hachure-org / spec

Не вдалося зібрати розв'язаний набір залежностей для цього звіту: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository

{
  "data": {
    "repo": {
      "topics": [
        "conformance",
        "json-schema",
        "open-standard",
        "provenance",
        "specification",
        "trust"
      ],
      "is_fork": false,
      "size_kb": 242,
      "has_wiki": true,
      "homepage": "https://hachure.org",
      "languages": {
        "JavaScript": 100392
      },
      "pushed_at": "2026-07-17T03:40:13Z",
      "created_at": "2026-06-11T14:56:25Z",
      "owner_type": "Organization",
      "updated_at": "2026-07-17T03:40:10Z",
      "description": "Hachure — an open trust format. Specification, normative schemas, and conformance test vectors. npm: hachure",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "MIT",
      "default_branch": "main",
      "license_spdx_raw": "MIT",
      "primary_language": "JavaScript",
      "significant_languages": [
        "JavaScript"
      ]
    },
    "owner": {
      "blog": null,
      "name": null,
      "type": "Organization",
      "login": "hachure-org",
      "company": null,
      "location": null,
      "followers": 0,
      "avatar_url": "https://avatars.githubusercontent.com/u/292825615?v=4",
      "created_at": "2026-06-11T14:53:24Z",
      "is_verified": null,
      "public_repos": 4,
      "account_age_days": 40
    },
    "license": {
      "state": "standard",
      "spdx_id": "MIT",
      "raw_spdx": "MIT",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.15.0",
          "kind": "minor",
          "published_at": "2026-07-17T03:40:13Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "1840b2f71cfa02a29212639087fc6cb0473be1e3",
          "body": "Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(main): release 0.15.0 (#20)",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-17T03:40:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a6f7eda8ed09539b4d66f3a852a74f0491ea6db9",
          "body": "Adds the org-standard release-please workflow, config, and manifest.\nManifest bootstraps at 0.14.0 (last published npm version; tag history\nstops at v0.9.0) with bootstrap-sha at the 0.14.0 commit, so the first\nrun opens the 0.15.0 release PR covering the runtime-observation and\ncontract-claims work\n[…]\nches the existing tag-triggered publish-npm workflow explicitly.\n\nClaude-Session: https://claude.ai/code/session_01SmQYjiUo1aDSXgEKyiye7M\n\nCo-authored-by: Brian Anderson <brian.anderson1222@gmail.com>",
          "is_bot": false,
          "headline": "ci: adopt release-please (manifest bootstrapped at 0.14.0) (#19)",
          "author_name": "Brian Anderson",
          "author_login": "briananderson1222",
          "committed_at": "2026-07-16T21:44:10Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4a64a2d72bbdba8ba2e625e2785ee3ad5686e97f",
          "body": "…ms (#18)\n\nAdds contract-claims.md, a docs-only convention profile (no schema\nchange; claimType is free-form): claimType \"contract\" with required\nqualifiers {provider, consumer, contract}, a policy template requiring\nruntime_observation with a suggested validity window, receipt guidance\n(execution b\n[…]\nests, 9/9 vectors, both examples validate + derive).\n\nCloses #16\n\nClaude-Session: https://claude.ai/code/session_01SmQYjiUo1aDSXgEKyiye7M\n\nCo-authored-by: Brian Anderson <brian.anderson1222@gmail.com>",
          "is_bot": false,
          "headline": "docs(profile): add contract-claims profile — end-to-end contract clai…",
          "author_name": "Brian Anderson",
          "author_login": "briananderson1222",
          "committed_at": "2026-07-16T15:00:37Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "053e77945c11e369b2c1b55e3f2d5b10eff9dc65",
          "body": "Adds the runtime_observation evidence type across the three normative\nenum sites (evidence, verification-policy, trust-bundle), an optional\nexecution.environment field (test|staging|production), and mints\nschemaVersion 7 (additive; every bundle valid at 6 remains valid).\nstatusFunctionVersion stays \n[…]\n(183/183 tests, 9/9 vectors re-run by orchestrator).\n\nCloses #15\n\nClaude-Session: https://claude.ai/code/session_01SmQYjiUo1aDSXgEKyiye7M\n\nCo-authored-by: Brian Anderson <brian.anderson1222@gmail.com>",
          "is_bot": false,
          "headline": "feat(schema): add runtime observation evidence (0.15.0) (#17)",
          "author_name": "Brian Anderson",
          "author_login": "briananderson1222",
          "committed_at": "2026-07-16T14:41:22Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1baddfe37aa148e33dda4e5809353c2978cd2b77",
          "body": "…inds) + conclusionConfidence mapping (#14)\n\nDeepen the AI-evaluation profile with a RECOMMENDED (non-normative) evidence\nconvention so eval evidence stays interoperable and mergeable instead of\ndegrading to incomparable numbers. Covers both recurring eval kinds — model/\nbenchmark evals (model/datas\n[…]\ngration demonstrates the shape. No schema/statusFunction change.\n\nClaude-Session: https://claude.ai/code/session_01PkH77gV2ir4pB1tSc7WZAA\n\nCo-authored-by: Brian Anderson <brian.anderson1222@gmail.com>",
          "is_bot": false,
          "headline": "docs(ai-evaluation): add recommended evidence convention (both eval k…",
          "author_name": "Brian Anderson",
          "author_login": "briananderson1222",
          "committed_at": "2026-07-13T01:54:31Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1664a10a6cebf68678adae088b8ac94d459664e2",
          "body": "…recomputable (#13)\n\nAdds ai-evaluation.md: a vendor-neutral profile defining how eval results, model\nclaims, and agent outcomes are carried as recomputable trust rather than sealed\none-time attestations. An eval conclusion is a Claim; its evidence binds the score\nto its computation (model/dataset/h\n[…]\nate.\n\nNo schema or statusFunctionVersion change. 178 tests pass.\n\nClaude-Session: https://claude.ai/code/session_01PkH77gV2ir4pB1tSc7WZAA\n\nCo-authored-by: Brian Anderson <brian.anderson1222@gmail.com>",
          "is_bot": false,
          "headline": "docs(profile): add AI Evaluation profile — eval/model/agent trust as …",
          "author_name": "Brian Anderson",
          "author_login": "briananderson1222",
          "committed_at": "2026-07-13T00:56:01Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f37c8738f4d1cc235f8c917cf4c97c52665742b1",
          "body": "…A/Cedar/CEL) (#12)\n\nA landscape research pass (adversarially verified) confirmed Hachure's\npositioning is accurate and its \"portable recomputable status function\" niche is\ngenuinely unoccupied — every named standard (SCITT, in-toto/DSSE, SLSA, Sigstore,\nOSCAL, C2PA, RATS/EAT, VC status lists) seals\n[…]\nation and all\nother standards references were verified accurate.\n\nClaude-Session: https://claude.ai/code/session_01PkH77gV2ir4pB1tSc7WZAA\n\nCo-authored-by: Brian Anderson <brian.anderson1222@gmail.com>",
          "is_bot": false,
          "headline": "docs(README): distinguish the status function from policy engines (OP…",
          "author_name": "Brian Anderson",
          "author_login": "briananderson1222",
          "committed_at": "2026-07-13T00:36:13Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e1837f07c9e6059cfe5f98383c746f5b89fb74dd",
          "body": "Adds an optional, additive claim field carrying a calibrated confidence value on\nthe conclusion (distinct from confidenceBasis's raw signals) plus a\nproducer-populated comfort-zone signal. Carried, not produced; the status\nfunction never consults it, so no schemaVersion bump (follows the derivationE\n[…]\nschema.\n\nSupports kontourai/surface #25. Publish is owner-gated.\n\nClaude-Session: https://claude.ai/code/session_01PkH77gV2ir4pB1tSc7WZAA\n\nCo-authored-by: Brian Anderson <brian.anderson1222@gmail.com>",
          "is_bot": false,
          "headline": "feat(schema): optional conclusionConfidence on claim (0.14.0) (#11)",
          "author_name": "Brian Anderson",
          "author_login": "briananderson1222",
          "committed_at": "2026-07-12T22:47:59Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3c7eff6486791774e2902f18165b1b020cb9592a",
          "body": "Adds an optional `sensitivity` object to `claim.derivationEdges[]`:\n`{ low: number, high: number, basis: string }` (all required when present;\nadditionalProperties:false). A quantitative derivation edge — a threshold\nor estimate — travels with its bounds and basis so it is never a bare\nnumber (\"Gove\n[…]\nnates kontourai/surface#24. 4 new ajv tests (validates; optional;\nrejects partial; rejects wrong-type/extra-key); 174/174 pass.\n\nClaude-Session: https://claude.ai/code/session_014NXy9YhzLHYsa4eJV87MZa",
          "is_bot": false,
          "headline": "feat(schema): optional sensitivity range on derivationEdge (0.13.0)",
          "author_name": "Brian Anderson",
          "author_login": "pumakuma",
          "committed_at": "2026-07-12T04:04:14Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e5ef4df25b43435467a3e4a808af958f56ff85b6",
          "body": "Lets a strict consumer validate a waiver-bearing TrustReport without\nweakening core. Restructures trust-report.schema.json to expose its\nfield set as an OPEN $defs/core building block, closed at the top level\nby unevaluatedProperties:false — byte-different but validation-equivalent\nto the previous f\n[…]\nversarial review (Opus): APPROVE, no soundness or\nbehaviour-preservation break found across 42 equivalence + 25 evasion probes.\n\nClaude-Session: https://claude.ai/code/session_014NXy9YhzLHYsa4eJV87MZa",
          "is_bot": false,
          "headline": "feat(schema): waiver-validity TrustReport extension schema (0.12.0)",
          "author_name": "Brian Anderson",
          "author_login": "pumakuma",
          "committed_at": "2026-07-10T13:58:38Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1beec55f91683933590cc91ed5404d5ef4b7401f",
          "body": "Formalizes the claim.metadata.waiver {reason, approved_by, approved_at}\nshape (originating producer convention: kontourai/flow-agents ADR 0020 §3;\nconsumer motivation: kontourai/surface#123, kontourai/flow-agents#511) as an\nOPTIONAL hachure.org/v1 extension profile. No core-format or status-function\n[…]\nroved_at grammar is validated per RFC3339 without enforcing leap-second\nplacement. Modeled on assurance.md's profile structure.\n\nClaude-Session: https://claude.ai/code/session_014NXy9YhzLHYsa4eJV87MZa",
          "is_bot": false,
          "headline": "docs: Waivers extension profile — typed accepted-gap vocabulary",
          "author_name": "Brian Anderson",
          "author_login": "pumakuma",
          "committed_at": "2026-07-10T07:31:00Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1b9f4bb4e21f31957cc155b0fd8339407523ed55",
          "body": "…plementation-table independence claim\n\n- README: worked example deriving the reference vector fixture at its own\n  now, with the documented output reproduced by bin/hachure.mjs and the\n  staleness explained as the freshness-window fold step, not an evidence gap.\n- README + interop-in-toto: last two\n[…]\nut reproduced exactly. Independent report-only review by Codex\n(gpt-5.6-sol): findings addressed in hachure.org sibling commit.\n\nClaude-Session: https://claude.ai/code/session_014NXy9YhzLHYsa4eJV87MZa",
          "is_bot": false,
          "headline": "docs: worked derive example; finish authorityTrace rename; sharpen im…",
          "author_name": "Brian Anderson",
          "author_login": "pumakuma",
          "committed_at": "2026-07-10T05:30:23Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "26654abcc2d6c2c9fa3e970239fd6d103fd9cc4a",
          "body": "…0.11.0)\n\nExecutes backlog issues #7, #8, #9 (spec half), #10 — reoriented against\nmain f26d423, all still needed; SCITT status re-verified as RFC 9943\n(Proposed Standard, June 2026), resolving the draft-vs-RFC conflict\nbetween the two research runs.\n\n- scitt.md (#7): registration mapping (COSE issu\n[…]\n  never affects derivation; OSCAL expired/fresh twins derive stale/\n  verified; open risk derives disputed). 163 tests, 0 fail.\n\nClaude-Session: https://claude.ai/code/session_01SPaNvKDehpjBSGDbtgqCFY",
          "is_bot": false,
          "headline": "feat: SCITT + OSCAL profiles, replay-resistance nonce, hachure diff (…",
          "author_name": "Brian Anderson",
          "author_login": "pumakuma",
          "committed_at": "2026-07-04T16:52:55Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f26d4239039220e29e687fae87c8114766cc285a",
          "body": "…e, AR4SI mapping (0.10.2)\n\nLandscape research outcome (25 adversarially-verified claims across\nSCITT/RATS/EAT/in-toto/VC 2.0/OSCAL): every adjacent standard delegates\nstatus decisions to unstandardized \"local policy\"; none defines a\nconsumer-recomputable status function. Doc changes align the spec \n[…]\n-policy strategic question; ingestion + AR4SI marked\n  shipped.\n\nNo schema or behavior change; statusFunctionVersion stays \"2\".\n\nClaude-Session: https://claude.ai/code/session_01SPaNvKDehpjBSGDbtgqCFY",
          "is_bot": false,
          "headline": "feat(docs): recomputable-trust positioning, evidence-ingestion profil…",
          "author_name": "Brian Anderson",
          "author_login": "pumakuma",
          "committed_at": "2026-07-04T05:07:03Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "18e17225ed6033e8948e98bbfc0c4072a8f3afc7",
          "body": "…otes\n\n- merge.md §5 rule 3 now covers the schemaVersion-6 `proof` block: a\n  producer's signature does not survive merging, so `proof` MUST be\n  omitted from merged output (same contract as producerId). The bundled\n  implementation already behaves this way; locked by test.\n- Implementation-notes ta\n[…]\n\"/\"Implementer TODO\" rows were stale\n  (kontourai/surface#116 completes the picture with schemaVersion 6 +\n  proof round-trip).\n\nClaude-Session: https://claude.ai/code/session_01SPaNvKDehpjBSGDbtgqCFY",
          "is_bot": false,
          "headline": "docs(merge): proof omitted on merged output; refresh implementation n…",
          "author_name": "Brian Anderson",
          "author_login": "pumakuma",
          "committed_at": "2026-07-03T19:37:39Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "87951eb8a06c6a342e3f6954c3f8eb59b9be0d5f",
          "body": "…reflects bundled implementation (0.10.1)\n\nsf-reference-bundle-snapshot.json carried kontour-surface fixture\nstrings while every other vector had been genericized to producer-a/b/c\n— renamed to example-producer (claim id claim.surface.future-console →\nclaim.roadmap.future-service, expect key updated\n[…]\n status/merge derivation itself — false since 0.10.0's\nbundled implementation; rewritten to describe the in-repo L1/L2/L3 runs.\n\nClaude-Session: https://claude.ai/code/session_01SPaNvKDehpjBSGDbtgqCFY",
          "is_bot": false,
          "headline": "fix(conformance): genericize snapshot vector fixtures; manifest note …",
          "author_name": "Brian Anderson",
          "author_login": "pumakuma",
          "committed_at": "2026-07-03T19:20:32Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8d6e5c3df29415977ebb3cd757c0b512f7bc1a3f",
          "body": "…ne spec (0.10.0)\n\nThe package now stands entirely on its own — no vendor implementation\nrequired to produce, validate, merge, or evaluate Hachure records:\n\n- lib/derive.mjs: status derivation (statusFunctionVersion \"2\") per\n  status-function.md; passes all 8 conformance vectors in-repo.\n- lib/merge\n[…]\nersions.test.mjs: prose/schema version agreement gate —\n  npm test fails if advertised versions drift from schema/package.json.\n\nClaude-Session: https://claude.ai/code/session_01SPaNvKDehpjBSGDbtgqCFY",
          "is_bot": false,
          "headline": "feat: bundled implementation, proof block (schemaVersion 6), standalo…",
          "author_name": "Brian Anderson",
          "author_login": "pumakuma",
          "committed_at": "2026-07-03T18:30:23Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "30e0989b9c5b7e87bf7c71e5700d00fbdb0a0452",
          "body": "…eset to 5 (0.9.0) (#6)\n\nThe last vendor artifact leaves the core wire format:\n\n- Claim.surface (required, product-named) -> Claim.facet (optional):\n  producer-defined grouping tag, excluded from claim identity (merge.md\n  section 4) and from status derivation; documented properly in README for\n  th\n[…]\n survey/veritas/flow-agents/\nflow in parallel. npm test 126/126.\n\nClaude-Session: https://claude.ai/code/session_01CEPxsn2GuWdysEMACRHsFQ\n\nCo-authored-by: Brian Anderson <brian.anderson1222@gmail.com>",
          "is_bot": false,
          "headline": "feat!(claim): rename surface -> facet, optional; schemaVersion hard-r…",
          "author_name": "Brian Anderson",
          "author_login": "briananderson1222",
          "committed_at": "2026-07-02T15:16:37Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "31dc6aabd910b0ef4143581a949c479560ff4b27",
          "body": "…0.8.0) (#5)\n\nHachure stands alone:\n- all 8 schema $ids migrate kontourai.io/schemas/surface/* ->\n  hachure.org/schemas/* (atomic; cross-file $refs verified; flow-loader\n  pattern validated against a real conformance bundle); titles neutralized\n  to \"Hachure <RecordType>\"\n- SECURITY.md: honest L0 th\n[…]\nd rename is deferred to an\nowner-gated 0.9.0). npm test 122/122.\n\nClaude-Session: https://claude.ai/code/session_01CEPxsn2GuWdysEMACRHsFQ\n\nCo-authored-by: Brian Anderson <brian.anderson1222@gmail.com>",
          "is_bot": false,
          "headline": "feat(spec): vendor-neutral schema identity + standalone credibility (…",
          "author_name": "Brian Anderson",
          "author_login": "briananderson1222",
          "committed_at": "2026-07-02T14:09:55Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "15026aeeea0cca6851e7bbc79dec18d71b984eb0",
          "body": "…nformance vectors (0.7.0) (#4)\n\nMakes the README's multi-producer merge promise implementable:\n\n- merge.md (new, normative RFC 2119): claim identity across producers =\n  canonicalized subject + fieldOrBehavior + qualifiers (claimType/surface\n  are producer-local, excluded); union-by-id with identic\n[…]\nd via Builder Kit deliver loop,\n4 iterations. npm test: 117/117.\n\nClaude-Session: https://claude.ai/code/session_01CEPxsn2GuWdysEMACRHsFQ\n\nCo-authored-by: Brian Anderson <brian.anderson1222@gmail.com>",
          "is_bot": false,
          "headline": "feat(merge): normative multi-producer merge semantics, producerId, co…",
          "author_name": "Brian Anderson",
          "author_login": "briananderson1222",
          "committed_at": "2026-07-02T02:38:56Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c0bbac54a01fd0128b7ddacdc14c789376b941bd",
          "body": "…validation, enum alignment (0.6.0) (#3)\n\nFive verified correctness defects plus one prerequisite:\n\n- identityLinks: schema now matches the README prose and the reference\n  implementation (surface validate.ts) — new $defs/identityLink with id,\n  subjects ($defs/subjectRef), reason, attestedBy, relat\n[…]\n> verify,\n2 iterations; AC1-AC10 PASS with independent evidence.\n\nClaude-Session: https://claude.ai/code/session_01CEPxsn2GuWdysEMACRHsFQ\n\nCo-authored-by: Brian Anderson <brian.anderson1222@gmail.com>",
          "is_bot": false,
          "headline": "fix(schemas): prose/schema agreement, trust-report schema, container …",
          "author_name": "Brian Anderson",
          "author_login": "briananderson1222",
          "committed_at": "2026-07-01T21:32:25Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4da87ccf35d987d7d32f4447c61e96c9e052e3e8",
          "body": "…onsumers read) (#2)\n\nindex.mjs exported statusFunctionVersion '2' but package.json omitted the\nfield, so tooling reading hachurePkg.statusFunctionVersion fell back to '1'\n(e.g. surface's release-trust-bundle gate). Declare it explicitly. Patch 0.5.1.\n\nCo-authored-by: Brian Anderson <brian.anderson1222@gmail.com>",
          "is_bot": false,
          "headline": "fix: declare statusFunctionVersion in package.json (spec-side value c…",
          "author_name": "Brian Anderson",
          "author_login": "briananderson1222",
          "committed_at": "2026-06-17T23:39:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0c9babe57e8635661820a9b79b1773a811f73210",
          "body": "…ent vocab; schemaVersion 4, statusFunctionVersion 2 (#1)\n\n- claim.schema: optional expiresAt (ISO) and ttlSeconds (relative); expiresAt canonical\n- verification-event.schema: add 'revoked' status + optional type (verification|invalidation)\n- inquiry-record.schema: add 'revoked' to status enums\n- tr\n[…]\n, sf-no-freshness-fields\n- README/package: version bump to 0.5.0\n\nAll new fields optional; bundles valid at schemaVersion 3 remain valid.\n\nCo-authored-by: Brian Anderson <brian.anderson1222@gmail.com>",
          "is_bot": false,
          "headline": "Add optional claim freshness (expiresAt/ttlSeconds) + invalidation ev…",
          "author_name": "Brian Anderson",
          "author_login": "briananderson1222",
          "committed_at": "2026-06-17T20:33:08Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6cbc7661a7e17524dfb63e8612a6980ccb31f1bf",
          "body": "Reconcile the evidence schema with what the reference implementation\nalready validates and emits: passing/blocking (surface EVIDENCE_KEYS,\nemitted by the surface release bundle) and execution (Evidence.execution\nin surface types since May, emitted by the surface release pipeline and\nveritas evidence projection). additionalProperties:false meant strict\nreceivers rejected the flagship producer's own published bundle —\nfound by ops receiver-attestation spike, 2026-06-12.",
          "is_bot": false,
          "headline": "Evidence passing/blocking/execution fields (0.4.0)",
          "author_name": "Brian Anderson",
          "author_login": "pumakuma",
          "committed_at": "2026-06-12T22:54:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "24bec60e79d3dc88529f7d12cf87bb5b4a6e4bde",
          "body": "…independent implementation",
          "is_bot": false,
          "headline": "docs(verification-endpoint): resolve five ambiguities found by first …",
          "author_name": "Brian Anderson",
          "author_login": "pumakuma",
          "committed_at": "2026-06-12T06:28:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2c1b92b0f2d33d59b7e9cd91b5b86ec49b0b5d46",
          "body": "Bump version 0.3.0 → 0.3.1 (docs-only). Adds WebAuthn/passkey with\nuser-verification as the RECOMMENDED mechanism for highest-assurance\nhuman ceremonies: device-local biometric proves liveness + enrolled\nidentity without biometric data leaving the device; output is a\nhardware-backed signature that c\n[…]\nDR 0004: channels may attach C2PA-style capture-provenance media as\nordinary evidence with integrity anchors; channels never replace\nadmissible testimony kinds; media without capture provenance is L0.",
          "is_bot": false,
          "headline": "docs: passkey ceremony recommendation + media-evidence channel note",
          "author_name": "Brian Anderson",
          "author_login": "pumakuma",
          "committed_at": "2026-06-12T05:46:15Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "daf38efc3d85d3c1299ff71cf4abcd9c448f4ee9",
          "body": "- L0 producer-asserted / L1 identity-signed (keyless OIDC) / L2 held-key\n- signing targets: bundles, attestations, verification responses\n- human-readable identity presentation MUST; policy mismatches are\n  transparency gaps; human ceremony co-located with the authorizing act",
          "is_bot": false,
          "headline": "Assurance profile (0.3.0): signing as a dial",
          "author_name": "Brian Anderson",
          "author_login": "pumakuma",
          "committed_at": "2026-06-11T22:31:25Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "81de3c72dd6c0f30d2da03c08f843bff8c4e6379",
          "body": null,
          "is_bot": false,
          "headline": "0.2.2: repository field (required by npm provenance validation)",
          "author_name": "Brian Anderson",
          "author_login": "pumakuma",
          "committed_at": "2026-06-11T22:09:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "357f6ae7325cf77d02724ccf69002c8bcc62a890",
          "body": "- optional extension: producer-served liveness for portable records;\n  response is a scoped TrustBundle (testimony, never a verdict);\n  signed/unsigned assurance levels; key management explicitly deferred\n- README gains a Profiles tier (in-toto, verification-endpoint)",
          "is_bot": false,
          "headline": "Verification endpoint profile (0.2.1)",
          "author_name": "Brian Anderson",
          "author_login": "pumakuma",
          "committed_at": "2026-06-11T20:15:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4e7b14a57337da15d8a342afc671ac6d26d2c666",
          "body": null,
          "is_bot": false,
          "headline": "statusFunctionVersion: camelCase export matching the wire field (0.2.0)",
          "author_name": "Brian Anderson",
          "author_login": "pumakuma",
          "committed_at": "2026-06-11T16:09:36Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f6008c98cf4f30c276291cbfc3eba3d700c30071",
          "body": null,
          "is_bot": false,
          "headline": "CI: test + pack dry-run on push/PR",
          "author_name": "Brian Anderson",
          "author_login": "pumakuma",
          "committed_at": "2026-06-11T16:08:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1d960d4154d151ec270810d0a2099d26966d5a51",
          "body": "…DC publish workflow",
          "is_bot": false,
          "headline": "npm package: hachure 0.1.0 — schemas, test vectors, index exports, OI…",
          "author_name": "Brian Anderson",
          "author_login": "pumakuma",
          "committed_at": "2026-06-11T15:17:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "27b9863153669783edcb4e464c27db04ae7a9b21",
          "body": "…tors",
          "is_bot": false,
          "headline": "Hachure specification: prose, normative schemas, conformance test vec…",
          "author_name": "Brian Anderson",
          "author_login": "pumakuma",
          "committed_at": "2026-06-11T14:56:23Z",
          "body_truncated": false,
          "is_coding_agent": false
        }
      ],
      "releases_count": 1,
      "commits_last_year": 33,
      "latest_release_at": "2026-07-17T03:40:13Z",
      "latest_release_tag": "v0.15.0",
      "releases_from_tags": false,
      "days_since_last_push": 4,
      "active_weeks_last_year": 5,
      "days_since_latest_release": 4,
      "mean_days_between_releases": null
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": true,
      "health_percentage": 75,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "hachure",
          "exists": true,
          "license": "MIT",
          "keywords": [
            "trust",
            "format",
            "spec",
            "conformance",
            "hachure"
          ],
          "ecosystem": "npm",
          "matches_repo": true,
          "registry_url": "https://www.npmjs.com/package/hachure",
          "is_deprecated": false,
          "latest_version": "0.15.0",
          "repository_url": "https://github.com/hachure-org/spec",
          "versions_count": 19,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": 1,
          "monthly_downloads": 12115,
          "first_published_at": "2026-06-11T15:16:56.464000Z",
          "latest_published_at": "2026-07-17T03:40:47.050000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 4
        }
      ]
    },
    "popularity": {
      "forks": 0,
      "stars": 0,
      "watchers": 0,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 0
      },
      "star_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_stars": 0
      },
      "open_issues_and_prs": 1
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [
        "examples"
      ],
      "has_llms_txt": false,
      "has_dockerfile": false,
      "has_mcp_signal": false,
      "bootstrap_files": [],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [],
      "largest_source_bytes": 24475,
      "source_files_sampled": 15,
      "oversized_source_files": 0,
      "agent_instruction_files": [],
      "agent_instruction_max_bytes": null
    },
    "dependencies": {
      "manifests": [
        "package.json"
      ],
      "advisories": {
        "error": null,
        "scope": null,
        "source": null,
        "findings": [],
        "collected": false,
        "truncated": false,
        "by_severity": {},
        "advisory_count": 0,
        "affected_count": 0,
        "assessed_count": 0,
        "assessed_package": null,
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "npm"
      ],
      "dependencies": [],
      "all_dependencies": {
        "error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
        "source": null,
        "packages": [],
        "collected": false,
        "truncated": false,
        "total_count": null,
        "direct_count": null,
        "indirect_count": null
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 14,
        "open_issues": 1,
        "closed_ratio": 0.857,
        "closed_issues": 6,
        "closed_unmerged_prs": 0
      },
      "bus_factor": 1,
      "bot_contributors": 1,
      "top_contributors": [
        {
          "type": "User",
          "login": "pumakuma",
          "commits": 19,
          "avatar_url": "https://avatars.githubusercontent.com/u/1477568?v=4"
        },
        {
          "type": "User",
          "login": "briananderson1222",
          "commits": 13,
          "avatar_url": "https://avatars.githubusercontent.com/u/4603907?v=4"
        }
      ],
      "contributors_sampled": 2,
      "top_contributor_share": 0.594
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "ci.yml",
        "publish-npm.yml",
        "release-please.yml"
      ],
      "has_docs_dir": false,
      "linter_configs": [],
      "has_editorconfig": false,
      "has_linter_config": false,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "package-lock.json"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 10,
            "reason": "14 out of 14 merged PRs checked by a CI test -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/29 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 3,
            "reason": "project has 1 contributing companies or organizations -- score normalized to 3",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 0,
            "reason": "no update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 0,
            "reason": "project was created within the last 90 days. Please review its contents carefully",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": 10,
            "reason": "packaging workflow detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 5,
            "reason": "dependency not pinned by hash detected -- score normalized to 5",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "SAST tool is not run on all commits -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 10,
            "reason": "security policy file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": null,
            "reason": "no releases found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 10,
            "reason": "0 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "1840b2f71cfa02a29212639087fc6cb0473be1e3",
        "ran_at": "2026-07-21T21:25:23Z",
        "aggregate_score": 4.4,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": true,
      "has_dependabot_config": false
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/hachure-org/spec",
    "host": "github.com",
    "name": "spec",
    "owner": "hachure-org"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "moderate",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 56,
      "inputs": {
        "security": 44,
        "vitality": 65,
        "community": 42,
        "governance": 55,
        "engineering": 71
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "moderate",
        "name": "Vitality",
        "value": 65,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "moderate",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 53,
            "inputs": {
              "commits_last_year": 33,
              "human_commit_share": 0.97,
              "days_since_last_push": 4,
              "active_weeks_last_year": 5
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 4 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 4
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "5/52 weeks with commits",
                "points": 3.5,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 5
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "33 commits in the last year",
                "points": 13.8,
                "status": "partial",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 33
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "good",
            "name": "Release discipline",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 84,
            "inputs": {
              "releases_count": 1,
              "latest_release_tag": "v0.15.0",
              "releases_from_tags": false,
              "days_since_latest_release": 4,
              "mean_days_between_releases": null
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "1 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 4 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 4
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "cadence unknown (single release)",
                "points": 12.6,
                "status": "partial",
                "details": [
                  {
                    "code": "release_cadence_unknown",
                    "params": {}
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "at_risk",
        "name": "Community & Adoption",
        "value": 42,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 1,
            "inputs": {
              "forks": 0,
              "stars": 0,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "0 stars",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "0 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "good",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 70,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": true,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (MIT)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "MIT"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 18,
                "status": "met",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          },
          {
            "key": "ecosystem_adoption",
            "band": "moderate",
            "name": "Ecosystem adoption (downloads)",
            "note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "registry_dependents"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 68,
            "inputs": {
              "packages": [
                "hachure"
              ],
              "dependents": null,
              "ecosystems": "npm",
              "total_downloads": null,
              "monthly_downloads": 12115
            },
            "components": [
              {
                "key": "monthly_downloads",
                "name": "Monthly downloads",
                "detail": "12,115 downloads/month across npm",
                "points": 54.4,
                "status": "partial",
                "details": [
                  {
                    "code": "downloads_monthly",
                    "params": {
                      "count": 12115,
                      "ecosystems": "npm"
                    }
                  }
                ],
                "max_points": 80
              },
              {
                "key": "registry_dependents",
                "name": "Registry dependents",
                "detail": "not reported by this ecosystem",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_reported_by_this_ecosystem",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "moderate",
        "name": "Sustainability & Governance",
        "value": 55,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 24,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 2,
              "top_contributor_share": 0.594
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 59% of commits",
                "points": 9.1,
                "status": "partial",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 59
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "2 contributors",
                "points": 2.7,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 1 contributing companies or organizations -- score normalized to 3",
                "points": 3,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "good",
            "name": "Issue & PR responsiveness",
            "note": null,
            "notes": [],
            "value": 78,
            "inputs": {
              "merged_prs": 14,
              "open_issues": 1,
              "closed_issues": 6,
              "issue_closed_ratio": 0.857,
              "closed_unmerged_prs": 0
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "86% of issues closed",
                "points": 40.1,
                "status": "partial",
                "details": [
                  {
                    "code": "issues_closed_share",
                    "params": {
                      "share": 86
                    }
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "14/14 decided PRs merged",
                "points": 38.2,
                "status": "met",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 14,
                      "decided": 14
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/29 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "at_risk",
            "name": "Ownership & stewardship",
            "note": null,
            "notes": [],
            "value": 35,
            "inputs": {
              "followers": 0,
              "owner_type": "Organization",
              "is_verified": null,
              "owner_login": "hachure-org",
              "public_repos": 4,
              "account_age_days": 40
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "organization-owned",
                "points": 30,
                "status": "met",
                "details": [
                  {
                    "code": "owner_organization",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "0 followers of hachure-org",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 0,
                      "login": "hachure-org"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "4 public repos, account ~0 yr old",
                "points": 5.3,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 4
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 0
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "hachure"
              ],
              "ecosystems": "npm",
              "any_deprecated": false,
              "min_days_since_publish": 4
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on npm",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "npm"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 4 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 4
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "19 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 19
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "good",
        "name": "Engineering Quality",
        "value": 71,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "moderate",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 68,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": false,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "3 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 3
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "14 out of 14 merged PRs checked by a CI test -- score normalized to 10",
                "points": 20,
                "status": "met",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "good",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 75,
            "inputs": {
              "topics": [
                "conformance",
                "json-schema",
                "open-standard",
                "provenance",
                "specification",
                "trust"
              ],
              "has_wiki": true,
              "homepage": "https://hachure.org",
              "has_readme": true,
              "has_docs_dir": false,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": "https://hachure.org",
                "points": 15,
                "status": "met",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": "6 topics",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "topics_count",
                    "params": {
                      "count": 6
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "at_risk",
        "name": "Security",
        "value": 44,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "at_risk",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 44,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 17,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 1,
              "scorecard_aggregate": 4.4
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "14 out of 14 merged PRs checked by a CI test -- score normalized to 10",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/29 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 1 contributing companies or organizations -- score normalized to 3",
                "points": 0.8,
                "status": "partial",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "no update tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 5",
                "points": 2.5,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool is not run on all commits -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "0 existing vulnerabilities detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 1
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "at_risk",
        "name": "AI Readiness",
        "value": 41,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "at_risk",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 0.844,
              "agent_instruction_files": [],
              "agent_instruction_max_bytes": null
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "no CLAUDE.md / AGENTS.md / editor rules",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_instructions",
                    "params": {}
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "27 of 32 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 27,
                      "sampled": 32
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "at_risk",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 37,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "package-lock.json"
              ],
              "has_dockerfile": false,
              "typed_language": false,
              "bootstrap_files": [],
              "has_devcontainer": false,
              "has_linter_config": false,
              "typecheck_configs": [],
              "agent_commit_share": 0,
              "toolchain_manifests": [],
              "dependency_bot_commit_share": 0
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "no agent-authored commits among the last 33",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_authored_commits",
                    "params": {
                      "sampled": 33
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "no automated dependency updates observed",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_dependency_automation",
                    "params": {}
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 5",
                "points": 5,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "moderate",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 55,
            "inputs": {
              "primary_language": "JavaScript",
              "largest_source_bytes": 24475,
              "source_files_sampled": 15,
              "oversized_source_files": 0
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "JavaScript without a type-check config",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_typecheck_config_language",
                    "params": {
                      "language": "JavaScript"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "0/15 source files over 60KB",
                "points": 55,
                "status": "met",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 15,
                      "oversized": 0
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "at_risk",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "example_dirs": [
                "examples"
              ],
              "has_mcp_signal": false,
              "api_schema_files": []
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": "examples",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "examples"
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
    "deps.dev does not index npm:hachure@0.15.0; advisories assessed against the repository dependency graph instead"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-21T21:25:34.527223Z",
  "schema_version": "0.23.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/h/hachure-org/spec.svg",
  "full_name": "hachure-org/spec",
  "license_state": "standard",
  "license_spdx": "MIT"
}