatch split into `applyListNode` to hold the\ncyclomatic cap.\n\nRefs ward#309.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(describe): emit optional `## See also` footer from a `doc-link` …",
          "author_name": "claude-linux-9729af223bd4-cb58-she-her",
          "author_login": null,
          "committed_at": "2026-07-02T17:19:05Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "75ddf2ee9313c586eef3aa49edf24b63068b9945",
          "body": "…enforce runner (closes #180)",
          "is_bot": false,
          "headline": "Merge branch 'issue-180': skip sandbox security-claim tests on can't-…",
          "author_name": "claude-linux-65783e3df92d-ac17-she-her",
          "author_login": null,
          "committed_at": "2026-07-01T16:32:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cabdd940520e59a8d539ade8057dbf7747329e73",
          "body": "…n lint installer\n\nThe cli/sandbox security-claim tests asserted kernel sandbox *enforcement*\n(namespace jail, gate reroute, seccomp ptrace denial) but had no positive signal\nthat the jail actually engaged. After the auto-degrade feature (c154e1d), a\ncan't-jail runner silently degrades to an unsandb\n[…]\nfra rollout concern for infrastructure/ansible,\ntracked separately; the cli-guard-side change is this test hardening.\n\ncloses #180\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(sandbox): skip security-claim tests on a can't-enforce runner; pi…",
          "author_name": "claude-linux-65783e3df92d-ac17-she-her",
          "author_login": null,
          "committed_at": "2026-07-01T16:32:22Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "c8da301191abdcb9461ff0db00a519e77c270879",
          "body": null,
          "is_bot": false,
          "headline": "Merge branch 'issue-178': typed KDL fleet-config validator (closes #178)",
          "author_name": "claude-linux-ae52b0304404-de86-she-her",
          "author_login": null,
          "committed_at": "2026-07-01T08:40:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6db852aa5981e9bf061084d8668414a6db4815d4",
          "body": "…ace)\n\nAdd pkg/fleetconfig: the typed validator for the agent-shaped KDL fleet\nconfig (Fleet/Agent/Defaults/Attribution/Argv/Director). Parse over KDL\nreuses the existing kdl-go node walker, failing closed on unknown nodes,\nwrong argument counts/kinds, schema-version mismatch, and missing required\nf\n[…]\ndocs/fleetconfig.md (schema + two-source model); architecture.md\nnote on config-as-core; FEATURES.md inventory entry.\n\ncloses #178\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(fleetconfig): typed KDL fleet-config validator (core, not a surf…",
          "author_name": "claude-linux-ae52b0304404-de86-she-her",
          "author_login": null,
          "committed_at": "2026-07-01T08:40:33Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "b9519930c2a8e87b95c7a4553b11ab009499d712",
          "body": null,
          "is_bot": false,
          "headline": "Merge remote-tracking branch 'origin/main' into issue-176",
          "author_name": "claude-linux-d9341d72476a-fc59-she-her",
          "author_login": null,
          "committed_at": "2026-07-01T05:03:46Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a934d12aac4c3134d42f7b2edd2b9c9802f67209",
          "body": "A `value` node may now name an ordered fallback list instead of a single\nsource. KDL has no arrays, so the sources sit in a children block, one per\nline; resolution walks the chain and takes the first source that yields a\nnon-empty value with no error - prefer a fast local `env`, fall back to a\ndura\n[…]\n/specverb-value-chain.md; FEATURES + policy pointers. Comprehensive\nparse, resolution, and end-to-end coverage added.\n\ncloses #176\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(value): `value` accepts a fallback list (children block)",
          "author_name": "claude-linux-d9341d72476a-fc59-she-her",
          "author_login": null,
          "committed_at": "2026-07-01T05:03:12Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "40a2e2023ae4721713b48f722053ee6bd5dc7098",
          "body": "# Conflicts:\n#\tdocs/execverb.md",
          "is_bot": false,
          "headline": "Merge branch 'issue-173'",
          "author_name": "claude-linux-7853ed546813-be66-she-her",
          "author_login": null,
          "committed_at": "2026-07-01T04:53:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a47d8b7a4d46a9b1e9bb45e6f0ea1dabe39cb19d",
          "body": "A grant-level `sealed` keyword pins an `argv` verb to forward exactly its\nfixed command: any caller-supplied token is refused with a UserError before\nexec. This enables strictly-single-resource verbs (e.g. a ward-kdl verb that\nreads only the forgejo runner secret and cannot be widened to another sec\n[…]\nendered in the reference markdown\n- Docs: docs/execverb.md grammar + engine notes (trimmed to hold the 4000-char cap)\n\ncloses #173\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(execverb): add `sealed` clause to forbid trailing caller args",
          "author_name": "claude-linux-7853ed546813-be66-she-her",
          "author_login": null,
          "committed_at": "2026-07-01T04:52:57Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "0359c55391d1bbe48d94f7969e61bd8c7c5c5dd6",
          "body": "The build-time generator said nothing about what it generated. Its\nartifact is the KDL spec surface, so kdl-specs is the speaking name.\nApplied per-context casing (the \"depending on text\" rule):\n\n- `kdlspecs` - Go package name + import-path segment. `package specgen`\n  -> `package kdlspecs`; `http/s\n[…]\nnerated godoc-current.txt for the package heading change. Build,\nvet, tidy, race tests (bar the pre-existing environmental cli/sandbox\nseccomp/jail failures), and golangci-lint all green.\n\ncloses #174",
          "is_bot": false,
          "headline": "refactor(kdl-specs)!: rename `specgen` -> kdl-specs family",
          "author_name": "claude-linux-36d7b2027616-ea62-she-her",
          "author_login": null,
          "committed_at": "2026-07-01T04:50:14Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "69e28007dbb614925021f273444415f6f16be4f1",
          "body": "Add an optional `cache \"<ttl>\"` modifier to the specverb `collect` action so\nheavy auto-paginated reads serve from an on-disk TTL cache instead of\nre-fetching every invocation. Reuses pkg/ttlcache rooted at config.CacheDir().\n\n- Parser: `Cache string` on guardfile.Collect; `cache` in the collect sca\n[…]\nfetch), --dry-run (print key, TTL, dir without firing).\n- Describe surface + docs (specverb-action-collect.md) added.\n\ncloses #171\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(specverb): cache \"<ttl>\" modifier on collect actions",
          "author_name": "claude-linux-6d2a48ef1abe-fa20-she-her",
          "author_login": null,
          "committed_at": "2026-06-26T07:38:46Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "cc4f8f778f545ff56d8e9916016b00e3e1a81f84",
          "body": "…to cross it\n\nLayer a precedence model over `inherit` (cli-guard#169): the least-privileged\nbase explicitly `never`s dangerous classes, those denials inherit upward, and a\nhigher tier crosses one only with the new `override can <verb> <resource>`\nkeyword — naming the exact verb+resource, never `\"*\"`\n[…]\n docs/specverb-override.md and\ntrim docs/specverb-inherit.md to the merge mechanics + the restrict-now-inherits\nnote.\n\ncloses #169\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(inherit)!: fail-closed tiering — inherited `never` + `override` …",
          "author_name": "claude-linux-3a402f7cb3e1-fa33-she-her",
          "author_login": null,
          "committed_at": "2026-06-25T18:44:05Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "ed8b66cf55738bfb6e01990067a1ea79d5edec93",
          "body": null,
          "is_bot": false,
          "headline": "Merge remote-tracking branch 'origin/main' into issue-166",
          "author_name": "claude-linux-b1b50c5d8fc2-ff39-she-her",
          "author_login": null,
          "committed_at": "2026-06-25T10:47:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "735fac0d0503ba1b10c1c0b566914b2e4444964a",
          "body": "Land the cli-guard-first half of ward#269: the reusable helpers ward\ncarries in package main, lifted into standalone, importable cli-guard\npackages so ward (and any consumer) imports one source of truth.\n\nNew pkg/ packages, each self-contained with tests:\n- pkg/scan      - junk-scan diff policy (ven\n[…]\no the dispatch Dispatcher/Config. docs/ward-helpers.md\nwalks through each; FEATURES.md and godoc-current.txt updated.\n\ncloses #166\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(helpers): extract reusable helper packages from ward",
          "author_name": "claude-linux-b1b50c5d8fc2-ff39-she-her",
          "author_login": null,
          "committed_at": "2026-06-25T10:46:52Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "ba21df31aa81c236f3c78715bd4a04a72cea4b86",
          "body": "… engine is the boundary\n\nIssue #79 inverts enforcement from an enumerated, rendered denylist to a\npolicy-free engine plus a small consumer-owned protectedCommands literal.\nThe engine (cli/hook, cli/hookcfg, cli/shim, cli/doctor, cli/repocfg) landed\nearlier and is what ward consumes; coily is retire\n[…]\nnsumer imports it. The profiles/profile/decision cluster is\nleft in place; its own retirement is a separate follow-up.\n\ncloses #79\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "refactor(lockdown)!: retire the generated denylist; deny-by-structure…",
          "author_name": "claude-linux-24fc783202b5-de65-she-her",
          "author_login": null,
          "committed_at": "2026-06-25T10:34:59Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "3e34eb5a52cbd940c106496ea3412203e697d41d",
          "body": "… credential broker\n\nAdd the foundation pieces for ward's root credential broker (ward#329),\nwhere a root daemon holds the bot token while an unprivileged explore\nagent reaches the forge and the dispatch path through a unix socket,\nholding no credential itself.\n\npkg/broker is the policy core:\n- a ve\n[…]\nso\nthe seed (writer) and bootstrap (reader) sides cannot drift. Full\ndispatch.Dispatcher convergence is out of scope.\n\ncloses #167\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(broker): pkg/broker + pkg/credseed - policy core for ward's root…",
          "author_name": "coilyco-ops",
          "author_login": null,
          "committed_at": "2026-06-25T09:56:51Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "2cf29175dd834d9080985b204c4248eb265535ee",
          "body": "The pre-commit gate was red on `main` for reasons unrelated to any one\nfeature, forcing selective hook SKIPs to land work. Clear the debt and\nenforce it server-side.\n\nspecverb lint (golangci-lint v2.12.2, 6 findings):\n- gocritic ifElseChain -> switch in actionDescription, snapshotActions,\n  and writ\n[…]\nfeature container lacks those binaries on PATH. The GitHub\nmirror's .github/workflows/ci.yml stays the PR-gated twin.\n\ncloses #165\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(ci): clear specverb lint debt and add canonical Forgejo CI gate",
          "author_name": "coilyco-ops",
          "author_login": null,
          "committed_at": "2026-06-25T05:24:59Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "41249af3c52f4d583ec91ebd40c04bdf43f31a4f",
          "body": "# Conflicts:\n#\tcli/execverb/guardfile.go",
          "is_bot": false,
          "headline": "Merge remote-tracking branch 'origin/main' into issue-162",
          "author_name": "coilyco-ops",
          "author_login": null,
          "committed_at": "2026-06-25T05:10:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ef4fd38fbeb025a5280157dcdb07fc7a32fffc37",
          "body": "Make dispatch.Dispatcher drivable without re-hosting its core, so ward\ncan run workers in containers against Forgejo instead of forking the\npackage. Two new Config seams, both opt-in and backward compatible:\n\n- Backend interface (Reserve / Prepare / Spawn / Reap) selects where a\n  detached worker ru\n[…]\nckends.md. Drive-by: trim one pre-existing\n3-line comment in execverb/guardfile.go to satisfy the code-comments gate.\n\ncloses #162\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(dispatch): pluggable backend + pre-flight verdict seams",
          "author_name": "coilyco-ops",
          "author_login": null,
          "committed_at": "2026-06-25T05:09:51Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "0211287398acb5c5222f0b545ffe9ea805edd797",
          "body": null,
          "is_bot": false,
          "headline": "Merge remote-tracking branch 'origin/main' into issue-164",
          "author_name": "coilyco-ops",
          "author_login": null,
          "committed_at": "2026-06-25T05:09:03Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4afbbe5de61509ccdf8b801deb0da39235e7e2e9",
          "body": "…closes #164)\n\nThe build-time generator was named three ways - `specverb-gen` (binary),\n`specdrv` (driver lib), `specgen` (renderer) - while `specverb` is the\nrun-time engine. A reader could not tell which `spec*` package built the\nCLI versus ran it. This makes the build-vs-run split lexical: everyt\n[…]\nnge: a pure rename plus a godoc/doc refresh, with the build\nand the specgen, codegen, and specverb test suites green.\n\ncloses #164\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "refactor: unify the build-time generator under the `specgen` prefix (…",
          "author_name": "coilyco-ops",
          "author_login": null,
          "committed_at": "2026-06-25T05:08:23Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "10afa486e8f319b1bc1144be063e0372c4444ff1",
          "body": "…in (closes #161)\n\nThe reaper preserved this container's work on ward-salvage/cli-guard-4fc321b4\nafter a merge conflict integrating onto main. On triage the branch is strictly\nbehind main: its feature work (the execverb passthrough dialect with host-gate\nguards) already landed via #158, and main has\n[…]\ne branch as integrated and keeps\nmain's tree unchanged, since main already contains and supersedes everything the\ncontainer produced.\n\ncloses #161\n\nCo-Authored-By: Claude (she/her) <claude@ward.agent>",
          "is_bot": false,
          "headline": "Merge ward-salvage/cli-guard-4fc321b4: passthrough work already on ma…",
          "author_name": "coilyco-ops",
          "author_login": null,
          "committed_at": "2026-06-25T04:58:50Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "33345ed24db10cea1cc9ef5447380d4aef4b0f98",
          "body": "…fixtures (closes #163)",
          "is_bot": false,
          "headline": "Merge issue-163: neutralize consumer names in engine comments + test …",
          "author_name": "coilyco-ops",
          "author_login": null,
          "committed_at": "2026-06-25T04:55:05Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "de526c610d525550cc232b1b08be82bd0d4051f2",
          "body": "The engine is a clean standalone framework, but consumer names baked\ninto example comments and test fixtures let a fresh reader infer it was\ncarved from a specific consumer. Replace them with a generic `<cli>`\nplaceholder in doc comments and neutral filenames in fixtures.\n\n- cli/execverb/{describe,g\n[…]\ngacy.yaml/.myapp; the\n  legacy-fallback comment no longer names a specific consumer.\n- godoc-current.txt regenerated for the exported-field comment edits.\n\nNo production behaviour change.\n\ncloses #163",
          "is_bot": false,
          "headline": "refactor: neutralize consumer names in engine comments + test fixtures",
          "author_name": "coilyco-ops",
          "author_login": null,
          "committed_at": "2026-06-25T04:54:56Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1a0e37bedf399aa3e6144b0f5aaf811488f2a16a",
          "body": null,
          "is_bot": false,
          "headline": "Merge remote-tracking branch 'origin/main' into issue-154",
          "author_name": "coilyco-ops",
          "author_login": null,
          "committed_at": "2026-06-24T09:01:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "04efe7f82e30c828a80193a4acac538feffd755e",
          "body": "Part of the coily retirement. cli-guard is a shared guard engine, so most\n`coily` strings were either the canonical Forgejo host (coilysiren.me) and org\n(coilyco-*), which stay, or coily used as a stand-in for \"the consumer\" in\nframework defaults, comments, and test fixtures.\n\nThe load-bearing chang\n[…]\n denial hint never\n  leaks a consumer path.\n- `docs/release-pipeline.md` historical note that coily has been retired.\n\ncloses #154\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "refactor: scrub coily references, derive repo config/env from app dir",
          "author_name": "coilyco-ops",
          "author_login": null,
          "committed_at": "2026-06-24T09:00:49Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "778fbd17bd61ec1ab30d5434cfc86898069e52a7",
          "body": "…e guards (closes #158)\n\nBring the exec-dialect `passthrough <bin>` sugar and its wrap-level\nhost-gate guards onto main, reconciled with the `allow` inspect-list\nsugar that landed on main in parallel (4b09142).\n\nEngine (Part 1 of #158):\n- `passthrough <bin> [prefix...]`: exec + an implicit `can run \n[…]\nd the\noffline trufflehog binary is absent from the container; main's own tip\ndoes not pass them either. This diff adds no secrets.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Merge feat/passthrough-ssh-dialect: passthrough dialect with host-gat…",
          "author_name": "coilyco-ops",
          "author_login": null,
          "committed_at": "2026-06-24T08:49:46Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "efcee049a519cce3a1b81fa52486b2b06b410dbe",
          "body": "Co-Authored-By: Claude (she/her) <claude@ward.agent>",
          "is_bot": false,
          "headline": "ward-container: residual claude work on coilyco-flight-deck/cli-guard",
          "author_name": "coilyco-ops",
          "author_login": null,
          "committed_at": "2026-06-24T07:08:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "63701f9cdd5d2fa48d0af7a00227e91511e55419",
          "body": "Co-Authored-By: Claude (she/her) <claude@ward.agent>",
          "is_bot": false,
          "headline": "ward-container: residual claude work on coilyco-flight-deck/cli-guard",
          "author_name": "coilyco-ops",
          "author_login": null,
          "committed_at": "2026-06-24T06:54:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c05211452f37a7e0391650199839ab3897f69b69",
          "body": "…rant sets\n\nAdd an `inherit \"<path>\"` directive to ward-kdl guardfiles so a wrap composes\non top of another by merging grant sets, enabling layered tiers (read ⊂ write ⊂\nadmin) without copy-pasting every `can` sentence into each build.\n\nResolution is textual and runs before the typed parse: `guardfi\n[…]\nuilds), cli-guard#159 (wildcard \"*\").\n\ncloses #160\nForgejo: https://forgejo.coilysiren.me/coilyco-flight-deck/cli-guard/issues/160\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(specverb): `inherit` directive — compose guardfiles by merging g…",
          "author_name": "ward-container",
          "author_login": "coilysiren",
          "committed_at": "2026-06-24T06:15:11Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "5fd4715488d475a73daf7d441c5eacb193e89e18",
          "body": "Support a `\"*\"` resource sentinel in `can`/`never`/`cannot` guardfile grants,\nso one sentence applies a verb across every resource the spec exposes for it\ninstead of hand-enumerating each `(verb,resource)` pair.\n\nAt build and prune time the engine expands each `\"*\"` grant into one concrete\ngrant per\n[…]\ns), cli-guard#79 (deny-by-structure).\n\ncloses #159\nForgejo: https://forgejo.coilysiren.me/coilyco-flight-deck/cli-guard/issues/159\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(specverb): wildcard resource \"*\" in can/never grants",
          "author_name": "ward-container",
          "author_login": "coilysiren",
          "committed_at": "2026-06-24T05:52:09Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "88e426194c22837d9a421990d6ef1c279f40fdb5",
          "body": "# Conflicts:\n#\tgodoc-current.txt\n#\thttp/guardfile/guardfile.go",
          "is_bot": false,
          "headline": "Merge remote-tracking branch 'origin/main' into issue-157",
          "author_name": "ward-container",
          "author_login": "coilysiren",
          "committed_at": "2026-06-24T04:52:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4b09142a7a1e7e74e465e7cd75d2a2eb04a16451",
          "body": "Add an `allow <bin...>` keyword to the exec-dialect Guardfile: one wrap\nopens N independent read-only open-passthrough funnels, one leaf per bare\nbinary, instead of a separate `exec`/`can run \"*\"` wrap each.\n\nDesugars mechanically to one wildcard member Guardfile per name, reusing\nthe single-binary \n[…]\n container (no seccomp/namespaces); vet, build, execverb + guardfile\ntests, and the documentation/comment hooks pass.\n\ncloses #157\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(execverb): `allow` inspect-list passthrough sugar",
          "author_name": "ward-container",
          "author_login": "coilysiren",
          "committed_at": "2026-06-24T04:51:24Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "e962f96cf814e3b483f24ab1904d3ea3ee10d516",
          "body": "…es #141)",
          "is_bot": false,
          "headline": "Merge issue-141: dispatch foreground/in-place CI execution mode (clos…",
          "author_name": "ward-container",
          "author_login": "coilysiren",
          "committed_at": "2026-06-24T04:50:18Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6a53eea3e9f1a59c8f24c094dcaa712e02e68159",
          "body": "Add a `dispatch ci <ref>` surface that runs `claude -p` in the foreground,\nin place in the current checkout, for execution inside a Forgejo Actions\nrunner where the job process is the agent lifecycle.\n\nUnlike the detached surfaces (headless, cascade), ci makes no workstation\nassumptions: it runs in \n[…]\n pins a `closes-issue` hook id absent from agentic-os\nv0.65.0 (ward#139), which aborts the commit-msg stage outright.\n\ncloses #141\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(dispatch): foreground/in-place CI execution mode",
          "author_name": "ward-container",
          "author_login": "coilysiren",
          "committed_at": "2026-06-24T04:50:01Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "a476b69853f41fa7d744e4be0043d99fb82f9b31",
          "body": "Add a default-allow passthrough sugar to the exec dialect plus the\nwrap-level guards a funnel needs to subtract from it.\n\n- passthrough <bin> [prefix...]: sugar for exec <bin> + an implicit\n  can run * funnel. First arg is the binary, rest the fixed leading\n  argv (passthrough tailscale ssh -> tails\n[…]\nard\nfunnel. New docs/passthrough.md; tests, godoc updated.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01WBzoWLxE35KZ1YyfpSNGVz",
          "is_bot": false,
          "headline": "feat(execverb): passthrough dialect with host-gate guards",
          "author_name": "Kai Siren",
          "author_login": "coilysiren",
          "committed_at": "2026-06-19T07:03:18Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "2043788e808f6cf30c473f8bcc09699086efb172",
          "body": null,
          "is_bot": false,
          "headline": "feat(specverb): add collect action pagination",
          "author_name": "ward-container",
          "author_login": "coilysiren",
          "committed_at": "2026-06-18T09:34:18Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "628fa41d03461775db40c95601a6e9d8918d2921",
          "body": "…initions alone\n\nThe Swagger 2.0 pruner kept only the granted paths and the transitive closure of\n`definitions` they reach, but passed the top-level `responses` and `parameters`\nsections through verbatim. A shared response (e.g. forgejo's `AccessToken`) whose\nschema `$ref`s a definition that no gran\n[…]\ns only they reached) drop,\nso the lock is self-consistent.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_015epLy8VT2D67Xxe4SGkqoL",
          "is_bot": false,
          "headline": "fix(specverb): prune Swagger 2.0 shared responses/parameters, not def…",
          "author_name": "Kai Siren",
          "author_login": "coilysiren",
          "committed_at": "2026-06-18T08:52:16Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "fcb0205aaf378578d3fffd873b77367352eccb08",
          "body": "Add the two-arg `action <verb> <resource>` form to the Guardfile action\ngrammar: instead of mounting under the `action` noun, it mounts at that leaf\npath, replacing the generated leaf there. A mount call-action renders every\n`as` binding together as one object, so a composite can return more than it\n[…]\ns and the hook scans the whole repo; issue refs preserved.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_015epLy8VT2D67Xxe4SGkqoL",
          "is_bot": false,
          "headline": "feat(specverb): mount-target actions shadow a generated leaf",
          "author_name": "Kai Siren",
          "author_login": "coilysiren",
          "committed_at": "2026-06-18T08:38:54Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "69395d145cf49c1a8b03176e52ed4af515fa6ef0",
          "body": null,
          "is_bot": false,
          "headline": "Merge remote-tracking branch 'origin/main' into issue-142",
          "author_name": "ward-container",
          "author_login": "coilysiren",
          "committed_at": "2026-06-18T07:56:52Z",
          "body_truncated": false,
          "is_coding_agent": false
        }
      ],
      "releases_count": 100,
      "commits_last_year": 309,
      "latest_release_at": "2026-07-14T09:29:39Z",
      "latest_release_tag": "v0.100.0",
      "releases_from_tags": true,
      "days_since_last_push": 4,
      "active_weeks_last_year": 10,
      "days_since_latest_release": 13,
      "mean_days_between_releases": 0.4
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": true,
      "health_percentage": 75,
      "has_issue_template": false,
      "has_code_of_conduct": true,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "forgejo.coilysiren.me/coilyco-flight-deck/cli-guard",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": null,
          "registry_url": "https://pkg.go.dev/forgejo.coilysiren.me/coilyco-flight-deck/cli-guard",
          "is_deprecated": false,
          "latest_version": "v0.125.0",
          "repository_url": null,
          "versions_count": 125,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-27T03:25:31Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 0
        }
      ]
    },
    "popularity": {
      "forks": 1,
      "stars": 1,
      "watchers": 1,
      "fork_history": {
        "days": [
          {
            "date": "2026-05-20",
            "count": 1
          }
        ],
        "complete": true,
        "collected": 1,
        "total_forks": 1
      },
      "star_history": null,
      "open_issues_and_prs": 3
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [
        "examples"
      ],
      "has_llms_txt": false,
      "has_dockerfile": false,
      "has_mcp_signal": false,
      "bootstrap_files": [
        "Makefile"
      ],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [
        "go.mod",
        "scripts/gen-webdocs/go.mod"
      ],
      "largest_source_bytes": 51686,
      "source_files_sampled": 211,
      "oversized_source_files": 0,
      "agent_instruction_files": [
        "AGENTS.md",
        "CLAUDE.md"
      ],
      "agent_instruction_max_bytes": 3814
    },
    "dependencies": {
      "manifests": [
        "go.mod"
      ],
      "advisories": {
        "error": null,
        "scope": "repository_graph",
        "source": "osv",
        "findings": [
          {
            "name": "github.com/getkin/kin-openapi",
            "direct": true,
            "version": "v0.140.0",
            "severity": "critical",
            "ecosystem": "go",
            "cvss_score": 9.1,
            "advisory_ids": [
              "GHSA-jpcw-4wr7-c3vq",
              "GHSA-r277-6w6q-xmqw"
            ],
            "fixed_version": "0.144.0",
            "advisory_count": 2,
            "oldest_advisory_days": 3
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.14.0",
            "severity": "unknown",
            "ecosystem": "go",
            "cvss_score": null,
            "advisory_ids": [
              "GO-2026-5970"
            ],
            "fixed_version": "0.39.0",
            "advisory_count": 1,
            "oldest_advisory_days": 13
          }
        ],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {
          "unknown": 1,
          "critical": 1
        },
        "advisory_count": 3,
        "affected_count": 2,
        "assessed_count": 36,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 0,
        "direct_affected_count": 1
      },
      "ecosystems": [
        "go"
      ],
      "dependencies": [
        {
          "name": "github.com/calico32/kdl-go",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.14.1"
        },
        {
          "name": "github.com/getkin/kin-openapi",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.140.0"
        },
        {
          "name": "github.com/jmespath-community/go-jmespath",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.1"
        },
        {
          "name": "github.com/olekukonko/tablewriter",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.4"
        },
        {
          "name": "github.com/urfave/cli/v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.9.0"
        },
        {
          "name": "golang.org/x/sys",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.44.0"
        },
        {
          "name": "golang.org/x/term",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.43.0"
        },
        {
          "name": "gopkg.in/natefinch/lumberjack.v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.2.1"
        },
        {
          "name": "gopkg.in/yaml.v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.0.1"
        }
      ],
      "all_dependencies": {
        "error": null,
        "source": "github-sbom",
        "packages": [
          {
            "name": "github.com/calico32/kdl-go",
            "direct": true,
            "version": "v0.14.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/getkin/kin-openapi",
            "direct": true,
            "version": "v0.140.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/jmespath-community/go-jmespath",
            "direct": true,
            "version": "v1.1.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/olekukonko/tablewriter",
            "direct": true,
            "version": "v1.1.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/urfave/cli/v3",
            "direct": true,
            "version": "v3.9.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sys",
            "direct": true,
            "version": "v0.44.0",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/term",
            "direct": true,
            "version": "v0.43.0",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/natefinch/lumberjack.v2",
            "direct": true,
            "version": "v2.2.1",
            "ecosystem": "go"
          },
          {
            "name": "gopkg.in/yaml.v3",
            "direct": true,
            "version": "v3.0.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cespare/xxhash/v2",
            "direct": false,
            "version": "v2.3.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/clipperhouse/displaywidth",
            "direct": false,
            "version": "v0.10.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/clipperhouse/uax29/v2",
            "direct": false,
            "version": "v2.6.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/coilysiren/cli-web-docs",
            "direct": false,
            "version": "v0.0.0-20260513172246-d202b1f723a1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/cpuguy83/go-md2man/v2",
            "direct": false,
            "version": "v2.0.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/fatih/color",
            "direct": false,
            "version": "v1.18.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/jsonpointer",
            "direct": false,
            "version": "v0.22.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/go-openapi/swag/jsonname",
            "direct": false,
            "version": "v0.25.5",
            "ecosystem": "go"
          },
          {
            "name": "github.com/kr/pretty",
            "direct": false,
            "version": "v0.3.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-colorable",
            "direct": false,
            "version": "v0.1.14",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-isatty",
            "direct": false,
            "version": "v0.0.20",
            "ecosystem": "go"
          },
          {
            "name": "github.com/mattn/go-runewidth",
            "direct": false,
            "version": "v0.0.19",
            "ecosystem": "go"
          },
          {
            "name": "github.com/oasdiff/yaml",
            "direct": false,
            "version": "v0.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/oasdiff/yaml3",
            "direct": false,
            "version": "v0.0.13",
            "ecosystem": "go"
          },
          {
            "name": "github.com/olekukonko/cat",
            "direct": false,
            "version": "v0.0.0-20250911104152-50322a0618f6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/olekukonko/errors",
            "direct": false,
            "version": "v1.2.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/olekukonko/ll",
            "direct": false,
            "version": "v0.1.6",
            "ecosystem": "go"
          },
          {
            "name": "github.com/russross/blackfriday/v2",
            "direct": false,
            "version": "v2.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/santhosh-tekuri/jsonschema/v6",
            "direct": false,
            "version": "v6.0.2",
            "ecosystem": "go"
          },
          {
            "name": "github.com/urfave/cli-docs/v3",
            "direct": false,
            "version": "v3.1.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/yuin/goldmark",
            "direct": false,
            "version": "v1.8.2",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/exp",
            "direct": false,
            "version": "v0.0.0-20230314191032-db074128a8ec",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/text",
            "direct": false,
            "version": "v0.14.0",
            "ecosystem": "go"
          },
          {
            "name": "mkdocs",
            "direct": false,
            "version": "1.6.1",
            "ecosystem": "pypi"
          },
          {
            "name": "mkdocs-git-revision-date-localized-plugin",
            "direct": false,
            "version": "1.5.1",
            "ecosystem": "pypi"
          },
          {
            "name": "mkdocs-material",
            "direct": false,
            "version": "9.7.6",
            "ecosystem": "pypi"
          },
          {
            "name": "pygments",
            "direct": false,
            "version": "2.20.0",
            "ecosystem": "pypi"
          }
        ],
        "collected": true,
        "truncated": false,
        "total_count": 36,
        "direct_count": 9,
        "indirect_count": 27
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 3,
        "merged_prs": 4,
        "open_issues": 0,
        "closed_ratio": 1,
        "closed_issues": 90,
        "closed_unmerged_prs": 6
      },
      "bus_factor": 1,
      "bot_contributors": 1,
      "top_contributors": [
        {
          "type": "User",
          "login": "coilysiren",
          "commits": 227,
          "avatar_url": "https://avatars.githubusercontent.com/u/5768468?v=4"
        },
        {
          "type": "User",
          "login": "rhoggs-bot-test-account",
          "commits": 15,
          "avatar_url": "https://avatars.githubusercontent.com/u/22551806?v=4"
        },
        {
          "type": "User",
          "login": "dicnunz",
          "commits": 1,
          "avatar_url": "https://avatars.githubusercontent.com/u/139033898?v=4"
        }
      ],
      "contributors_sampled": 3,
      "top_contributor_share": 0.934
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "ci.yml",
        "codeql.yml",
        "dependabot-auto-merge.yml",
        "pages.yml"
      ],
      "has_docs_dir": true,
      "linter_configs": [
        ".golangci.yaml"
      ],
      "has_editorconfig": false,
      "has_linter_config": true,
      "has_precommit_config": true
    },
    "security_signals": {
      "lockfiles": [
        "go.sum"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 3,
            "reason": "branch protection is not maximal on development and all release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": null,
            "reason": "no pull request found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/30 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 10,
            "reason": "project has 4 contributing companies or organizations",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 10,
            "reason": "update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 0,
            "reason": "project was created within the last 90 days. Please review its contents carefully",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": null,
            "reason": "packaging workflow not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 0,
            "reason": "dependency not pinned by hash detected -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 10,
            "reason": "SAST tool detected: CodeQL",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 10,
            "reason": "security policy file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": null,
            "reason": "no releases found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 7,
            "reason": "3 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "b28749551c897f8b55f5ba2bfe2614b0bc8b98c1",
        "ran_at": "2026-07-27T22:18:45Z",
        "aggregate_score": 5.3,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": true,
      "has_security_policy": true,
      "has_dependabot_config": true
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-27T10:52:56Z",
      "oldest_open_prs": [
        {
          "number": 85,
          "created_at": "2026-05-20T21:42:46Z",
          "last_comment_at": "2026-05-22T04:29:23Z",
          "last_comment_author": "dicnunz"
        },
        {
          "number": 101,
          "created_at": "2026-07-15T22:34:03Z",
          "last_comment_at": "2026-07-15T22:34:04Z",
          "last_comment_author": "dependabot"
        },
        {
          "number": 103,
          "created_at": "2026-07-22T22:34:17Z",
          "last_comment_at": "2026-07-22T22:34:18Z",
          "last_comment_author": "dependabot"
        }
      ],
      "last_merged_pr_at": "2026-05-21T12:27:25Z",
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": []
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/coilyco-flight-deck/cli-guard",
    "host": "github.com",
    "name": "cli-guard",
    "owner": "coilyco-flight-deck"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "moderate",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 62,
      "inputs": {
        "security": 56,
        "vitality": 72,
        "community": 40,
        "governance": 54,
        "engineering": 85
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "good",
        "name": "Vitality",
        "value": 72,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "moderate",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 61,
            "inputs": {
              "commits_last_year": 309,
              "human_commit_share": 1,
              "days_since_last_push": 4,
              "active_weeks_last_year": 10
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 4 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 4
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "10/52 weeks with commits",
                "points": 6.9,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 10
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "309 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 309
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 88,
            "inputs": {
              "releases_count": 100,
              "latest_release_tag": "v0.100.0",
              "releases_from_tags": true,
              "days_since_latest_release": 13,
              "mean_days_between_releases": 0.4
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "100 version tags (no GitHub releases)",
                "points": 16.2,
                "status": "partial",
                "details": [
                  {
                    "code": "version_tags_no_releases",
                    "params": {
                      "count": 100
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 13 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 13
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~0.4 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 0.4
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "at_risk",
        "name": "Community & Adoption",
        "value": 40,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 1,
            "inputs": {
              "forks": 1,
              "stars": 1,
              "watchers": 1,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "1 stars",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "1 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "1 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "excellent",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": true,
              "has_issue_template": false,
              "has_code_of_conduct": true,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (MIT)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "MIT"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 18,
                "status": "met",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 13.5,
                "status": "met",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "moderate",
        "name": "Sustainability & Governance",
        "value": 54,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 25,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 3,
              "top_contributor_share": 0.934
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 93% of commits",
                "points": 1.5,
                "status": "partial",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 93
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "3 contributors",
                "points": 4.1,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 3
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 4 contributing companies or organizations",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "moderate",
            "name": "Issue & PR responsiveness",
            "note": null,
            "notes": [],
            "value": 62,
            "inputs": {
              "merged_prs": 4,
              "open_issues": 0,
              "closed_issues": 90,
              "issue_closed_ratio": 1,
              "closed_unmerged_prs": 6
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "100% of issues closed",
                "points": 46.8,
                "status": "met",
                "details": [
                  {
                    "code": "issues_closed_share",
                    "params": {
                      "share": 100
                    }
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "4/10 decided PRs merged",
                "points": 15.3,
                "status": "partial",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 4,
                      "decided": 10
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "at_risk",
            "name": "Ownership & stewardship",
            "note": null,
            "notes": [],
            "value": 43,
            "inputs": {
              "followers": 1,
              "owner_type": "Organization",
              "is_verified": null,
              "owner_login": "coilyco-flight-deck",
              "public_repos": 29,
              "account_age_days": 60
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "organization-owned",
                "points": 30,
                "status": "met",
                "details": [
                  {
                    "code": "owner_organization",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "1 followers of coilyco-flight-deck",
                "points": 2.2,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 1,
                      "login": "coilyco-flight-deck"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "29 public repos, account ~0 yr old",
                "points": 11.1,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 29
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 0
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "forgejo.coilysiren.me/coilyco-flight-deck/cli-guard"
              ],
              "ecosystems": "go",
              "any_deprecated": false,
              "min_days_since_publish": 0
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on go",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "go"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 0 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 0
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "125 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 125
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "excellent",
        "name": "Engineering Quality",
        "value": 85,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "excellent",
            "name": "Engineering practices",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_ci_tests"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 92,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": true,
              "has_precommit_config": true
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "4 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 4
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": ".golangci.yaml",
                "points": 16,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yaml"
                    }
                  }
                ],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 9.6,
                "status": "met",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "good",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 75,
            "inputs": {
              "topics": [
                "argv-validation",
                "lockdown-writer",
                "scope-tokens"
              ],
              "has_wiki": false,
              "homepage": null,
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": "3 topics",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "topics_count",
                    "params": {
                      "count": 3
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "moderate",
        "name": "Security",
        "value": 56,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "moderate",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): CI-Tests, Packaging, Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "ci_tests",
                    "packaging",
                    "signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 53,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 15,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 3,
              "scorecard_aggregate": 5.3
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection is not maximal on development and all release branches",
                "points": 2.2,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 4 contributing companies or organizations",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "update tool detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow not detected",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool detected: CodeQL",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "3 existing vulnerabilities detected",
                "points": 5.2,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "moderate",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories. Remaining weights renormalized. Matched 36 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "indirect_dependencies_free_of_known_advisories"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_repository",
                "params": {
                  "assessed": 36
                }
              },
              {
                "code": "advisories_repo_graph_caveat",
                "params": {}
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 66,
            "inputs": {
              "source": "osv",
              "advisories": 3,
              "affected_packages": 2,
              "assessed_packages": 36,
              "unassessed_packages": 0,
              "affected_by_severity": "critical 1, unknown 1",
              "direct_affected_packages": 1
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "1 affected: github.com/getkin/kin-openapi v0.140.0 (critical 9.1)",
                "points": 9.5,
                "status": "partial",
                "details": [
                  {
                    "code": "advisories_affected",
                    "params": {
                      "count": 1,
                      "packages": "github.com/getkin/kin-openapi v0.140.0 (critical 9.1)"
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "transitive set not separable from development and test dependencies in this scope",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_scope_not_separable",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory has been public longer than 90 days",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "advisories_none_stale",
                    "params": {
                      "days": 90
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 36,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 2
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "good",
        "name": "AI Readiness",
        "value": 80,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "good",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 82,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 0.69,
              "agent_instruction_files": [
                "AGENTS.md",
                "CLAUDE.md"
              ],
              "agent_instruction_max_bytes": 3814
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "AGENTS.md, CLAUDE.md",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "AGENTS.md, CLAUDE.md"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "69 of 100 human commits state their intent (structured subject or explanatory body)",
                "points": 36.8,
                "status": "partial",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 69,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "excellent",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 87,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "go.sum"
              ],
              "has_dockerfile": false,
              "typed_language": true,
              "bootstrap_files": [
                "Makefile"
              ],
              "has_devcontainer": false,
              "has_linter_config": true,
              "typecheck_configs": [],
              "agent_commit_share": 0.4,
              "toolchain_manifests": [
                "go.mod",
                "scripts/gen-webdocs/go.mod"
              ],
              "dependency_bot_commit_share": 0
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "Makefile",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Makefile"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": ".golangci.yaml",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yaml"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "Go (statically typed)",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "40 of the last 100 commits agent-authored or agent-credited",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "agent_authored_commits",
                    "params": {
                      "count": 40,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "dependency automation configured, none observed in the sampled commits",
                "points": 5,
                "status": "partial",
                "details": [
                  {
                    "code": "dependency_bot_config_only",
                    "params": {}
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "Go",
              "largest_source_bytes": 51686,
              "source_files_sampled": 211,
              "oversized_source_files": 0
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Go (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "0/211 source files over 60KB",
                "points": 55,
                "status": "met",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 211,
                      "oversized": 0
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "at_risk",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "example_dirs": [
                "examples"
              ],
              "has_mcp_signal": false,
              "api_schema_files": []
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": "examples",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "examples"
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-27T22:18:50.723325Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/c/coilyco-flight-deck/cli-guard.svg",
  "full_name": "coilyco-flight-deck/cli-guard",
  "license_state": "standard",
  "license_spdx": "MIT"
}