tomtom215 / a2a-rust

Не вдалося зібрати розв'язаний набір залежностей для цього звіту: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository

{
  "data": {
    "repo": {
      "topics": [
        "a2a",
        "a2a-protocol",
        "agentic-ai",
        "agents",
        "artificial-intelligence",
        "protocol-specification",
        "rust",
        "sdk",
        "agentic-ai-development",
        "a2a-server",
        "a2a-sdk",
        "a2a-types",
        "agent-orchestration",
        "agents-sdk"
      ],
      "is_fork": false,
      "size_kb": 29755,
      "has_wiki": true,
      "homepage": "https://a2a-rust.com/",
      "languages": {
        "Go": 18833,
        "CSS": 4826,
        "HTML": 141318,
        "Java": 18931,
        "Rust": 3686414,
        "Shell": 48825,
        "Python": 72567,
        "Dockerfile": 953,
        "Handlebars": 7353,
        "JavaScript": 11853
      },
      "pushed_at": "2026-07-24T11:52:39Z",
      "created_at": "2026-03-15T00:20:45Z",
      "owner_type": "User",
      "updated_at": "2026-07-24T17:12:32Z",
      "description": "Type-safe, async Rust SDK for the Agent2Agent (A2A) protocol, built to the final v1.0.0 spec — JSON-RPC, REST, WebSocket & gRPC for building interoperable AI agents",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "Apache-2.0",
      "default_branch": "main",
      "license_spdx_raw": "Apache-2.0",
      "primary_language": "Rust",
      "significant_languages": [
        "Rust"
      ]
    },
    "owner": {
      "blog": null,
      "name": "Tom F",
      "type": "User",
      "login": "tomtom215",
      "company": null,
      "location": null,
      "followers": 32,
      "avatar_url": "https://avatars.githubusercontent.com/u/4908716?v=4",
      "created_at": "2013-07-01T16:18:28Z",
      "is_verified": null,
      "public_repos": 21,
      "account_age_days": 4772
    },
    "license": {
      "state": "standard",
      "spdx_id": "Apache-2.0",
      "raw_spdx": "Apache-2.0",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.7.0",
          "kind": "minor",
          "published_at": "2026-07-24T11:52:39Z"
        },
        {
          "tag": "v0.6.0",
          "kind": "minor",
          "published_at": "2026-06-10T22:35:52Z"
        },
        {
          "tag": "v0.5.0",
          "kind": "minor",
          "published_at": "2026-04-02T21:51:52Z"
        },
        {
          "tag": "v0.4.1",
          "kind": "patch",
          "published_at": "2026-03-31T18:41:22Z"
        },
        {
          "tag": "v0.4.0",
          "kind": "minor",
          "published_at": "2026-03-31T16:26:03Z"
        },
        {
          "tag": "v0.3.3",
          "kind": "patch",
          "published_at": "2026-03-31T05:37:35Z"
        },
        {
          "tag": "v0.3.2",
          "kind": "patch",
          "published_at": "2026-03-30T22:08:36Z"
        },
        {
          "tag": "v0.3.1",
          "kind": "patch",
          "published_at": "2026-03-21T00:39:16Z"
        },
        {
          "tag": "v0.3.0",
          "kind": "minor",
          "published_at": "2026-03-20T18:08:59Z"
        },
        {
          "tag": "v0.2.0",
          "kind": "minor",
          "published_at": "2026-03-16T00:47:12Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "b416c1a43212775afa68fb5d4824043311ca7de5",
          "body": "…hkvwjw\n\nci(release): fix the release pipeline (invalid attest-sbom pin) + per-crate SBOM attestation",
          "is_bot": false,
          "headline": "Merge pull request #95 from tomtom215/claude/rust-sdk-hardening-v0.7-…",
          "author_name": "Tom F",
          "author_login": "tomtom215",
          "committed_at": "2026-07-24T11:25:34Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "78fdc82d503fd1950e17d20a1e7fcc1152621125",
          "body": "The `javascript` and `js-sdk` cross-language TCK legs ran\n\n    cd itk/agents/js-<x> && npm install && ... node index.js &\n\nwhich backgrounds the *entire* chain — `npm install` included. The\nreadiness poll then waits only ~30s for the agent to answer, so when the\nnpm registry is slow on a runner, `np\n[…]\nas a distinct,\nimmediate error instead of a misleading startup timeout.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_013qqQa1Scb6pyRXT9WHhfJX",
          "is_bot": false,
          "headline": "ci(tck): install JS agent deps in the foreground to stop startup flake",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-24T11:00:40Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "6856fab19ef6a63f0a3e5a743582a4509627ca53",
          "body": "Harden the supply-chain evidence the release produces, for downstream\n(and LF) verification:\n\n- Attest each crate against its OWN CycloneDX SBOM instead of attesting\n  all four .crate archives against a single shared SBOM\n  (a2a-protocol-server's). `gh attestation verify <crate>.crate` now\n  resolve\n[…]\nest failure).\n\nNo behavioural change to what is published to crates.io.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_013qqQa1Scb6pyRXT9WHhfJX",
          "is_bot": false,
          "headline": "ci(release): per-crate SBOM attestation + publish SBOMs on the release",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-24T10:52:49Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "e99d1009bec2cf1684a8eeb8ae375db6d664b35d",
          "body": "The `Package and attest` job pinned `actions/attest-sbom` to\n`bd218ad7dbfd8ce29ba013dfea656c96f4d24c46` (labelled `# v3.0.0`), a\ncommit SHA that does not exist in that action's repository. GitHub\nresolves all referenced actions before any job starts, so the entire\nRelease workflow failed immediately\n[…]\ne same SHAs\nalready resolving in the green CI/TCK/Benchmarks workflows.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_013qqQa1Scb6pyRXT9WHhfJX",
          "is_bot": false,
          "headline": "ci(release): fix invalid actions/attest-sbom pin blocking the release",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-24T10:40:37Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "7ac16a27310b722f608f893af4d79e3d3473ef17",
          "body": null,
          "is_bot": false,
          "headline": "Update README.md",
          "author_name": "Tom F",
          "author_login": "tomtom215",
          "committed_at": "2026-07-24T08:10:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f9ab2c16b4e7cbf6d8f97a5897dc75fad9180691",
          "body": null,
          "is_bot": false,
          "headline": "Update README.md",
          "author_name": "Tom F",
          "author_login": "tomtom215",
          "committed_at": "2026-07-24T08:09:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6a936ce625268d31cf4c1a83850bfb2ebc4aae5a",
          "body": null,
          "is_bot": false,
          "headline": "Update README.md",
          "author_name": "Tom F",
          "author_login": "tomtom215",
          "committed_at": "2026-07-24T08:07:23Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "178fc9046b2e965840402f78427363299ff01623",
          "body": "…hkvwjw\n\nv0.7.0: spec-compliance closure, cross-SDK interop, adversarial testing",
          "is_bot": false,
          "headline": "Merge pull request #93 from tomtom215/claude/rust-sdk-hardening-v0.7-…",
          "author_name": "Tom F",
          "author_login": "tomtom215",
          "committed_at": "2026-07-24T08:03:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cf6bc2fe3b15d074272cd70524ffd270660ebc0e",
          "body": "The Regression Gate compares a focused criterion subset on the base\nbranch vs the PR. It inherited the shipping `[profile.release]`\n(`lto = true`, `codegen-units = 1`), so both sides were built with fat\nwhole-program LTO. Under fat LTO the optimizer re-inlines across every\nworkspace crate, which mak\n[…]\ns stay faithful.\n\nDocs and the threshold comments are updated to match.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_013qqQa1Scb6pyRXT9WHhfJX",
          "is_bot": false,
          "headline": "ci(bench): build the PR regression gate without whole-program LTO",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-24T07:32:33Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "c6f0830e6fe62d09b2f162696dd48e157336318e",
          "body": "…ocker)\n\nThe upstream a2a-itk's uv.lock pins baseline dependencies (aiosqlite via\na2a-sdk[sqlite] -> sqlalchemy, and others) to a PRIVATE Google Artifact\nRegistry (us-python.pkg.dev/artifact-foundry-prod/…) that returns 401 to\nunauthenticated public runners, so `uv sync` cannot provision the baselin\n[…]\nemains the authoritative\nautomated gate. README updated to explain this.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_013qqQa1Scb6pyRXT9WHhfJX",
          "is_bot": false,
          "headline": "ci(itk): make upstream current-mount manual-only (private-registry bl…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-24T06:25:57Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "614ff812ce892620c8ce9bcc48db89e482b3f876",
          "body": "…b bugs\n\nTwo real bugs surfaced by the newer-toolchain CI and the fuzz smoke run,\nplus three CI-config fixes:\n\n- iso8601 parser (a2a-protocol-types): the `iso8601` fuzz target found a\n  panic — `attempt to multiply with overflow`. Two root causes, both fixed:\n  * The year was parsed as an unbounded \n[…]\n and serves under\n  the real ITK; only the upstream baseline needed uv.)\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_013qqQa1Scb6pyRXT9WHhfJX",
          "is_bot": false,
          "headline": "Fix CI failures: iso8601 overflow (fuzz), clippy question_mark, CI jo…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-24T06:22:21Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "8c269f715091c69b22cb01df02167173ff813e20",
          "body": "…ning-v0.7-hkvwjw",
          "is_bot": false,
          "headline": "Merge remote-tracking branch 'origin/main' into claude/rust-sdk-harde…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-24T05:43:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a4ad04b573b624516bad74563c7d63685c738d55",
          "body": "- CHANGELOG.md: promote [Unreleased] to [0.7.0] - 2026-07-24, keep a fresh\n  empty [Unreleased] section on top.\n- CITATION.cff: version 0.7.0, date-released 2026-07-24.\n- SECURITY.md: supported-versions table now covers the 0.7.x line.\n\nCrate versions were already at 0.7.0. All release-workflow vali\n[…]\ne` for all publishable\ncrates, and `RUSTDOCFLAGS=-D warnings cargo doc`.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_013qqQa1Scb6pyRXT9WHhfJX",
          "is_bot": false,
          "headline": "chore: prepare release v0.7.0",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-24T05:42:56Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "698f4f159dbc6a8b2d49ea723660aae43880720b",
          "body": "- CHANGELOG: documents the cross-SDK interop and adversarial-testing work\n  (official-SDK agents both directions, upstream ITK current-mount, fuzz\n  expansion, hostile-peer harness, SPEC_COMPLIANCE/semver/SBOM), the\n  default working-cancel change, and the canonical HTTP+JSON binding.\n- Stop trackin\n[…]\n26/26; ITK traversal self-test 9/9;\na2a-inspector card validation green.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_013qqQa1Scb6pyRXT9WHhfJX",
          "is_bot": false,
          "headline": "Final validation, CHANGELOG interop notes, drop build artifacts",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-24T05:12:20Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "8b3170a2037576313b137c30a9fff78c6b1a03ed",
          "body": "…or check\n\n- cargo-semver-checks CI job (ci.yml) guards the public API of the three\n  published crates against the last crates.io release from 0.7.0 onward\n  (reports on 0.x, blocks once 1.0). MSRV 1.93 is already compiled by the\n  clippy matrix across three OSes and by the release MSRV job.\n- Cyclo\n[…]\nstill requires the\n  v0.3 top-level `url` field that v1.0 made optional.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_013qqQa1Scb6pyRXT9WHhfJX",
          "is_bot": false,
          "headline": "Release-review hygiene: semver-checks, SBOM, SPEC_COMPLIANCE, inspect…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-24T05:03:50Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "3a3f7fb5e90860bc0ba5f16238aa5454a2f97483",
          "body": "…ve TCK\n\nT2 — upstream ITK traversal agent:\n- itk/ is now the a2a-itk \"current\" agent: itk-current-agent implements\n  the ITK's multi-hop traversal instruction protocol (protos/instruction.proto\n  vendored verbatim) on a2a-protocol-{server,client}, serving JSON-RPC\n  (/ and /jsonrpc), REST, and gRPC\n[…]\n4.2); a malformed\n  request body must be rejected, never yield a result.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_013qqQa1Scb6pyRXT9WHhfJX",
          "is_bot": false,
          "headline": "ITK current-mount agent, fuzz expansion, hostile-peer harness, negati…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-24T04:59:36Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "7c57c4f73b0bc0e0659a6d9c98375b46b659d222",
          "body": "…interop\n\nAdds a second agent tier built on the OFFICIAL reference SDKs, so cross-SDK\ninterop is proven against real implementations instead of our own stubs:\n\n- itk/agents/python-sdk — a2a-sdk 1.1.2 (DefaultRequestHandlerV2, Starlette\n  routes). TCK: 20/20 JSON-RPC, 20/20 REST.\n- itk/agents/js-sdk \n[…]\nw\n  official-client-vs-rust-server job runs the reverse-direction suite.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_013qqQa1Scb6pyRXT9WHhfJX",
          "is_bot": false,
          "headline": "ITK: official-SDK echo agents for all four languages + bidirectional …",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-24T04:14:29Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "be51bb77099b52f64abf92ad9d56c3d9ba6ff8e7",
          "body": "…l Python agent\n\nRunning our TCK against an echo agent built on the official Python\na2a-sdk 1.1.2 (itk/agents/python-sdk) surfaced three interop deviations,\nfixed here for exact reference parity. TCK now passes 20/20 against both\nour echo-agent and the official SDK agent, on JSON-RPC and REST.\n\n- Mi\n[…]\nejection,\n  versionless card discovery, legacy-name rejection, opt-out).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_013qqQa1Scb6pyRXT9WHhfJX",
          "is_bot": false,
          "headline": "Reference-SDK interop: strict A2A-Version, drop v0.3 aliases, officia…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-24T03:48:23Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "a811a2bbeee3bbb1d05efdf1f92b69d6258059c4",
          "body": "… (v0.7.0)\n\nCloses the remaining deviations from an independent A2A v1.0 protocol\naudit, hardens streaming semantics, pays down test debt, and bumps the\nworkspace to 0.7.0.\n\nSpec compliance:\n- gRPC errors attach google.rpc.ErrorInfo (reason + a2a-protocol.org\n  domain) via tonic-types (§10.6); the g\n[…]\ns passing with all features,\n2075 with defaults, per-feature legs green.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_013qqQa1Scb6pyRXT9WHhfJX",
          "is_bot": false,
          "headline": "Spec-compliance closure pass: error details, filters, auth, streaming…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-24T00:07:41Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "893c4bc5de491bbd16be3bcba751a4108962849f",
          "body": "Auto-generated by the Benchmarks workflow.\nSource: benches/scripts/generate_book_page.sh, generate_dashboard.sh",
          "is_bot": true,
          "headline": "chore: update benchmark results",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-23T23:45:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "fb4b24727f1c0c2d2bce58669cf095212f8fe2be",
          "body": "…rouvag\n\nv0.7.0: protobuf-native gRPC, full-surface WebSocket, first-party auth, and a v1.0.0 spec-compliance pass",
          "is_bot": false,
          "headline": "Merge pull request #92 from tomtom215/claude/rust-sdk-hardening-v0.7-…",
          "author_name": "Tom F",
          "author_login": "tomtom215",
          "committed_at": "2026-07-23T22:19:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "84b46bc952f2d4b01bf1530cd55f929b4eb31a21",
          "body": "…WT exp boundary\n\nThe incremental mutation-testing gate surfaced surviving mutants across the\ndiff — code changed with too-weak test coverage to pin its behavior. Close all\nof them with real assertions (no overrides, no skips), and fix two spots where\nthe correct move was to fix the logic, not pin i\n[…]\neatures build. CI's 8-shard incremental mutation\ngate re-verifies the full diff.\n\nCo-Authored-By: Claude <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_011Q4B7A2PMwa7QvnbfczgHH",
          "is_bot": false,
          "headline": "test(hardening): kill every incremental mutation-test survivor; fix J…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-23T21:36:56Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "b3b2cf0d5069a4e0b8851960e258a6fdb567b92d",
          "body": "The incremental (PR) mutation job sharded the in-diff mutant set 4 ways with a\n45-minute per-shard timeout. A large PR diff generates enough in-diff mutants\nthat the heaviest shards ran past 45 minutes and were cancelled, failing the\ngate even though zero mutants survived in the shards that complete\n[…]\ng reads the\nshard count from `INCREMENTAL_SHARDS`, so no other change is needed.\n\nCo-Authored-By: Claude <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_011Q4B7A2PMwa7QvnbfczgHH",
          "is_bot": false,
          "headline": "ci(mutants): shard incremental mutation testing 8-way to fit the timeout",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-23T20:33:09Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "478270bb98eab80c56b1bf7b2e9cfd099502510b",
          "body": "…I runners\n\n`token_still_evictable_spares_fresh_live_token` built an \"aged\" instant with\n`Instant::now().checked_sub(Duration::from_secs(3600))`. On platforms whose\nmonotonic-clock epoch is younger than the subtracted duration — e.g. a\nfreshly booted Windows CI runner — `checked_sub` returns `None`,\n[…]\ner underflows and is platform-independent. Test-only change; behavior\nunchanged.\n\nCo-Authored-By: Claude <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_011Q4B7A2PMwa7QvnbfczgHH",
          "is_bot": false,
          "headline": "test(server): avoid Instant::checked_sub underflow on fresh Windows C…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-23T19:44:43Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "3766e6613482e522279391b9d713989cc69b510b",
          "body": "…lidation, cross-binding metadata\n\nFour spec-conformance fixes from a v1.0.0 compliance audit, each with unit,\nadversarial, and cross-binding tests.\n\nListTasks ordering (spec §3.1.4). Every task store previously returned tasks\nin ascending `id` order — an arbitrary lexical order the spec does not pe\n[…]\nes, and gRPC wire-compat against the official A2A Python SDK\nin both directions.\n\nCo-Authored-By: Claude <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_011Q4B7A2PMwa7QvnbfczgHH",
          "is_bot": false,
          "headline": "fix(server): spec-compliance pass — ListTasks ordering, capability va…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-23T19:37:10Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "3b5d687c91257bcb9221570d4be4d8702b8a8eba",
          "body": "--all-features already covers auth-jwt, but with TLS on it never\ncompiles the plaintext JWKS-client path. Add a dedicated\nno-default-features + auth-jwt clippy step (exercises that path) and a\nmatching test step, matching the existing per-feature CI coverage.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_011Q4B7A2PMwa7QvnbfczgHH",
          "is_bot": false,
          "headline": "ci: lint and test the auth-jwt feature in isolation",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-23T17:57:45Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "11ee868cce89ebca18b11c2a0d66b2f97e2491d9",
          "body": "…server)\n\nCloses the auth gap vs the official SDKs: the SDK now acquires and\nverifies credentials, not just models the schemes and provides\ninterceptor hooks. Built on the existing ring/hyper stack — no\nOAuth-ecosystem dependencies (ADR 0010).\n\nClient (a2a-protocol-client::token_provider, no new fea\n[…]\nrough.\nAdds ADR 0010, a book Authentication page, and CHANGELOG entries.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_011Q4B7A2PMwa7QvnbfczgHH",
          "is_bot": false,
          "headline": "feat(auth): first-party token acquisition and verification (client + …",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-23T17:56:24Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "d4585d3effae2f3f88c3fa64fbe2aed13a076396",
          "body": "Fix every stale claim found by a systematic docs audit against current\ncode:\n\n- gRPC: the dispatchers book page still described the removed\n  JSON-in-bytes tunnel as the current protocol; ADR 0004's transport\n  list said \"JSON-over-gRPC\" with no supersession note; a dogfooding\n  test description use\n[…]\ne new first-event timeout and full WHATWG SSE\n  line-terminator support.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_011Q4B7A2PMwa7QvnbfczgHH",
          "is_bot": false,
          "headline": "docs: full accuracy pass across book, README, ADRs, and rustdoc for 0.7",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-23T17:04:28Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "761dc850a526de6921114199c5cebdb9f9bb321f",
          "body": "The spec's push-delivery example and the official SDK's webhook\nreceivers use X-A2A-Notification-Token; the bare a2a-notification-token\nname was this SDK's own pre-0.7 invention, so receivers written against\nthe official convention never saw the token. Both names are sent for\n0.7 (legacy removal pla\n[…]\n10-30s recommendation) all conform; only the token\nheader name diverged.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_011Q4B7A2PMwa7QvnbfczgHH",
          "is_bot": false,
          "headline": "fix(push): send the canonical X-A2A-Notification-Token header",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-23T16:58:45Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "1ef327faa6fe86465b5484f9ee7340ed25d8a784",
          "body": "…ns header\n\nREST tenant binding: the spec proto's google.api.http additional\nbindings put the tenant as a bare first path segment\n(/{tenant}/message:send, /{tenant}/tasks, ...), which is exactly what\nthe official SDK's RestTransport sends when configured with a tenant\n(f'/{tenant}{base_path}'). Only\n[…]\non SDK's own table\ndisagree — reason-based client mapping is unaffected.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_011Q4B7A2PMwa7QvnbfczgHH",
          "is_bot": false,
          "headline": "fix(rest): route the canonical /{tenant}/ bindings; wire A2A-Extensio…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-23T16:55:03Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "da19ec3910b6bcc767a5113e6317619b262b24e6",
          "body": "The first-event bound is now wired by every streaming transport\n(JSON-RPC, REST, gRPC, WebSocket), but the method was still gated on\ncfg(any(test, feature = \"websocket\")) — builds without the websocket\nfeature failed to compile. All-features test runs masked this; caught\nby the feature-combination check.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_011Q4B7A2PMwa7QvnbfczgHH",
          "is_bot": false,
          "headline": "fix(client): ungate EventStream::with_first_event_timeout from websocket",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-23T14:23:57Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "6b82c822a83e5e418c9f77238629a43fda87b3e7",
          "body": "… audit\n\nClient:\n- Bound the wait for the first stream event on the HTTP JSON-RPC, REST,\n  and gRPC streaming paths (the WebSocket transport already did): the\n  establishment timeouts only bounded response headers / stream open, so\n  a server that accepted the stream and then went silent hung the\n  \n[…]\nn split.\nAlso drop the duplicate manual pong (tungstenite auto-replies).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_011Q4B7A2PMwa7QvnbfczgHH",
          "is_bot": false,
          "headline": "fix(client,server): close streaming, sweep-race, and parser gaps from…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-23T14:17:58Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "e4459ffad3eabc539f85054b4721ed4a550caba8",
          "body": "… book\n\ntungstenite queues the RFC 6455 pong reply itself when a Ping frame is\nread, and the dispatcher's continuous read polling flushes it — the\nmanual reply in the read loop sent a second pong per ping (verified in\nthe tungstenite 0.29 source: OpCtl::Ping -> set_additional(Frame::pong)\nflushed by\n[…]\nent's connect_with_config in the dispatchers and transport-layers\npages.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_011Q4B7A2PMwa7QvnbfczgHH",
          "is_bot": false,
          "headline": "fix(websocket): drop duplicate pong reply; document new WS surface in…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-23T13:56:08Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "01c7adc64a58eadac6677df16a840c32f128de62",
          "body": "…e types\n\nProtoJSON printers — what every official A2A SDK uses on the JSON wire —\nomit empty repeated fields and empty maps, so absence on the wire means\n\"empty\". Twelve JSON-facing list/map fields required their key and\nrejected real official-SDK traffic at parse time. Found live by driving\nthe JS\n[…]\ngate being\nloosened. A regression past the raised threshold still fails.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_011Q4B7A2PMwa7QvnbfczgHH",
          "is_bot": false,
          "headline": "fix(types): tolerate ProtoJSON empty-repeated omission across all wir…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-23T13:52:00Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "6cdde7a64be3c78f0424f4c2e05f211ec34d47ae",
          "body": "proto/README.md still described the pre-0.7 JSON-in-bytes tunnel\n(a2a.v1.A2aService/JsonPayload) as the primary gRPC binding and claimed\nthat design \"ensures wire-format compatibility\" — the opposite of the\n0.7 reality, where the canonical lf.a2a.v1.A2AService is served and the\ntunnel is deprecated \n[…]\npat proof against the official SDK, and the tunnel's\ndeprecation status.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_011Q4B7A2PMwa7QvnbfczgHH",
          "is_bot": false,
          "headline": "docs(proto): rewrite stale README for the protobuf-native gRPC binding",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-23T13:32:15Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "afd0b5c1519ed5aeb857b46094437ba2e58502e5",
          "body": "…hardening\n\nServer dispatcher:\n- Capture the upgrade request's HTTP headers (lowercased, plus the\n  request path under \":path\") during the handshake and pass them to the\n  handler for every request on the connection. Tenant resolvers, strict\n  multi-tenancy, and header-based auth now work over WebSo\n[…]\n connect_with_config; tungstenite's 64 MiB\n  default previously applied.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_011Q4B7A2PMwa7QvnbfczgHH",
          "is_bot": false,
          "headline": "fix(websocket): full method surface, auth/tenancy headers, lifecycle …",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-23T13:29:43Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "61241d974a18744300d4e38c95a90d569bb25774",
          "body": "Auto-generated by the Benchmarks workflow.\nSource: benches/scripts/generate_book_page.sh, generate_dashboard.sh",
          "is_bot": true,
          "headline": "chore: update benchmark results",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-23T09:41:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9e1acf42c2271f849568b81b1c05570ee6e9c9f0",
          "body": "…5jtg14\n\nHardening pass: correctness/security fixes across types, client, server + HTTPS first-class",
          "is_bot": false,
          "headline": "Merge pull request #91 from tomtom215/claude/rust-sdk-hardening-v0.7-…",
          "author_name": "Tom F",
          "author_login": "tomtom215",
          "committed_at": "2026-07-23T08:16:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e4d6574cdc9ff4662fea70d2afa0815fc7723744",
          "body": "percent_decode tracked a mutable index and advanced it with `i += 1` /\n`i += 3`. Mutating those increments (`+=` → `*=`/`-=`) produces\nnon-terminating loops, which mutation testing can only catch as a\n300s-per-mutant timeout. Seven such mutants landed in one incremental\nCI shard and pushed it past i\n[…]\nnged — the existing percent-decode and path-traversal tests pass\nas-is.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01VHaarm98MrLjgwqHDmnyUz",
          "is_bot": false,
          "headline": "refactor(server): drive percent_decode by slice consumption",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-23T07:00:15Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "d713251aec32fcd2539f73ebb3522c3d16ffad8f",
          "body": "A full in-diff mutation sweep of the server crate surfaced survivors\nbeyond the earlier batch. Resolve each honestly — by removing\nredundancy where the same logic was duplicated, and by strengthening\ntests — rather than excluding them:\n\n- Per-artifact append cap: the sync collector and the backgroun\n[…]\ngetter test asserting\n  it reports the configured limit (not None/0/1).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01VHaarm98MrLjgwqHDmnyUz",
          "is_bot": false,
          "headline": "test(server): kill remaining surviving mutants in changed files",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-23T05:13:25Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "07b1bbe2b624928f5fb485cab0fa9f742442d6f1",
          "body": "The single incremental job runs every in-diff mutant at 4-way\nparallelism. On a large PR (hundreds of mutants) it exceeds the\n60-minute timeout and is cancelled, so the \"zero surviving mutants in\nchanged files\" gate silently stops enforcing.\n\nShard the in-diff mutant set across four parallel runners\n[…]\n change. Bump\nINCREMENTAL_SHARDS if a future diff outgrows four shards.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01VHaarm98MrLjgwqHDmnyUz",
          "is_bot": false,
          "headline": "ci(mutants): shard the incremental job so it completes on large PRs",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-23T04:19:04Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "49a7bdacf93cd0c18017ab02e95d5f318709d315",
          "body": "The four nested-conversion functions each duplicated the same\n`depth > MAX_STRUCT_DEPTH` check and `depth + 1` recursion increment.\nCollapse both into a single `check_depth` helper that every recursion\nsite shares, so the boundary and the per-level increment exist in one\nplace and are directly unit-\n[…]\nng (comparison weakening and\nincrement mangling in all four functions).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01VHaarm98MrLjgwqHDmnyUz",
          "is_bot": false,
          "headline": "refactor(types): centralize proto/JSON recursion-depth guard",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-23T04:13:11Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "6a79c15c382a07b7666281d784889f3c72b4a0eb",
          "body": "Add regression tests (and extract three small testable helpers in\nmessaging.rs) so the previously-surviving mutants in files touched by\nthis branch are caught:\n\n- messaging.rs: extract `second_send_blocked`, `token_aged`, and\n  `evict_aged_token` from the cancellation-entry logic and unit-test\n  eac\n[…]\nns/aborts), killing the\n  `replace signal_watcher_loop with ()` mutant.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01VHaarm98MrLjgwqHDmnyUz",
          "is_bot": false,
          "headline": "test(server): kill surviving mutants in changed handler/dispatch code",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-23T04:00:37Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "631d2a2a979d1a4eec48082e75970ba3222809cf",
          "body": "Upholds the repo's zero-surviving-mutants gate for these changed files:\n\n- sse_parser: remove the redundant feed-time BOM fast-path. It duplicated the\n  BOM strip already done by process_line (proven equivalent across single-chunk,\n  split, and no-BOM feeds), so the 'delete !input.is_empty()' mutant\n[…]\nt headers to drop. This verifies the\n  security-observability guarantee (a WebSocket-undeliverable Authorization\n  header is never dropped silently) instead of excluding the helper as\n  logging noise.",
          "is_bot": false,
          "headline": "test: resolve surviving mutants in SSE parser and WS header-drop warning",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-22T21:39:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e8748f144e6ba7a27e268ef454680696f3299f1c",
          "body": "The incremental mutation-testing job surfaced gaps (the code is correct; no test\nkilled these mutants):\n\n- push sender: extract the http-pins/https-doesn't decision into a testable\n  pin_target() helper and unit-test both branches. The DNS-rebinding pin choice\n  is security-relevant and was never ex\n[…]\nus the pure-fn extraction). Lower-value mutants\n(logging-only warn helper, the SIGHUP signal loop, an equivalent SSE-BOM strip)\nare left as accepted — side-effect/equivalent mutants not worth pinning.",
          "is_bot": false,
          "headline": "test: close mutation-testing coverage gaps in new/changed code",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-22T20:15:32Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a8b1a2f145c3c3c9c9550ce17e2ed3e4fb7d5f8a",
          "body": "…with_tls_config\n\n- New push_sender_https_e2e integration test (gated on tls-rustls) stands up a\n  real tokio-rustls HTTPS server on loopback with an rcgen-generated CA + cert,\n  then drives the actual HttpPushSender through a complete TLS handshake and\n  webhook POST — verifying SNI, certificate ve\n[…]\ntest suite in its own step (was client-only),\n  so the live-TLS path is exercised in feature isolation, not just all-features.\n- dev-deps: rcgen, tokio-rustls (already used by the client's TLS tests).",
          "is_bot": false,
          "headline": "test(server): live-TLS end-to-end push delivery; add HttpPushSender::…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-22T18:59:43Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b72457b0a67f2d5af12c64e01682bc3047c6cee6",
          "body": "…ate link\n\n- push_sender integration + unit tests now assert the correct behavior per\n  feature: HTTP-only fail-fast without tls-rustls, SSRF-enforced https with it.\n- De-link an intra-doc reference to the pub(crate) validate_webhook_url_with_dns\n  helper so all-features rustdoc stays warning-clean under -D warnings.",
          "is_bot": false,
          "headline": "test: update https push-sender tests for tls-rustls; fix rustdoc priv…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-22T18:59:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2c811c0c598b0cd16c71c1d53cb367753077c53c",
          "body": "…nd pass\n\n- book/building-agents/push-notifications.md: describe the bundled sender's\n  actual HTTPS behavior (tls-rustls, on by default; http-only fail-fast without\n  it), remove the non-existent 'HTTPS-only enforcement' claim, and fix the\n  won't-compile AuthenticationInfo.credentials example (Opt\n[…]\n hardening pass (HTTPS first-class, retry\n  idempotency, single deadline, Retry-After, WS timeout, JSON-RPC response\n  validation, queue-lease lost-work fix, push-config global cap, strict\n  tenancy).",
          "is_bot": false,
          "headline": "docs: correct HTTPS behavior in book/installation; changelog for seco…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-22T18:59:43Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "88abae0e1e9f806108f81904f6bebafe560f5f02",
          "body": "…ush sender\n\n- tls-rustls is now a DEFAULT feature of a2a-protocol-client and\n  a2a-protocol-sdk, so the client reaches https:// agents (the spec-standard\n  transport) out of the box. Opt out with default-features = false.\n- The SDK's tls-rustls now also enables the server's, so the bundled push\n  s\n[…]\n combos.\n\nNote: the live TLS handshake path is not exercised by an end-to-end test here\n(no hermetic HTTPS server in the build env); coverage asserts scheme handling,\nSSRF, and connector construction.",
          "is_bot": false,
          "headline": "feat(https): make TLS first-class — default client feature + server p…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-22T18:59:43Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "10b73a78031c5cb4eadc291ce87f931282e121dc",
          "body": "…rict tenancy\n\n- on_send_message now rejects a QueueLease::Existing (queue already registered\n  for the task) instead of spawning a second executor with NO persistence\n  channel. That old path silently dropped every state transition and push for a\n  resent task (stuck in Submitted) while racing the \n[…]\nrtition. Off by default to preserve the documented resolver contract.\n\nRegression tests added for the lease/has_queue semantics, strict tenancy, the\nglobal push-config cap, and the sqlite count query.",
          "is_bot": false,
          "headline": "fix(server): close queue-lease lost-work race; bound push configs; st…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-22T18:59:43Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3a97cc11d8d59806f6f7ee299c21bf3250c42379",
          "body": "…otency\n\ntypes:\n- JsonRpcResponse gets a hand-written deserializer enforcing JSON-RPC 2.0 §5\n  (exactly one of result/error). A both-present message is rejected instead of\n  being read as success with the error silently dropped; a bad result type now\n  surfaces the real error rather than an opaque \"\n[…]\nf.\n- EventStream gains a first-event timeout; the WebSocket streaming path uses it\n  so a socket that is accepted but never answered fails instead of hanging.\n\nRegression tests added for every change.",
          "is_bot": false,
          "headline": "fix(types,client): validate JSON-RPC responses; gate retries by idemp…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-22T18:59:43Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e04a84abf84070f83548afdb6981ad2ab4ab06c5",
          "body": "- AgentCard.url and TaskState gain doc notes on their gRPC-binding behavior\n  (url is derived from the first interface; unknown enum numbers are rejected,\n  making a future state addition a wire-breaking change) so the constraints are\n  explicit for API consumers and auditors.\n- Cargo.lock: spin 0.9.8 (yanked) -> 0.9.9, resolving the packaging warning.\n  Transitive via sqlx-sqlite; sqlite tests pass unchanged.",
          "is_bot": false,
          "headline": "chore: document gRPC round-trip caveats; unyank spin in lockfile",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-22T18:59:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "dcb9c663084b8a8db29b932e821cd0ae7238ea4c",
          "body": "…ing pass\n\n- book: gRPC transport section now describes the protobuf-native binding\n  (was the removed JSON-in-bytes tunnel); version pins bumped 0.5 -> 0.6;\n  tracing-subscriber pin corrected 0.5 -> 0.3; push-notification security\n  section corrected to reflect the HTTP-only bundled sender.\n- sdk: \n[…]\nurity + additional-hardening entries covering the\n  tenant-isolation, resource-limit, secret-hygiene, lifecycle, and transport\n  fixes in this pass.\n\nAlso applies rustfmt across the hardening changes.",
          "is_bot": false,
          "headline": "docs: correct stale gRPC/version/transport docs; changelog for harden…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-22T18:59:43Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "11bdf9471330d5eca7ec848940caaa82a549b84d",
          "body": "…rden infra\n\n- Tenant isolation: a configured TenantResolver is now actually consulted. It\n  is authoritative (tenant derived from trusted request context); a client-\n  supplied tenant that disagrees is rejected. Previously with_tenant_resolver\n  was a no-op and the client-controlled params.tenant a\n[…]\numented the pluggable-PushSender path for HTTPS delivery.\n\nfix(client): retry jitter uses try_from_secs_f64 to avoid a panic on a\nnear-Duration::MAX backoff config.\n\nRegression tests added throughout.",
          "is_bot": false,
          "headline": "fix(server): enforce tenant isolation, bound push/artifact growth, ha…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-22T18:59:42Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7bd458d29f8a1e5c44c63580c82d147f87104286",
          "body": "… lost work\n\n- Fire-and-forget (return_immediately) sends now spawn the background event\n  processor and a persistence channel, exactly like streaming. Previously the\n  executor's events went to a dropped reader: nothing was persisted, no push\n  fired, and the task was stuck in Submitted forever.\n- \n[…]\n on every cancel of an input-required task. It uses a non-registering\n  writer that still reaches live subscribers when a queue exists.\n\nAdds ServerError::Overloaded and regression tests for each fix.",
          "is_bot": false,
          "headline": "fix(server): harden send/cancel lifecycle against leaks, orphans, and…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-22T18:59:42Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "387dfee93321af991ab796a14e23a0477a163423",
          "body": "…apping\n\nWebSocket:\n- route_frame no longer holds the pending-map mutex across the bounded\n  stream send; a stalled consumer can no longer wedge the whole transport\n  (including unary timeout cleanup).\n- terminal-state detection now recognizes the canonical TASK_STATE_* wire\n  strings (via the domai\n[…]\n, retain the original code\n  under data instead of collapsing to a bare InternalError.\n\nBuilder:\n- the spec binding name 'HTTP+JSON' resolves to the REST transport.\n\nRegression tests added throughout.",
          "is_bot": false,
          "headline": "fix(client): harden WebSocket, SSE, gRPC, REST streaming, and error m…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-22T18:59:42Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "de6989fe2ad3cb21e38f4f4f5e0788e4a00eacf5",
          "body": "…d recursion\n\n- proto convert: replace the saturating `i as f64 as i64 == i` guard with an\n  explicit ±2^53 range check. The round-trip form saturated at the extremes and\n  silently accepted (and corrupted) i64::MAX/i64::MIN/u64::MAX; they are now\n  rejected. Make the encode-accepted integer set exa\n[…]\nk secrets into logs; serialization unchanged.\n- proto docs: correct the module doc claiming domain->proto is infallible From\n  (both directions are fallible TryFrom).\n\nRegression tests added for each.",
          "is_bot": false,
          "headline": "fix(types): harden proto number conversion, redact push secrets, boun…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-22T18:59:42Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4c19a547f9e5c83ac025df4a76d813ad82a64625",
          "body": "Auto-generated by the Benchmarks workflow.\nSource: benches/scripts/generate_book_page.sh, generate_dashboard.sh",
          "is_bot": true,
          "headline": "chore: update benchmark results",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-22T15:25:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "60279b3fb31a2a2ddcf582fc4fa5763ca2b359e7",
          "body": "Protobuf-native gRPC: canonical lf.a2a.v1.A2AService, wire-compatible with the official A2A SDKs",
          "is_bot": false,
          "headline": "Merge pull request #90 from tomtom215/claude/grpc-protobuf-native",
          "author_name": "Tom F",
          "author_login": "tomtom215",
          "committed_at": "2026-07-22T14:06:05Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "441bf82186ad9b13ae9ff53390cc856566145e07",
          "body": "Auto-generated by the Benchmarks workflow.\nSource: benches/scripts/generate_book_page.sh, generate_dashboard.sh",
          "is_bot": true,
          "headline": "chore: update benchmark results",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-22T12:05:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b2afd55fd987b058d074d41e2af84cf62e190d90",
          "body": "Close the remaining interop caveat: wire compatibility is now proven\nagainst the official a2a-sdk (generated lf.a2a.v1 classes on the\nprotobuf-python runtime — an implementation independent of prost), not\njust against the schema file.\n\nA 33-fixture ProtoJSON corpus covers every message with a domain\n[…]\nthe official SDK parses the\nprost-encoded bytes back to the same values.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01QULKD8YZMfCx8Rf1ZMAecW",
          "is_bot": false,
          "headline": "test(tck): golden gRPC wire-compat fixtures from the official Python SDK",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-22T11:26:06Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "7128e9fbecbd287f1ab500509dd3ad5096df22d8",
          "body": "Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01QULKD8YZMfCx8Rf1ZMAecW",
          "is_bot": false,
          "headline": "style(types): collapse task_state_from_i32 signature per rustfmt",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-22T11:12:59Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "f300d122bda42a7c046c9ba077bcdd1af127b02e",
          "body": "RUSTDOCFLAGS='-D warnings' with --all-features failed on a public doc\nlinking the private ring_provider helper (pre-existing; CI's doc job\ndoes not build the tls-rustls docs with warnings denied).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01QULKD8YZMfCx8Rf1ZMAecW",
          "is_bot": false,
          "headline": "docs(client): fix rustdoc link to private item in tls module",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-22T11:12:58Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "e62e27a8484d20eb6006c79425bec90b315bef03",
          "body": "Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01QULKD8YZMfCx8Rf1ZMAecW",
          "is_bot": false,
          "headline": "docs: ADR 0009 (protobuf-native gRPC) + changelog",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-22T11:11:29Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "34aed2f7e895be5264fbd32b666be794b7c045e8",
          "body": "grpc_e2e drives a served GrpcDispatcher through the high-level A2aClient\non the canonical binding: unary round-trips, error-code mapping\n(TaskNotFound, TaskNotCancelable), push-config CRUD, and streaming to a\nterminal state. grpc_legacy_coexistence (feature grpc-legacy-json)\nhand-rolls a 0.6-style J\n[…]\n proves both bindings\nshare one listener with tasks visible across them.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01QULKD8YZMfCx8Rf1ZMAecW",
          "is_bot": false,
          "headline": "test(sdk): gRPC e2e over real sockets + 0.6 tunnel coexistence proof",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-22T11:11:29Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "2329ee7269d52c34d996871ce400ab69cc5b3196",
          "body": "…rvice\n\nGrpcTransport now dials /lf.a2a.v1.A2AService/* with typed protobuf\nmessages: JSON params from the client core convert to prost requests per\nmethod, and typed responses (including streaming StreamResponse events)\nconvert back through the shared conversion layer. Conversion failures\nsurface a\n[…]\nd — servers keep 0.6 clients working via their grpc-legacy-json\nfeature.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01QULKD8YZMfCx8Rf1ZMAecW",
          "is_bot": false,
          "headline": "feat(client): protobuf-native GrpcTransport speaking the canonical se…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-22T11:11:17Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "49ebdce18ed53238369b8fcb059d9949e333650d",
          "body": "GrpcDispatcher now serves the protobuf-native A2A binding — typed\nrequests convert to the same domain params the JSON-RPC and REST\ndispatchers feed into RequestHandler, making the gRPC endpoint\nwire-compatible with the official Go/Python/Java SDKs. The pre-0.7\nJSON-in-bytes tunnel service (a2a.v1.A2\n[…]\nents\nsurvive rolling upgrades. Removal of the tunnel is planned for 0.8.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01QULKD8YZMfCx8Rf1ZMAecW",
          "is_bot": false,
          "headline": "feat(server): serve canonical lf.a2a.v1.A2AService over gRPC",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-22T11:11:17Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "bc8d6a9b03abe93cc637eaedec1bc6ac1db202e5",
          "body": "…n layer\n\nGenerate the canonical A2A v1.0 protobuf messages with prost behind a new\n'proto' feature, keeping proto/a2a_v1/a2a.proto byte-identical to the\nspecification copy (google/api option imports vendored as minimal stubs;\noptions carry no wire-format significance). Hand-written TryFrom\nconversi\n[…]\ns that\npush arbitrary domain values through real encoded protobuf bytes.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01QULKD8YZMfCx8Rf1ZMAecW",
          "is_bot": false,
          "headline": "feat(types): canonical lf.a2a.v1 protobuf messages + domain conversio…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-22T11:11:06Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "8c4dfa392fcdcbf5f9dcacadfefe6255bfbc1978",
          "body": "…-xej5qp\n\nProtocol audit fixes: push config optionality, JSON-RPC null id, rate limiter hardening, response caps, RFC 8785 edge cases",
          "is_bot": false,
          "headline": "Merge pull request #89 from tomtom215/claude/a2a-protocol-audit-fixes…",
          "author_name": "Tom F",
          "author_login": "tomtom215",
          "committed_at": "2026-07-22T10:40:46Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1a7191c415035fed02540aadb545e3f6deeb3478",
          "body": "Auto-generated by the Benchmarks workflow.\nSource: benches/scripts/generate_book_page.sh, generate_dashboard.sh",
          "is_bot": true,
          "headline": "chore: update benchmark results",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-22T09:43:03Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8a98556548edd94aca9e91b7906250dd9b207c3f",
          "body": "Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01QULKD8YZMfCx8Rf1ZMAecW",
          "is_bot": false,
          "headline": "style(types): backtick SendMessageConfiguration in push doc comment",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-22T09:35:00Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "e275b34eac637d67f5017965cea366348e04be61",
          "body": "…tting\n\ncanonicalize_float_no_trailing_zeros pinned the pre-fix serde_json\nrendering (10.0 -> \"10.0\"); RFC 8785 §3.2.2 requires the ECMAScript\nform \"10\", which the canonicalization fix now produces.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01QULKD8YZMfCx8Rf1ZMAecW",
          "is_bot": false,
          "headline": "test(types): align signing test with RFC 8785 ECMAScript number forma…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-22T09:27:15Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "14e2e36a5da375a5621992d362f4cb884e1c4953",
          "body": "Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01QULKD8YZMfCx8Rf1ZMAecW",
          "is_bot": false,
          "headline": "docs: add Unreleased changelog entries for audit fixes",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-22T09:24:13Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "447ddaaaa9435ea352e9638aad47bbf332db6327",
          "body": "max_concurrent_streams previously defaulted to None (unlimited): every\nstreaming request eagerly allocates channels and spawns two background\ntasks, so an unauthenticated caller on the default path could grow server\nmemory and task count without bound (D4). The default is now\nDEFAULT_MAX_CONCURRENT_\n[…]\ntion guide\nnow document the recommendation to always set one explicitly.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01QULKD8YZMfCx8Rf1ZMAecW",
          "is_bot": false,
          "headline": "fix(server): cap concurrent streams at 1024 by default (DoS hardening)",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-22T09:23:41Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "1642dce5a66e73983545b8c1a42e89fe1119fa98",
          "body": "… request id)\n\nJsonRpcRequest.id was Option<Value> with skip-when-None serialization, so\nan explicit {\"id\": null} request deserialized to None and re-serialized\nWITHOUT the id member — collapsing a null-id *call* into a *notification*\n(confirmed empirically). Per JSON-RPC 2.0 only an ABSENT id is a\n\n[…]\nn, websocket suites green, TCK 20/20\non both JSON-RPC and REST bindings.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01QULKD8YZMfCx8Rf1ZMAecW",
          "is_bot": false,
          "headline": "fix(types): preserve explicit JSON-RPC null id as a call (three-state…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-22T09:21:00Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "958b6a983ff5409f99b4cdbc4dab38ff55e0eaa6",
          "body": "…chema\n\nThe canonical protocol schema marks AuthenticationInfo.credentials and\nTaskPushNotificationConfig.taskId optional, but both were required String\nfields — spec-compliant JSON was rejected at the parse layer (confirmed:\n{\"scheme\":\"Bearer\"} failed with 'missing field credentials'; a push\nconfig\n[…]\nent/types suites green and TCK 20/20 on both\nJSON-RPC and REST bindings.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01QULKD8YZMfCx8Rf1ZMAecW",
          "is_bot": false,
          "headline": "fix(types): make push credentials and taskId optional per canonical s…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-22T09:09:34Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "125809c95ce99035a92f1d2b9a20acc80c404037",
          "body": "Unary responses in the JSON-RPC and REST transports were collected with\nresp.collect() and no size cap — bounded only by the request timeout, so a\nhostile or buggy server could stream an arbitrarily large body into client\nmemory (confirmed: a 40 MiB unary response was fully buffered and parsed).\n\nBu\n[…]\nror; genuine body I/O\nfailures keep their retryable Http classification.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01QULKD8YZMfCx8Rf1ZMAecW",
          "is_bot": false,
          "headline": "fix(client): cap buffered response bodies (32 MiB default, configurable)",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-22T08:55:21Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "64f072ad6b857ac88749f53adeb7bdf42e76e147",
          "body": "…ation edge cases\n\nTwo spec-conformance edge cases (D7):\n\n- Part: a JSON object carrying more than one content member (e.g.\n  {\"text\":...,\"raw\":...}) was silently coalesced — the deserializer took\n  the first match in text > raw > url > data order and dropped the rest\n  (confirmed empirically). Ambi\n[…]\nill produce/verify different signature\n  bytes — that is the correction.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01QULKD8YZMfCx8Rf1ZMAecW",
          "is_bot": false,
          "headline": "fix(types): reject ambiguous Part content; align RFC 8785 canonicaliz…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-22T08:47:14Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "410b2bc8cbc846f758eab5186daf187267f6219f",
          "body": "…ed-out client requests\n\nTwo defects in the opt-in websocket feature (D6):\n\n- Server: the intended 4 MiB message cap was checked only after tungstenite\n  had fully buffered the message, so the effective cap was tungstenite's\n  64 MiB default (confirmed: a 5 MiB frame was assembled in memory and\n  an\n[…]\noves the entry on timeout; regression test\n  fails before, passes after.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01QULKD8YZMfCx8Rf1ZMAecW",
          "is_bot": false,
          "headline": "fix(websocket): enforce 4 MiB cap at protocol level; stop leaking tim…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-22T08:41:11Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "8e8d6b5fe98f0e8fc730389d5e9a603164d11196",
          "body": "…ded map, div-by-zero\n\nThree defects in the opt-in rate limiter (D3):\n\n- Caller identity was derived from the client-controlled X-Forwarded-For\n  header with no trust configuration, so any caller could evade the limit\n  by forging a fresh address per request (each forged value minted its own\n  bucke\n[…]\nuse\n..RateLimitConfig::default() in literals) and new() is now fallible.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01QULKD8YZMfCx8Rf1ZMAecW",
          "is_bot": false,
          "headline": "fix(server): harden RateLimitInterceptor — spoofable identity, unboun…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-22T08:32:08Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "2a9880bafc46663276c4932d3a5d598003851bfb",
          "body": "…n-jjjsrj\n\nSecurity, robustness & interop hardening",
          "is_bot": false,
          "headline": "Merge pull request #88 from tomtom215/claude/rust-sdk-linux-foundatio…",
          "author_name": "Tom F",
          "author_login": "tomtom215",
          "committed_at": "2026-07-22T08:16:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b4569c33973d823308d792d396351ad0bc583b21",
          "body": "The mutation-testing sweep surfaced two survivors in the SSRF fix, both\nbecause the primitives were only exercised through `validate_webhook_url`,\nwhich masks their boundaries:\n\n- `is_private_v4`: the CGNAT check ANDs two octet tests, but no test\n  distinguished `&&` from `||` (100.64.0.0/10 address\n[…]\nts were confirmed\nkilled by hand (apply mutation -> the new test fails).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01B71ajz5r5jkXbRra3tagKC",
          "is_bot": false,
          "headline": "test(server): pin SSRF private-range primitives (kill surviving mutants)",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-22T07:43:07Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "7ef67cd54cecd76b59eac4311737aecde450b904",
          "body": "Pure `cargo fmt` reflow of the lines touched by the preceding fixes so the\nFormat CI gate passes. No behavior change.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01B71ajz5r5jkXbRra3tagKC",
          "is_bot": false,
          "headline": "style: apply rustfmt to the audit-pass changes",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-22T07:00:30Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "ae142f2f88013499202ca4ea9567cc9f0b1b22a9",
          "body": "`cargo deny check advisories` flagged RUSTSEC-2026-0204: an invalid pointer\ndereference in the `fmt::Display` impl for crossbeam-epoch's `Atomic`/`Shared`\nwhen the pointer is null/invalid. It reaches the tree only transitively\nthrough `criterion` (benchmark/dev tooling), not the published library\nde\n[…]\nthe workspace builds with `--all-features` and the advisory gate\npasses.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01B71ajz5r5jkXbRra3tagKC",
          "is_bot": false,
          "headline": "chore(deps): bump crossbeam-epoch to 0.9.20 (RUSTSEC-2026-0204)",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-21T22:32:03Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "29776d3cb7fc305caa3bea5fd8ed8f65ddd5cd79",
          "body": "`cap_backoff` guarded only against non-finite and negative products before\ncalling `Duration::from_secs_f64`, which also panics on a finite value that\noverflows `Duration` (above ~1.8e19 s) — reachable from a retry policy with\na near-`Duration::MAX` backoff and a multiplier >= 2. The doc comment\ncla\n[…]\n, clamping all of them to `max`. Adds a\nfinite-overflow regression test.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01B71ajz5r5jkXbRra3tagKC",
          "is_bot": false,
          "headline": "fix(client): avoid panic on finite Duration overflow in backoff cap",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-21T22:27:42Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "e4d07e7f172a9350bf9f357c12508d0b1df1adef",
          "body": "Agent-card discovery checked Content-Length up front but then read the body\nwith an unbounded `resp.collect()`, enforcing the 2 MiB cap only after the\nwhole body was in memory. A hostile or compromised card endpoint that omits\nContent-Length (chunked / close-delimited) bypassed the pre-check and cou\n[…]\nl::Limited` so the cap is enforced while\nreading, regardless of framing.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01B71ajz5r5jkXbRra3tagKC",
          "is_bot": false,
          "headline": "fix(client): bound agent-card response size during streaming",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-21T22:27:42Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "3c963ba575bcbdcebf5d02d33aecd7d70b05fe4b",
          "body": "`canonicalize_card` serialized the whole card, including `signatures`, into\nthe bytes that signatures are computed over. A signed card is served on the\nwire with its `signatures` array populated, so verifying that served card\nrecomputed the canonical form *with* the signatures present and failed —\nv\n[…]\ntures\npopulated) shape; the existing tamper-detection test still passes.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01B71ajz5r5jkXbRra3tagKC",
          "is_bot": false,
          "headline": "fix(types): exclude signatures field from agent-card canonicalization",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-21T22:27:30Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "9bdbdec895d0ec594d297a428dc204e2879fd753",
          "body": "`serve` propagated any `accept()` error with `?` and `serve_with_addr`\n`break`s on it, so a transient, per-connection failure permanently killed\nthe accept loop. The common case is file-descriptor exhaustion (`EMFILE`/\n`ENFILE`): once the fd table momentarily fills, the next `accept()` errors,\nthe l\n[…]\npt_retry_backoff` helper isolates the classification and is unit-tested.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01B71ajz5r5jkXbRra3tagKC",
          "is_bot": false,
          "headline": "fix(server): keep the accept loop alive across transient accept() errors",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-21T22:27:22Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "f440ff8e89af66baeb9a9a421261f9628a906586",
          "body": "The Axum adapter stored `DispatchConfig` but never applied\n`max_request_body_size`, so the `Bytes` extractor fell back to Axum's\ndefault `DefaultBodyLimit` (2 MiB). A caller that raised or lowered the\nconfigured limit silently got Axum's default instead — the knob was a no-op\non this transport while\n[…]\n13, and one under the cap succeeds — verified to\nfail without the layer.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01B71ajz5r5jkXbRra3tagKC",
          "is_bot": false,
          "headline": "fix(server): honor max_request_body_size on the Axum transport",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-21T22:27:15Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "78edfe1cff03ac24595e764a04c28e8673761510",
          "body": "`is_private_ip` only inspected native IPv4 and native IPv6 ranges, so an\nIPv4 address smuggled inside IPv6 slipped through: `Ipv6Addr::is_loopback`\nmatches only `::1`, so `::ffff:127.0.0.1`, `::ffff:169.254.169.254`\n(cloud metadata), and `::ffff:10.0.0.1` all read as \"public\". Dual-stack\nsockets dia\n[…]\nwed. Applies to both the literal-IP and DNS-resolution validation paths.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01B71ajz5r5jkXbRra3tagKC",
          "is_bot": false,
          "headline": "fix(server): close SSRF bypass via IPv4-in-IPv6 webhook URLs",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-21T22:27:08Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "7ef8daa47a4e697bae5ac1a892cd964c05ee9e29",
          "body": "`read_body_limited` (JSON-RPC and REST) buffered the entire request body\nvia `.collect()` before comparing its length to `max_request_body_size`.\nThe upfront `size_hint.upper()` guard only fires when the client sends a\nContent-Length, so a chunked or HTTP/2 request (no advertised length)\nbypassed it\n[…]\ntly (\"too large\") instead of the\nrequest hanging until the read timeout.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01B71ajz5r5jkXbRra3tagKC",
          "is_bot": false,
          "headline": "fix(server): enforce request-body size limit during streaming",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-07-21T22:26:58Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "e5cf2afe5ab1b41418dd8eca1bba87b47a5584fc",
          "body": "Auto-generated by the Benchmarks workflow.\nSource: benches/scripts/generate_book_page.sh, generate_dashboard.sh",
          "is_bot": true,
          "headline": "chore: update benchmark results",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-06-10T23:07:32Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "319c79f6675a26d5a8884c3dc1ba35b328cdac4c",
          "body": "…fmhz\n\nv0.6.0: fix six E2E-proven library bugs, flagship incident-response example, release-gate hardening",
          "is_bot": false,
          "headline": "Merge pull request #86 from tomtom215/claude/compassionate-pasteur-pu…",
          "author_name": "Tom F",
          "author_login": "tomtom215",
          "committed_at": "2026-06-10T21:42:36Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1e79b908251c9bccf9c3d41ef8c3c29a76e19422",
          "body": "…dify the policy\n\nA workspace-wide inventory of every time::sleep in test code, classified\nby purpose. Production timing code (retry backoff, SSE keepalive,\nshutdown polling), simulated work inside test executors, select! timeout\nguards, and TTL-expiry sleeps (sound by construction: sleep's\nminimum-\n[…]\nserting async state.\n\nVerified: 15 consecutive iterations of the four touched suites with zero\nfailures; full server suite green; clippy clean.\n\nhttps://claude.ai/code/session_01M4zgREzD7kemd5CAy2iHh2",
          "is_bot": false,
          "headline": "test(server): eliminate the remaining fixed-sleep synchronization; co…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-06-10T21:06:55Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b48863980e161f7ef7f78933898cf214d87d2119",
          "body": "…gate catch\n\nThe benchmark Regression Gate flagged\ntransport_payload_scaling/jsonrpc_send/1048576 at +95.78% median\n(95% CI [+93.88%, +98.69%] — far too tight to be runner noise), scaling\nwith payload size (+14% at 100 KiB, +4% at 4 KiB). Root cause: the\nTask.history fix made send responses carry th\n[…]\nhs end-to-end through on_send_message. 2,152 workspace tests passing,\nclippy clean; the gate re-runs on this push as the authoritative verdict.\n\nhttps://claude.ai/code/session_01M4zgREzD7kemd5CAy2iHh2",
          "is_bot": false,
          "headline": "fix(server): send responses no longer echo history back — regression-…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-06-10T20:58:51Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4489c66a71621b6fe97b7a477d659cb515ed277a",
          "body": "…e version pin, stale counts\n\nFull-file review found:\n\n- The Quick Start client snippet matched #[non_exhaustive] StreamResponse\n  with no wildcard arm — it cannot compile outside this workspace. Added\n  the catch-all with a comment, since this is the first code a user\n  copies. (The other snippet c\n[…]\n readers);\n  the status paragraph and plan link remain.\n- Clarified the Motivation line about community samples ('Rust is absent\n  there too').\n\nhttps://claude.ai/code/session_01M4zgREzD7kemd5CAy2iHh2",
          "is_bot": false,
          "headline": "docs(readme): line-by-line review — fix a non-compiling snippet, stal…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-06-10T20:13:56Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5283c78db8b3acc2fd8e4bf6a5376698c9f541b3",
          "body": "…ay server sharding\n\nThree compounding optimizations for the mutation gates, all measured:\n\n1. --test-tool=nextest: the server crate's ~30 test binaries run in\n   parallel with run-wide fail-fast, so CAUGHT mutants die at the first\n   failing test instead of after a serial cargo-test pass. (Caveat n\n[…]\ns\n64s + 83s before (~1.8x on the dominant per-mutant cost), mutant still\ncaught. Expected full-sweep wall-clock: ~2h down to roughly 30-40 min.\n\nhttps://claude.ai/code/session_01M4zgREzD7kemd5CAy2iHh2",
          "is_bot": false,
          "headline": "ci(mutants): ~4x faster sweeps — nextest, debuginfo-free profile, 8-w…",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-06-10T20:12:28Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e17fe792f55a194eac52cd4ef5a17b4d82f06b95",
          "body": "Qwen2.5-0.5B-Instruct read as dated for docs positioning this as a\ncurrent stack. Evaluated the newest options empirically: Qwen3.5-0.8B\n(Feb 2026, Apache-2.0) is a thinking-first model whose completions\narrive in reasoning_content with empty content even with the reasoning\nbudget zeroed — wrong fit\n[…]\nserver: input-required pause, multi-turn\nresume with delegation, cancellation — all green, with a visibly\nstronger synthesized incident report.\n\nhttps://claude.ai/code/session_01M4zgREzD7kemd5CAy2iHh2",
          "is_bot": false,
          "headline": "examples+docs: switch the local-model reference to Qwen3-0.6B",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-06-10T19:57:36Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "39173d4a49e6810da7c0c2905af66240094cc2a2",
          "body": "The codecov-action verifies its downloaded CLI against Codecov's public\nkey before running. That key is currently unobtainable everywhere — the\nkeybase identity returns 'SELF-SIGNED PUBLIC KEY NOT FOUND',\ncli.codecov.io/pgp_keys.asc 404s, and the fingerprint\n(27034E7FDB850E0BBC2C62FF806BB28AED779869\n[…]\ne key, at which point the line\nshould be deleted so fail_ci_if_error regains teeth. Weakening\nvalidation itself (skip_validation) was rejected.\n\nhttps://claude.ai/code/session_01M4zgREzD7kemd5CAy2iHh2",
          "is_bot": false,
          "headline": "ci(coverage): tolerate the Codecov key-distribution outage, temporarily",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-06-10T19:41:10Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "eceafe2aedf4194e74f753d64359dae572356368",
          "body": "Promote the unreleased section to '## [0.6.0] - 2026-06-10'. Minor (not\npatch) bump: no public API signatures changed, but observable behavior\ndid — Task.history is now populated in responses, streaming disconnects\nno longer cancel running tasks, and Working → Working status refreshes\nare accepted. \n[…]\nated changelog heading, CITATION version+date, SECURITY coverage, and\ncrate-version/tag consistency. Workspace: 2,151 tests passing, fmt\nclean.\n\nhttps://claude.ai/code/session_01M4zgREzD7kemd5CAy2iHh2",
          "is_bot": false,
          "headline": "release: prepare v0.6.0",
          "author_name": "Claude",
          "author_login": "claude",
          "committed_at": "2026-06-10T19:29:07Z",
          "body_truncated": true,
          "is_coding_agent": false
        }
      ],
      "releases_count": 10,
      "commits_last_year": 608,
      "latest_release_at": "2026-07-24T11:52:39Z",
      "latest_release_tag": "v0.7.0",
      "releases_from_tags": false,
      "days_since_last_push": 1,
      "active_weeks_last_year": 8,
      "days_since_latest_release": 1,
      "mean_days_between_releases": 14.5
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": true,
      "health_percentage": 71,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "a2a-protocol-sdk",
          "exists": true,
          "license": "Apache-2.0",
          "keywords": [
            "a2a",
            "agent",
            "agent2agent",
            "ai",
            "protocol",
            "network-programming",
            "api-bindings",
            "web-programming"
          ],
          "ecosystem": "crates",
          "matches_repo": true,
          "registry_url": "https://crates.io/crates/a2a-protocol-sdk",
          "is_deprecated": false,
          "latest_version": "0.7.0",
          "repository_url": "https://github.com/tomtom215/a2a-rust",
          "versions_count": 10,
          "total_downloads": 643,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": 152,
          "first_published_at": "2026-03-16T00:52:34.993254Z",
          "latest_published_at": "2026-07-24T12:09:36.303614Z",
          "latest_version_yanked": false,
          "days_since_latest_publish": 1
        },
        {
          "name": "a2a-protocol-types",
          "exists": true,
          "license": "Apache-2.0",
          "keywords": [
            "a2a",
            "agent",
            "agent2agent",
            "protocol",
            "types",
            "api-bindings"
          ],
          "ecosystem": "crates",
          "matches_repo": true,
          "registry_url": "https://crates.io/crates/a2a-protocol-types",
          "is_deprecated": false,
          "latest_version": "0.7.0",
          "repository_url": "https://github.com/tomtom215/a2a-rust",
          "versions_count": 10,
          "total_downloads": 10024,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": 3190,
          "first_published_at": "2026-03-16T00:51:01.829154Z",
          "latest_published_at": "2026-07-24T12:09:01.142153Z",
          "latest_version_yanked": false,
          "days_since_latest_publish": 1
        },
        {
          "name": "a2a-protocol-client",
          "exists": true,
          "license": "Apache-2.0",
          "keywords": [
            "a2a",
            "agent",
            "agent2agent",
            "client",
            "protocol",
            "network-programming",
            "web-programming"
          ],
          "ecosystem": "crates",
          "matches_repo": true,
          "registry_url": "https://crates.io/crates/a2a-protocol-client",
          "is_deprecated": false,
          "latest_version": "0.7.0",
          "repository_url": "https://github.com/tomtom215/a2a-rust",
          "versions_count": 10,
          "total_downloads": 752,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": 173,
          "first_published_at": "2026-03-16T00:51:48.127295Z",
          "latest_published_at": "2026-07-24T12:09:29.807653Z",
          "latest_version_yanked": false,
          "days_since_latest_publish": 1
        },
        {
          "name": "a2a-protocol-server",
          "exists": true,
          "license": "Apache-2.0",
          "keywords": [
            "a2a",
            "agent",
            "agent2agent",
            "protocol",
            "server",
            "network-programming",
            "web-programming"
          ],
          "ecosystem": "crates",
          "matches_repo": true,
          "registry_url": "https://crates.io/crates/a2a-protocol-server",
          "is_deprecated": false,
          "latest_version": "0.7.0",
          "repository_url": "https://github.com/tomtom215/a2a-rust",
          "versions_count": 10,
          "total_downloads": 800,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": 182,
          "first_published_at": "2026-03-16T00:51:57.673763Z",
          "latest_published_at": "2026-07-24T12:09:16.436824Z",
          "latest_version_yanked": false,
          "days_since_latest_publish": 1
        }
      ]
    },
    "popularity": {
      "forks": 0,
      "stars": 19,
      "watchers": 1,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 0
      },
      "star_history": null,
      "open_issues_and_prs": 0
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [
        "example",
        "examples"
      ],
      "has_llms_txt": false,
      "has_dockerfile": true,
      "has_mcp_signal": false,
      "bootstrap_files": [],
      "api_schema_files": [
        "crates/a2a-protocol-client/proto/a2a_v1/a2a.proto",
        "crates/a2a-protocol-client/proto/a2a_v1/google/api/annotations.proto",
        "crates/a2a-protocol-client/proto/a2a_v1/google/api/client.proto",
        "crates/a2a-protocol-client/proto/a2a_v1/google/api/field_behavior.proto",
        "crates/a2a-protocol-client/proto/a2a_v1/google/api/http.proto",
        "crates/a2a-protocol-server/proto/a2a.proto",
        "crates/a2a-protocol-server/proto/a2a_v1/a2a.proto",
        "crates/a2a-protocol-server/proto/a2a_v1/google/api/annotations.proto",
        "crates/a2a-protocol-server/proto/a2a_v1/google/api/client.proto",
        "crates/a2a-protocol-server/proto/a2a_v1/google/api/field_behavior.proto",
        "crates/a2a-protocol-server/proto/a2a_v1/google/api/http.proto",
        "crates/a2a-protocol-types/proto/a2a_v1/a2a.proto",
        "crates/a2a-protocol-types/proto/a2a_v1/google/api/annotations.proto",
        "crates/a2a-protocol-types/proto/a2a_v1/google/api/client.proto",
        "crates/a2a-protocol-types/proto/a2a_v1/google/api/field_behavior.proto",
        "crates/a2a-protocol-types/proto/a2a_v1/google/api/http.proto",
        "docs/implementation/a2a.proto",
        "itk/protos/instruction.proto",
        "proto/a2a.proto",
        "proto/a2a_v1/a2a.proto",
        "proto/a2a_v1/google/api/annotations.proto",
        "proto/a2a_v1/google/api/client.proto",
        "proto/a2a_v1/google/api/field_behavior.proto",
        "proto/a2a_v1/google/api/http.proto"
      ],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [
        "Cargo.toml",
        "benches/Cargo.toml",
        "crates/a2a-protocol-client/Cargo.toml",
        "crates/a2a-protocol-sdk/Cargo.toml",
        "crates/a2a-protocol-server/Cargo.toml",
        "crates/a2a-protocol-types/Cargo.toml",
        "examples/agent-team/Cargo.toml",
        "examples/echo-agent/Cargo.toml",
        "examples/genai-agent/Cargo.toml",
        "examples/incident-response/Cargo.toml",
        "examples/multi-lang-team/Cargo.toml",
        "examples/rig-agent/Cargo.toml",
        "fuzz/Cargo.toml",
        "itk/Cargo.toml",
        "itk/agents/go-agent/go.mod",
        "itk/agents/go-sdk/go.mod",
        "itk/agents/java-agent/pom.xml",
        "itk/agents/java-sdk/pom.xml",
        "tck/Cargo.toml"
      ],
      "largest_source_bytes": 78192,
      "source_files_sampled": 316,
      "oversized_source_files": 3,
      "agent_instruction_files": [],
      "agent_instruction_max_bytes": null
    },
    "dependencies": {
      "manifests": [
        "Cargo.toml",
        "benches/Cargo.toml",
        "fuzz/Cargo.toml",
        "itk/Cargo.toml",
        "tck/Cargo.toml"
      ],
      "advisories": {
        "error": null,
        "scope": null,
        "source": null,
        "findings": [],
        "collected": false,
        "malicious": [],
        "truncated": false,
        "by_severity": {},
        "advisory_count": 0,
        "affected_count": 0,
        "assessed_count": 0,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "crates"
      ],
      "dependencies": [
        {
          "name": "a2a-protocol-types",
          "manifest": "benches/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "a2a-protocol-client",
          "manifest": "benches/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "a2a-protocol-server",
          "manifest": "benches/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "criterion",
          "manifest": "benches/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "tokio",
          "manifest": "benches/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "hyper",
          "manifest": "benches/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "http-body-util",
          "manifest": "benches/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "hyper-util",
          "manifest": "benches/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "bytes",
          "manifest": "benches/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "1"
        },
        {
          "name": "socket2",
          "manifest": "benches/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.6"
        },
        {
          "name": "serde",
          "manifest": "benches/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde_json",
          "manifest": "benches/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "uuid",
          "manifest": "benches/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "a2a-protocol-types",
          "manifest": "itk/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "a2a-protocol-server",
          "manifest": "itk/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "a2a-protocol-client",
          "manifest": "itk/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "tokio",
          "manifest": "itk/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": ">=1.47.1, <2"
        },
        {
          "name": "serde_json",
          "manifest": "itk/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": ">=1.0.145, <2"
        },
        {
          "name": "hyper",
          "manifest": "itk/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": ">=1.7.0, <2"
        },
        {
          "name": "hyper-util",
          "manifest": "itk/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": ">=0.1.17, <0.2"
        },
        {
          "name": "prost",
          "manifest": "itk/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": ">=0.14.1, <0.15"
        },
        {
          "name": "base64",
          "manifest": "itk/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.22"
        },
        {
          "name": "a2a-protocol-types",
          "manifest": "tck/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "a2a-protocol-client",
          "manifest": "tck/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde_json",
          "manifest": "tck/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde",
          "manifest": "tck/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "tokio",
          "manifest": "tck/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "hyper",
          "manifest": "tck/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "hyper-util",
          "manifest": "tck/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "http-body-util",
          "manifest": "tck/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "uuid",
          "manifest": "tck/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "a2a-protocol-types",
          "manifest": "crates/a2a-protocol-client/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.7.0"
        },
        {
          "name": "serde",
          "manifest": "crates/a2a-protocol-client/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde_json",
          "manifest": "crates/a2a-protocol-client/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "base64",
          "manifest": "crates/a2a-protocol-client/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.22"
        },
        {
          "name": "hyper",
          "manifest": "crates/a2a-protocol-client/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "http-body-util",
          "manifest": "crates/a2a-protocol-client/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "hyper-util",
          "manifest": "crates/a2a-protocol-client/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "tokio",
          "manifest": "crates/a2a-protocol-client/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "uuid",
          "manifest": "crates/a2a-protocol-client/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "tracing",
          "manifest": "crates/a2a-protocol-client/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "tokio-tungstenite",
          "manifest": "crates/a2a-protocol-client/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": ">=0.29, <0.30"
        },
        {
          "name": "futures-util",
          "manifest": "crates/a2a-protocol-client/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": ">=0.3.30, <0.4"
        },
        {
          "name": "hyper-rustls",
          "manifest": "crates/a2a-protocol-client/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": ">=0.27, <0.28"
        },
        {
          "name": "rustls",
          "manifest": "crates/a2a-protocol-client/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": ">=0.23, <0.24"
        },
        {
          "name": "rustls-pki-types",
          "manifest": "crates/a2a-protocol-client/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": ">=1.7, <2"
        },
        {
          "name": "webpki-roots",
          "manifest": "crates/a2a-protocol-client/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": ">=1.0, <2"
        },
        {
          "name": "tonic",
          "manifest": "crates/a2a-protocol-client/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "tonic-prost",
          "manifest": "crates/a2a-protocol-client/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "tonic-types",
          "manifest": "crates/a2a-protocol-client/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "prost",
          "manifest": "crates/a2a-protocol-client/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "tokio-stream",
          "manifest": "crates/a2a-protocol-client/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "a2a-protocol-types",
          "manifest": "crates/a2a-protocol-sdk/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.7.0"
        },
        {
          "name": "a2a-protocol-client",
          "manifest": "crates/a2a-protocol-sdk/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.7.0"
        },
        {
          "name": "a2a-protocol-server",
          "manifest": "crates/a2a-protocol-sdk/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.7.0"
        },
        {
          "name": "a2a-protocol-types",
          "manifest": "crates/a2a-protocol-server/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.7.0"
        },
        {
          "name": "serde",
          "manifest": "crates/a2a-protocol-server/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde_json",
          "manifest": "crates/a2a-protocol-server/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "hyper",
          "manifest": "crates/a2a-protocol-server/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "http-body-util",
          "manifest": "crates/a2a-protocol-server/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "hyper-util",
          "manifest": "crates/a2a-protocol-server/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "tokio",
          "manifest": "crates/a2a-protocol-server/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "uuid",
          "manifest": "crates/a2a-protocol-server/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "bytes",
          "manifest": "crates/a2a-protocol-server/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "1"
        },
        {
          "name": "tokio-util",
          "manifest": "crates/a2a-protocol-server/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": ">=0.7, <0.8"
        },
        {
          "name": "tracing",
          "manifest": "crates/a2a-protocol-server/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "hyper-rustls",
          "manifest": "crates/a2a-protocol-server/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": ">=0.27, <0.28"
        },
        {
          "name": "rustls",
          "manifest": "crates/a2a-protocol-server/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": ">=0.23, <0.24"
        },
        {
          "name": "rustls-pki-types",
          "manifest": "crates/a2a-protocol-server/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": ">=1.7, <2"
        },
        {
          "name": "webpki-roots",
          "manifest": "crates/a2a-protocol-server/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": ">=1.0, <2"
        },
        {
          "name": "ring",
          "manifest": "crates/a2a-protocol-server/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.17"
        },
        {
          "name": "base64",
          "manifest": "crates/a2a-protocol-server/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.22"
        },
        {
          "name": "sqlx",
          "manifest": "crates/a2a-protocol-server/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "tokio-tungstenite",
          "manifest": "crates/a2a-protocol-server/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": ">=0.29, <0.30"
        },
        {
          "name": "futures-util",
          "manifest": "crates/a2a-protocol-server/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": ">=0.3.30, <0.4"
        },
        {
          "name": "tonic",
          "manifest": "crates/a2a-protocol-server/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "tonic-prost",
          "manifest": "crates/a2a-protocol-server/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "tonic-types",
          "manifest": "crates/a2a-protocol-server/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "prost",
          "manifest": "crates/a2a-protocol-server/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "tokio-stream",
          "manifest": "crates/a2a-protocol-server/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "opentelemetry",
          "manifest": "crates/a2a-protocol-server/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.31"
        },
        {
          "name": "opentelemetry_sdk",
          "manifest": "crates/a2a-protocol-server/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.31"
        },
        {
          "name": "opentelemetry-otlp",
          "manifest": "crates/a2a-protocol-server/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.31"
        },
        {
          "name": "axum",
          "manifest": "crates/a2a-protocol-server/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.8"
        },
        {
          "name": "serde",
          "manifest": "crates/a2a-protocol-types/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "serde_json",
          "manifest": "crates/a2a-protocol-types/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "base64",
          "manifest": "crates/a2a-protocol-types/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.22"
        },
        {
          "name": "ring",
          "manifest": "crates/a2a-protocol-types/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.17"
        },
        {
          "name": "prost",
          "manifest": "crates/a2a-protocol-types/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "prost-types",
          "manifest": "crates/a2a-protocol-types/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        },
        {
          "name": "time",
          "manifest": "crates/a2a-protocol-types/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": null
        }
      ],
      "all_dependencies": {
        "error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
        "source": null,
        "packages": [],
        "collected": false,
        "truncated": false,
        "total_count": null,
        "direct_count": null,
        "indirect_count": null
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 91,
        "open_issues": 0,
        "closed_ratio": 1,
        "closed_issues": 1,
        "closed_unmerged_prs": 0
      },
      "bus_factor": 1,
      "bot_contributors": 1,
      "top_contributors": [
        {
          "type": "User",
          "login": "claude",
          "commits": 478,
          "avatar_url": "https://avatars.githubusercontent.com/u/81847?v=4"
        },
        {
          "type": "User",
          "login": "tomtom215",
          "commits": 107,
          "avatar_url": "https://avatars.githubusercontent.com/u/4908716?v=4"
        }
      ],
      "contributors_sampled": 2,
      "top_contributor_share": 0.817
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "benchmarks.yml",
        "ci.yml",
        "coverage.yml",
        "docs.yml",
        "fuzz.yml",
        "itk.yml",
        "mutants.yml",
        "release.yml",
        "tck.yml"
      ],
      "has_docs_dir": true,
      "linter_configs": [],
      "has_editorconfig": false,
      "has_linter_config": false,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "Cargo.lock",
        "go.sum",
        "package-lock.json"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 10,
            "reason": "3 out of 3 merged PRs checked by a CI test -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/7 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 3,
            "reason": "project has 1 contributing companies or organizations -- score normalized to 3",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 0,
            "reason": "no update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 10,
            "reason": "project is fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 10,
            "reason": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": 10,
            "reason": "packaging workflow detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 4,
            "reason": "dependency not pinned by hash detected -- score normalized to 4",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "SAST tool is not run on all commits -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 10,
            "reason": "security policy file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": 0,
            "reason": "Project has not signed or included provenance with any releases.",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 4,
            "reason": "6 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "b416c1a43212775afa68fb5d4824043311ca7de5",
        "ran_at": "2026-07-25T19:22:42Z",
        "aggregate_score": 4.8,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": true,
      "has_dependabot_config": false
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-25T05:24:10Z",
      "oldest_open_prs": [],
      "last_merged_pr_at": "2026-07-24T11:25:35Z",
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": []
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/tomtom215/a2a-rust",
    "host": "github.com",
    "name": "a2a-rust",
    "owner": "tomtom215"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "good",
      "name": "Overall health",
      "note": "The weighted overall 64 is calibrated to 73 on the published index scale (record calibration 2026-08-02).",
      "notes": [
        {
          "code": "overall_calibration",
          "params": {
            "raw": 64,
            "calibrated": 73,
            "calibration": "2026-08-02"
          }
        }
      ],
      "value": 73,
      "inputs": {
        "security": 48,
        "vitality": 78,
        "community": 48,
        "governance": 60,
        "calibration": "2026-08-02",
        "engineering": 81,
        "ai_readiness": 67,
        "weighted_overall_raw": 64
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "good",
        "name": "Vitality",
        "value": 78,
        "weight": 0.21,
        "metrics": [
          {
            "key": "development_activity",
            "band": "good",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 70,
            "inputs": {
              "commits_last_year": 608,
              "human_commit_share": 0.94,
              "days_since_last_push": 1,
              "active_weeks_last_year": 8
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 1 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 1
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "8/52 weeks with commits",
                "points": 5.5,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 8
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "608 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 608
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": null,
            "notes": [],
            "value": 90,
            "inputs": {
              "releases_count": 10,
              "latest_release_tag": "v0.7.0",
              "releases_from_tags": false,
              "days_since_latest_release": 1,
              "mean_days_between_releases": 14.5
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "10 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 10
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 1 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 1
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~14.5 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 14.5
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "exceptional",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "weak",
        "name": "Community & Adoption",
        "value": 48,
        "weight": 0.17,
        "metrics": [
          {
            "key": "popularity",
            "band": "at_risk",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 20,
            "inputs": {
              "forks": 0,
              "stars": 19,
              "watchers": 1,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "19 stars",
                "points": 20.4,
                "status": "partial",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 19
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "0 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "1 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "good",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 70,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "readme_badges": null,
              "has_contributing": true,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "readme_badge_services": [],
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (Apache-2.0)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "Apache-2.0"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 18,
                "status": "met",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          },
          {
            "key": "ecosystem_adoption",
            "band": "moderate",
            "name": "Ecosystem adoption (downloads)",
            "note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "registry_dependents"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 60,
            "inputs": {
              "packages": [
                "a2a-protocol-sdk",
                "a2a-protocol-types",
                "a2a-protocol-client",
                "a2a-protocol-server"
              ],
              "dependents": null,
              "ecosystems": "crates",
              "total_downloads": 12219,
              "monthly_downloads": 3697
            },
            "components": [
              {
                "key": "monthly_downloads",
                "name": "Monthly downloads",
                "detail": "3,697 downloads/month across crates",
                "points": 47.6,
                "status": "partial",
                "details": [
                  {
                    "code": "downloads_monthly",
                    "params": {
                      "count": 3697,
                      "ecosystems": "crates"
                    }
                  }
                ],
                "max_points": 80
              },
              {
                "key": "registry_dependents",
                "name": "Registry dependents",
                "detail": "not reported by this ecosystem",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_reported_by_this_ecosystem",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "moderate",
        "name": "Sustainability & Governance",
        "value": 60,
        "weight": 0.23,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 19,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 2,
              "top_contributor_share": 0.817
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 82% of commits",
                "points": 4.1,
                "status": "partial",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 82
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "2 contributors",
                "points": 2.7,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 1 contributing companies or organizations -- score normalized to 3",
                "points": 3,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "excellent",
            "name": "Issue & PR responsiveness",
            "note": "Excluded from scoring (no data or not applicable): Newcomer PR acceptance. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "newcomer_pr_acceptance"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 83,
            "inputs": {
              "merged_prs": 91,
              "open_issues": 0,
              "closed_issues": 1,
              "prs_merged_7d": null,
              "prs_decided_7d": null,
              "prs_merged_30d": null,
              "prs_decided_30d": null,
              "issue_closed_ratio": 1,
              "closed_unmerged_prs": 0,
              "first_time_authors_30d": null,
              "first_time_prs_merged_30d": null,
              "first_time_prs_decided_30d": null
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "100% of issues closed",
                "points": 42,
                "status": "met",
                "details": [
                  {
                    "code": "issues_closed_share",
                    "params": {
                      "share": 100
                    }
                  }
                ],
                "max_points": 42
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "91/91 decided PRs merged",
                "points": 30,
                "status": "met",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 91,
                      "decided": 91
                    }
                  }
                ],
                "max_points": 30
              },
              {
                "key": "newcomer_pr_acceptance",
                "name": "Newcomer PR acceptance",
                "detail": "no first-time contributor's PR decided in 30d",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_newcomer_prs",
                    "params": {
                      "days": 30
                    }
                  }
                ],
                "max_points": 13
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/7 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "moderate",
            "name": "Ownership & stewardship",
            "note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "verified_domain"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 53,
            "inputs": {
              "followers": 32,
              "owner_type": "User",
              "is_verified": null,
              "owner_login": "tomtom215",
              "public_repos": 21,
              "account_age_days": 4772
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "personal (user) account",
                "points": 10,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_personal",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": "not applicable to user accounts",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_applicable_to_user_accounts",
                    "params": {}
                  }
                ],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "32 followers of tomtom215",
                "points": 10.9,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 32,
                      "login": "tomtom215"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "21 public repos, account ~13 yr old",
                "points": 21.8,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 21
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 13
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "exceptional",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "a2a-protocol-sdk",
                "a2a-protocol-types",
                "a2a-protocol-client",
                "a2a-protocol-server"
              ],
              "ecosystems": "crates",
              "any_deprecated": false,
              "min_days_since_publish": 1
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "4 package(s) on crates",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 4,
                      "ecosystems": "crates"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 1 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 1
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "10 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 10
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "excellent",
        "name": "Engineering Quality",
        "value": 81,
        "weight": 0.19,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "good",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 68,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": false,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "9 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 9
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "3 out of 3 merged PRs checked by a CI test -- score normalized to 10",
                "points": 20,
                "status": "met",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "exceptional",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "topics": [
                "a2a",
                "a2a-protocol",
                "agentic-ai",
                "agents",
                "artificial-intelligence",
                "protocol-specification",
                "rust",
                "sdk",
                "agentic-ai-development",
                "a2a-server",
                "a2a-sdk",
                "a2a-types",
                "agent-orchestration",
                "agents-sdk"
              ],
              "has_wiki": true,
              "homepage": "https://a2a-rust.com/",
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": "https://a2a-rust.com/",
                "points": 15,
                "status": "met",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": "14 topics",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "topics_count",
                    "params": {
                      "count": 14
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "weak",
        "name": "Security",
        "value": 48,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "weak",
            "name": "Security posture",
            "note": null,
            "notes": [],
            "value": 48,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 18,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 0,
              "scorecard_aggregate": 4.8
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "3 out of 3 merged PRs checked by a CI test -- score normalized to 10",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/7 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 1 contributing companies or organizations -- score normalized to 3",
                "points": 0.8,
                "status": "partial",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "no update tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is fuzzed",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 4",
                "points": 2,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool is not run on all commits -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "6 existing vulnerabilities detected",
                "points": 3,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "good",
        "name": "AI Readiness",
        "value": 67,
        "weight": 0.04,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "weak",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 0.957,
              "agent_instruction_files": [],
              "agent_instruction_max_bytes": null
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "no CLAUDE.md / AGENTS.md / editor rules",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_instructions",
                    "params": {}
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "90 of 94 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 90,
                      "sampled": 94
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "good",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 70,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "Cargo.lock",
                "go.sum",
                "package-lock.json"
              ],
              "has_dockerfile": true,
              "typed_language": true,
              "bootstrap_files": [],
              "has_devcontainer": false,
              "has_linter_config": false,
              "typecheck_configs": [],
              "agent_commit_share": 0.61,
              "toolchain_manifests": [
                "Cargo.toml",
                "benches/Cargo.toml",
                "crates/a2a-protocol-client/Cargo.toml",
                "crates/a2a-protocol-sdk/Cargo.toml",
                "crates/a2a-protocol-server/Cargo.toml",
                "crates/a2a-protocol-types/Cargo.toml",
                "examples/agent-team/Cargo.toml",
                "examples/echo-agent/Cargo.toml",
                "examples/genai-agent/Cargo.toml",
                "examples/incident-response/Cargo.toml",
                "examples/multi-lang-team/Cargo.toml",
                "examples/rig-agent/Cargo.toml",
                "fuzz/Cargo.toml",
                "itk/Cargo.toml",
                "itk/agents/go-agent/go.mod",
                "itk/agents/go-sdk/go.mod",
                "itk/agents/java-agent/pom.xml",
                "itk/agents/java-sdk/pom.xml",
                "tck/Cargo.toml"
              ],
              "dependency_bot_commit_share": 0
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "Cargo.toml, benches/Cargo.toml, crates/a2a-protocol-client/Cargo.toml (toolchain convention, no task runner)",
                "points": 12.6,
                "status": "partial",
                "details": [
                  {
                    "code": "toolchain_convention",
                    "params": {
                      "files": "Cargo.toml, benches/Cargo.toml, crates/a2a-protocol-client/Cargo.toml"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "Rust (statically typed)",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Rust"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "Dockerfile, lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Dockerfile, lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "61 of the last 100 commits agent-authored or agent-credited",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "agent_authored_commits",
                    "params": {
                      "count": 61,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "no automated dependency updates observed",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_dependency_automation",
                    "params": {}
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 4",
                "points": 4,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "exceptional",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "Rust",
              "largest_source_bytes": 78192,
              "source_files_sampled": 316,
              "oversized_source_files": 3
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Rust (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Rust"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "3/316 source files over 60KB",
                "points": 54.5,
                "status": "partial",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 316,
                      "oversized": 3
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "excellent",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 80,
            "inputs": {
              "example_dirs": [
                "example",
                "examples"
              ],
              "has_mcp_signal": false,
              "api_schema_files": [
                "crates/a2a-protocol-client/proto/a2a_v1/a2a.proto",
                "crates/a2a-protocol-client/proto/a2a_v1/google/api/annotations.proto",
                "crates/a2a-protocol-client/proto/a2a_v1/google/api/client.proto",
                "crates/a2a-protocol-client/proto/a2a_v1/google/api/field_behavior.proto",
                "crates/a2a-protocol-client/proto/a2a_v1/google/api/http.proto",
                "crates/a2a-protocol-server/proto/a2a.proto",
                "crates/a2a-protocol-server/proto/a2a_v1/a2a.proto",
                "crates/a2a-protocol-server/proto/a2a_v1/google/api/annotations.proto",
                "crates/a2a-protocol-server/proto/a2a_v1/google/api/client.proto",
                "crates/a2a-protocol-server/proto/a2a_v1/google/api/field_behavior.proto",
                "crates/a2a-protocol-server/proto/a2a_v1/google/api/http.proto",
                "crates/a2a-protocol-types/proto/a2a_v1/a2a.proto",
                "crates/a2a-protocol-types/proto/a2a_v1/google/api/annotations.proto",
                "crates/a2a-protocol-types/proto/a2a_v1/google/api/client.proto",
                "crates/a2a-protocol-types/proto/a2a_v1/google/api/field_behavior.proto",
                "crates/a2a-protocol-types/proto/a2a_v1/google/api/http.proto",
                "docs/implementation/a2a.proto",
                "itk/protos/instruction.proto",
                "proto/a2a.proto",
                "proto/a2a_v1/a2a.proto",
                "proto/a2a_v1/google/api/annotations.proto",
                "proto/a2a_v1/google/api/client.proto",
                "proto/a2a_v1/google/api/field_behavior.proto",
                "proto/a2a_v1/google/api/http.proto"
              ]
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": "crates/a2a-protocol-client/proto/a2a_v1/a2a.proto, crates/a2a-protocol-client/proto/a2a_v1/google/api/annotations.proto, crates/a2a-protocol-client/proto/a2a_v1/google/api/client.proto, crates/a2a-protocol-client/proto/a2a_v1/google/api/field_behavior.proto, crates/a2a-protocol-client/proto/a2a_v1/google/api/http.proto, crates/a2a-protocol-server/proto/a2a.proto, crates/a2a-protocol-server/proto/a2a_v1/a2a.proto, crates/a2a-protocol-server/proto/a2a_v1/google/api/annotations.proto, crates/a2a-protocol-server/proto/a2a_v1/google/api/client.proto, crates/a2a-protocol-server/proto/a2a_v1/google/api/field_behavior.proto, crates/a2a-protocol-server/proto/a2a_v1/google/api/http.proto, crates/a2a-protocol-types/proto/a2a_v1/a2a.proto, crates/a2a-protocol-types/proto/a2a_v1/google/api/annotations.proto, crates/a2a-protocol-types/proto/a2a_v1/google/api/client.proto, crates/a2a-protocol-types/proto/a2a_v1/google/api/field_behavior.proto, crates/a2a-protocol-types/proto/a2a_v1/google/api/http.proto, docs/implementation/a2a.proto, itk/protos/instruction.proto, proto/a2a.proto, proto/a2a_v1/a2a.proto, proto/a2a_v1/google/api/annotations.proto, proto/a2a_v1/google/api/client.proto, proto/a2a_v1/google/api/field_behavior.proto, proto/a2a_v1/google/api/http.proto",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "crates/a2a-protocol-client/proto/a2a_v1/a2a.proto, crates/a2a-protocol-client/proto/a2a_v1/google/api/annotations.proto, crates/a2a-protocol-client/proto/a2a_v1/google/api/client.proto, crates/a2a-protocol-client/proto/a2a_v1/google/api/field_behavior.proto, crates/a2a-protocol-client/proto/a2a_v1/google/api/http.proto, crates/a2a-protocol-server/proto/a2a.proto, crates/a2a-protocol-server/proto/a2a_v1/a2a.proto, crates/a2a-protocol-server/proto/a2a_v1/google/api/annotations.proto, crates/a2a-protocol-server/proto/a2a_v1/google/api/client.proto, crates/a2a-protocol-server/proto/a2a_v1/google/api/field_behavior.proto, crates/a2a-protocol-server/proto/a2a_v1/google/api/http.proto, crates/a2a-protocol-types/proto/a2a_v1/a2a.proto, crates/a2a-protocol-types/proto/a2a_v1/google/api/annotations.proto, crates/a2a-protocol-types/proto/a2a_v1/google/api/client.proto, crates/a2a-protocol-types/proto/a2a_v1/google/api/field_behavior.proto, crates/a2a-protocol-types/proto/a2a_v1/google/api/http.proto, docs/implementation/a2a.proto, itk/protos/instruction.proto, proto/a2a.proto, proto/a2a_v1/a2a.proto, proto/a2a_v1/google/api/annotations.proto, proto/a2a_v1/google/api/client.proto, proto/a2a_v1/google/api/field_behavior.proto, proto/a2a_v1/google/api/http.proto"
                    }
                  }
                ],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": "example, examples",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "example, examples"
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? Carries a deliberately small weight: agent tooling is a real maintenance signal, but its absence must never gate the top of the scale (calibration saturates at raw 91, so 100/100 remains reachable with AI Readiness at zero)."
      }
    ],
    "classification": {
      "labels": [
        "network-service",
        "sdk",
        "library"
      ],
      "scores": {
        "sdk": 6,
        "library": 6,
        "network-service": 7
      },
      "primary": "network-service",
      "evidence": [
        {
          "tier": "distribution",
          "label": "library",
          "source": "registry:crates",
          "weight": 6
        },
        {
          "tier": "dependencies",
          "label": "network-service",
          "source": "dep:axum",
          "weight": 4
        },
        {
          "tier": "structure",
          "label": "network-service",
          "source": "api_schema",
          "weight": 3
        },
        {
          "tier": "description",
          "label": "sdk",
          "source": "description:sdk",
          "weight": 2
        },
        {
          "tier": "tags",
          "label": "sdk",
          "source": "tag:api-bindings",
          "weight": 2
        },
        {
          "tier": "tags",
          "label": "sdk",
          "source": "tag:sdk",
          "weight": 2
        }
      ],
      "artifacts": [],
      "confidence": "medium",
      "host_extension": false,
      "runs_as_process": true,
      "consumed_by_code": true
    },
    "metrics_version": "2.3.1"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
    "Could not fetch crates package 'itk-current-agent' from its registry",
    "Could not fetch crates package 'a2a-tck' from its registry",
    "Could not fetch crates package 'a2a-benchmarks' from its registry",
    "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-25T19:22:56.531088Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/t/tomtom215/a2a-rust.svg",
  "full_name": "tomtom215/a2a-rust",
  "license_state": "standard",
  "license_spdx": "Apache-2.0"
}