ul0gic / flightline

Не вдалося зібрати розв'язаний набір залежностей для цього звіту: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository

{
  "data": {
    "repo": {
      "topics": [],
      "is_fork": false,
      "size_kb": 1545,
      "has_wiki": false,
      "homepage": null,
      "languages": {
        "Go": 1538927,
        "Makefile": 2274
      },
      "pushed_at": "2026-07-21T01:39:00Z",
      "created_at": "2026-05-02T16:43:48Z",
      "owner_type": "User",
      "updated_at": "2026-07-21T01:37:04Z",
      "description": "App Store as Code.  The first declarative tool for App Store Connect: fetch live state, edit YAML, lint, plan, apply.",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "MIT",
      "default_branch": "main",
      "license_spdx_raw": "MIT",
      "primary_language": "Go",
      "significant_languages": [
        "Go"
      ]
    },
    "owner": {
      "blog": null,
      "name": null,
      "type": "User",
      "login": "ul0gic",
      "company": null,
      "location": "Milky Way Galaxy",
      "followers": 16,
      "avatar_url": "https://avatars.githubusercontent.com/u/243013912?v=4",
      "created_at": "2025-11-09T22:16:46Z",
      "is_verified": null,
      "public_repos": 16,
      "account_age_days": 262
    },
    "license": {
      "state": "standard",
      "spdx_id": "MIT",
      "raw_spdx": "MIT",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.7.0",
          "kind": "minor",
          "published_at": "2026-07-21T01:41:28Z"
        },
        {
          "tag": "v0.6.0",
          "kind": "minor",
          "published_at": "2026-07-20T17:47:55Z"
        },
        {
          "tag": "v0.5.0",
          "kind": "minor",
          "published_at": "2026-07-03T20:27:11Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "e2ac4bfe78bd0bb88a43caf2f3e1414013b28069",
          "body": null,
          "is_bot": false,
          "headline": "fix: harden live ASC command workflows",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-07-21T01:36:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "91defaf932335861a56909ea7457b8e0d52be827",
          "body": null,
          "is_bot": false,
          "headline": "fix: harden reconciliation and preflight",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-07-20T23:01:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "81f3366abeb525413155e928602b0aa1c7a09117",
          "body": null,
          "is_bot": false,
          "headline": "Update the rule count for the three corpus-mined additions",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-07-20T17:45:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c5d7382444b9205a05331cba4e2a03940149ee97",
          "body": "Every 2.1(b) rejection in the corpus traces to one of three gaps the\nexisting rules missed: empty App Review notes invite purchase-flow\ninterrogations (review-details.completeness, warning), IAPs stuck in\nDEVELOPER_ACTION_NEEDED/MISSING_METADATA/REJECTED guarantee another\nloop even when attached (ia\n[…]\nrror), and a lapsed\nPaid Apps Agreement surfaces as 'IAP product not found' with no API\nsignal at all (agreements.paid-apps-unverifiable, info reminder —\nApple exposes no agreement endpoint to check).",
          "is_bot": false,
          "headline": "Add three preflight rules mined from the rejection corpus",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-07-20T17:38:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8867baf86d0cbbc8e0fa0ee90e40f6a313d32685",
          "body": "The upcoming review-details preflight rule needs the type, and lint\nmust not import cmd. A type alias keeps the cmd surface unchanged.",
          "is_bot": false,
          "headline": "Share the review-detail attributes type from the asc package",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-07-20T17:21:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8323850b41ab720f4b38bc88ebbf89918588f703",
          "body": "manualPriceCount/automaticPriceCount came from the sideloaded\nrelationship array, which Apple caps at 50 — every auto-equalized app\nreported exactly 50 of its ~174 territory prices, and the JSON contract\ncarried the wrong number. Page the dedicated schedule endpoints for the\nreal totals. Closes BUG-016.",
          "is_bot": false,
          "headline": "Report true price counts instead of the 50-row sideload sample",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-07-20T17:21:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ef2d60725b34181bccdbbde2837b673fad3ecae9",
          "body": "Bare group commands had no RunE, so cobra treated a typo'd subcommand\nas a help request and returned success — a silent no-op in scripts and\nCI, the exact clerical failure mode the tool exists to prevent. A tree\nwalk at Execute() time attaches the guard to every group so new command\nfiles inherit it without per-file wiring. Closes BUG-015.",
          "is_bot": false,
          "headline": "Make unknown subcommands fail instead of exiting 0",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-07-20T17:18:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "364b4c9c42364a8f6dddccd421eac1e094018b48",
          "body": "Apple only fills relationship data blocks when the related resource is\nincluded, so item references were always empty and the rejection command\ncould never link a submission to its version. Include every to-one\nreference type except appStoreVersionExperiment v1, which Apple rejects\nwhen combined with V2.",
          "is_bot": false,
          "headline": "Populate review submission item references via include",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-07-20T17:11:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "55a8a8e5c4ab88a320032d49a2b6b58b587d62e5",
          "body": "Apple caps sideloaded include limits at 50; the previous\nlimit[territoryAvailabilities]=200 made every pricing get fail with\nHTTP 400, and capping at 50 would undercount the ~175 live territories.\nPage the /v2/appAvailabilities/{id}/territoryAvailabilities relationship\nendpoint instead, which allows limit=200 with links.next paging.",
          "is_bot": false,
          "headline": "Fix pricing get availability fetch rejected by Apple's include cap",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-07-20T17:11:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f8486d31ef9b3c71dba49d1dd54edcf4b8769e92",
          "body": "go install is the sole install method, so --version now falls back to\nGo module build info when ldflags are absent, and the Homebrew stub is\ngone from GoReleaser and the docs. The pre-1.0 versioning policy is\nstated in the README and the JSON contract reference: breaking changes\nland only in minors \n[…]\nvery public surface now uses the canonical Tideterm sample app\n(app.tideterm.ios) instead of a real bundle ID — README, docs, cobra\nexamples (cli.md regenerated), schemas, and test fixtures (BUG-001).",
          "is_bot": false,
          "headline": "Prepare the v0.5.0 debut",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-07-03T20:09:17Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8c455986f2bccf00638013f13b53170a8480fa39",
          "body": "Public issues become the user-facing tracker when the repo flips\npublic; vulnerabilities must not land there while exploitable.\nPrivate vulnerability reporting is enabled on the repo; advisories\npublish after a patched release.",
          "is_bot": false,
          "headline": "Add security policy with private disclosure channel",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-07-03T18:22:30Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "01dd81061518ec534411e178ff7f86de099f606d",
          "body": "The docs landing was echoing each page title as its own description.\nOne honest line per page gives the index, search excerpts, and any\nfuture consumer real summaries to work with.",
          "is_bot": false,
          "headline": "docs: add per-page descriptions to the nav manifest",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-07-03T18:08:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4adc56c185d44186e9c6a5fea4bd5d98e7b743d3",
          "body": "Half the product had no docs beyond --help. Adds task-oriented guides\nfor the observation surface and preflight-in-CI (written against the\nnew exit-code contract) plus a reference for the stable JSON output\nshape, all verified command-by-command against source. manifest.json\nsingle-sources the docs nav for the site loader. Fixes two wrong\nREADME examples (--rating repetition, --out takes a directory) and\npurges stray en-dashes.",
          "is_bot": false,
          "headline": "docs: cover the observation pillar, preflight CI, and JSON contract",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-07-03T16:21:18Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "52d97c0dab9bafc5adac8be5d76f337230b06692",
          "body": "beta-feedback took Apple's opaque build resource id while diagnostics\nand performance took the CFBundleVersion build number, so identifiers\ncopied between commands failed confusingly. beta-feedback now accepts\nthe build number and resolves it via filter[version]; zero matches get\nan actionable error and two matches list both candidates rather than\npicking one silently. Flag meaning changes before v1 locks the CLI.",
          "is_bot": false,
          "headline": "Unify --build to mean build number across observation commands",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-07-03T16:21:05Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cb60e5b711e4ba476adf609ee05e097ad37735f6",
          "body": "Warnings-only runs documented exit 2 but returned 0, so CI gating on\nthe documented contract silently passed warning builds. A typed\nExitError now carries the code out of any command; plan's ad-hoc\nos.Exit(2) unifies on it. SilenceErrors on the root command stops\ncobra printing errors unredacted before the redacting path runs.",
          "is_bot": false,
          "headline": "Implement documented tri-state exit codes for lint and preflight",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-07-03T16:20:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9c077184c48f9fd109e65abcbbfd2e2884aa3264",
          "body": "Install/Setup/Quickstart move above the positioning content so a\nvisitor reaches a runnable command in one scroll. Cut ~80 lines of\nredundancy: Position section folded into Why, review-submission\nrationale stated once, duplicate go-install section removed.",
          "is_bot": false,
          "headline": "docs: restructure README around install-first flow",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-07-03T12:50:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f8ef51bdfe20a0025cb798c85ed007e0e4af7177",
          "body": "cosign v3 makes --bundle required and drops --output-signature and\n--output-certificate, emitting a single .sigstore.json bundle. Update\nthe signs block so keyless signing works with the installed cosign.",
          "is_bot": false,
          "headline": "Migrate cosign signing to v3 bundle format",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-06-14T22:43:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1d41a9e85064dadd4fa8d7d0bf67be3b23e1ca15",
          "body": "Inject version, commit, and build date via ldflags from the git tag so\nrelease builds self-report their provenance. Drop the stale goreleaser\ncomment now that the flow is settled.",
          "is_bot": false,
          "headline": "Wire version metadata into --version output",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-06-14T21:29:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "14b6585a061f4b2cec59e02e1cf860b545e0cbf2",
          "body": "The file-write suppression used //nolint:gosec, which golangci-lint honors but\nstandalone gosec (make sec) does not, so the vuln job failed. Switch to gosec's\nown #nosec G306 G703 with a justification: the reference docs are world-readable\nby design and outDir is a trusted build-time argument.",
          "is_bot": false,
          "headline": "fix: use gosec #nosec directive for gen-docs file write",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-06-14T16:49:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a3385b29d3e4c008a4b8cc9d7abd6fc498af4735",
          "body": "Regenerate the reference docs in CI and diff against the committed copies, so a\ncommand or rule change that skips gen-docs cannot merge.",
          "is_bot": false,
          "headline": "ci: fail verify when generated reference docs drift",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-06-14T16:39:47Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "56443fd9d402163660178eee7f27810c1183d88e",
          "body": "Add cmd/gen-docs, which emits docs/reference/cli.md from the cobra command\ntree and docs/reference/preflight-rules.md from the lint rule registry, so the\nmechanical reference cannot drift from the code. Add Doc() to the Rule\ninterface so each rule's description co-locates with its logic. Output is\ndeterministic; a parity test asserts every command group and ruleId is\ncovered, and a committed-equals-generated test backstops the drift check.",
          "is_bot": false,
          "headline": "docs: generate CLI and preflight reference from source",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-06-14T16:39:47Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1363dcde5504b9fb3c78071664514143abf73275",
          "body": "…epts tree\n\nSplit the three monolithic docs into a navigable tree: getting-started\n(install, apple-api-key, first-run), guides (state-as-code, uploading-assets),\nreference (state-yaml), and concepts (three-layer-model). Prepares the docs\nfor a Starlight site and per-surface enforcement. Also gitignore the pnpm\nstore that leaks to the repo root when pnpm runs in web/.",
          "is_bot": false,
          "headline": "docs: restructure into Diataxis getting-started/guides/reference/conc…",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-06-14T16:39:47Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d75d2c30e4ac4f769998433ed7f1ee2c6025cc78",
          "body": "Several documented examples used flags or arguments that do not exist and\nwould fail on first paste: screenshots upload (--device-set, required\n--locale, positional file), iap create (--name), analytics list-instances\nand download (required bundleId positional), and the submit verb\n(testflight beta-review submit). Also align the API key role guidance to\nApp Manager/Admin and standardize the device constant on APP_IPHONE_67.",
          "is_bot": false,
          "headline": "docs: correct CLI examples to match actual flags and arguments",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-06-14T14:19:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ca032d236a6d14d30886ec5dd8f2277d4307f428",
          "body": "golangci-lint-action's latest installed a go1.24 binary that refused the\ngo1.26 target. Pin the action to v8 with golangci-lint v2.12.1. Scope gosec\nto exclude G501/G401/G304 (MD5 is Apple-mandated for upload checksums; the\nCLI opens user-specified paths by design) and tighten beta-feedback file\nwrites to 0600.",
          "is_bot": false,
          "headline": "ci: pin golangci-lint to a go1.26 build, scope gosec exclusions",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-06-14T14:06:33Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "00f94f7eaf81e320d60ee46c4e00ed5954217100",
          "body": "Pin every GitHub Action to a commit SHA, add per-job least-privilege\npermissions, harden-runner egress audit, and concurrency cancellation.\nAdd govulncheck, gosec, dependency-review, and CodeQL. Introduce a\ntag-triggered GoReleaser pipeline (multi-arch static builds, checksums,\nSBOM, keyless cosign signing) and a CONTRIBUTING guide.",
          "is_bot": false,
          "headline": "ci: harden workflows, add release pipeline and contributor guide",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-06-14T13:49:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c15f8de78f03b9ed841de645364d95dabb765092",
          "body": "Move the CLI entry from cmd/fline/main.go to a root main.go, matching the\nsingle-binary layout. Broad cleanup across the command, client, state, lint,\nand config packages removes duplicated and dead code (net ~3k fewer lines)\nand adds golden coverage for table rows and state dispatchers.",
          "is_bot": false,
          "headline": "refactor: relocate entry point to root and consolidate command surface",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-06-14T13:48:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "65d9e2b2a5803c8ac831eba72107e6f9c5978eb8",
          "body": "…load split\n\nTwo related cleanups that surfaced together while auditing the open\nissues against shipped behavior.\n\n1) version.account-deletion-attested deleted.\n\nThe rule could never verify what it claimed to check — Apple doesn't\nexpose account-deletion attestation state via any /v1 endpoint, and\nF\n[…]\nct\nfrom JSON PATCH on a config field; keeping it in a sibling verb is a\nclean split, not a workaround. The two-command flow (upload, then\napply) is the intended workflow. Footnote rewritten to say so.",
          "is_bot": false,
          "headline": "lint: delete version.account-deletion-attested rule; reframe asset-up…",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T14:49:07Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "bdd202d0358cc8201d938a841f95e0761fdd5bfd",
          "body": "Audited every row in the surface coverage table against the cobra\ncommand tree and the asc client surface. Three rows overstated reality:\n\n- Customer reviews: claimed write (respond) but the code is read-only;\n  reviews.go literally says \"Phase 3 will add the 'reviews respond'\n  write verb; v1 is re\n[…]\nAPI gap. The submit\nverb may land later once the toolchain has more real-world miles; for\nv1 the safer default is letting users double-check in the portal where\nthe full submission summary is visible.",
          "is_bot": false,
          "headline": "docs(readme): correct coverage table to match shipped code",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T14:07:50Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d1a0cc500ce0f7f8a3829f501d414510b084e4d4",
          "body": "Brew is the realistic install path: ASC work requires a Mac, every Mac\ndev has Homebrew. Pre-built binaries from GitHub Releases cover the\nrare CI-on-Linux case. The verbose `go install github.com/.../cmd/fline`\npath moves into a Building-from-source section so it stops being the\nheadline.\n\nSetup se\n[…]\nrs and explicit\nverification output. Easier for both humans skimming and LLMs following\nthe procedure end-to-end. Caught and fixed a made-up whoami output\nexample — real output is a FIELD/VALUE table.",
          "is_bot": false,
          "headline": "docs: lead install with Homebrew, restructure setup as numbered steps",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T13:37:21Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3e41e097e4e6bfdb9a64870a5b17c0b575ea2e08",
          "body": "skipper.dev was unavailable on every Tier-1 TLD, blocking any clean\npublic brand. flightline.dev is registered and slots the project into\nthe established \"as Code\" lineage (Terraform, Pulumi, Helm) — Flightline\nis App Store Connect described declaratively.\n\nBinary becomes `fline` (kubectl/Kubernetes\n[…]\n is flightline.dev/v1alpha1.\nREADME rewritten around \"App Store as Code\" framing with a position\ntable mapping into the IaC family.\n\nPure rename — 880 insertions / 880 deletions, zero semantic change.",
          "is_bot": false,
          "headline": "chore: rename project from skipper to flightline",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T13:19:18Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8409ec2a81c72978e6fefc0a91473e2b8ece6c89",
          "body": "Replaces the Phase 0 scaffold placeholder with a full project README\ncovering both pillars (authoring + observation), all three layers (L1/L2/L3),\ncoverage matrix, architecture Mermaid diagram, lifecycle diagram, install/setup/\nquickstart, commands by category, output contract, configuration precedence,\nknown limitations, and links to docs/. Badge set, status section, and\nattribution updated for personal open-source release.",
          "is_bot": false,
          "headline": "docs: rewrite public README for v0.5.0-beta",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T12:21:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "686c7dee68c5381aa23db13b5a6888fc667ff61e",
          "body": "Changes copyright holder from \"CoreLift LLC\" to \"ul0gic\" (GitHub handle).\nSkipper is a personal tool; company attribution was a scaffold placeholder.\nMIT license text is otherwise identical.",
          "is_bot": false,
          "headline": "chore: relicense to ul0gic personal attribution",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T12:20:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ce2962df5a0caa4538a688d5297a4ca32c273402",
          "body": "Two new test files freeze the wire contract for skipper lint and\npreflight --output json:\n\n- lint_output_stability_test.go: top-level keys (bundleId, version,\n  sourcePath, mode, diagnostics, summary), summary keys (error,\n  warning, info), per-diagnostic keys (ruleId, severity, message,\n  optional \n[…]\non.age-rating-answered, and screenshots.required-devices in a\n  single run. Asserts diagnostic ordering is stable across runs and\n  every emitted ruleId belongs to the registered rule set or 'schema'.",
          "is_bot": false,
          "headline": "test(cmd): lock JSON output shape for lint + preflight",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T11:24:15Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4d4ad139f754b0e1012bde86731f8c399956e6a3",
          "body": "Adds TestRulesCorpus_LiveRulesHaveLiveFixtures: walks the rule registry\nand refuses to ship a Live or Both rule whose testdata directory has no\n*.routes.json sibling. Without this guard a future rule could land with\nonly an offline pass/fail pair and the live arm would silently go\nuntested.\n\nInclude\n[…]\nd so the assertion is satisfied; the rule does not actually\nconsult the client today (Apple has no API surface for the attestation),\nbut the fixture documents the contract for the day Apple ships one.",
          "is_bot": false,
          "headline": "test(lint): assert every Live or Both rule has a routes.json fixture",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T11:24:05Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8d5968798af832959021cb3b9859a054ef27becf",
          "body": "Adds testdata/rules/<rule_id>/ tree with pass.yaml + fail*.yaml per rule,\nplus a table-driven TestRulesCorpus that walks every subdir and asserts\npass.yaml fires no diagnostics and fail*.yaml fires the expected ones.\n\nEach fail.yaml may carry a sidecar fail.expected.json describing the\nexpected diag\n[…]\nxtures, 18 fail fixtures including\nmultiple distinct failure modes for the IAP, build, age-rating, and\nyaml-coercion rules. Live arm of every Mode=Both rule has its own\nfail_live_*.yaml + routes.json.",
          "is_bot": false,
          "headline": "test(lint): per-rule pass/fail fixture corpus + driver",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T11:21:16Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a51e8cdbad9fbc6ea006e4cdc1feb77117ee76c5",
          "body": "Documents all 12 rules in internal/lint/ — mode, severity, when each\nfires, how to fix, and a copy-pasteable example diagnostic JSON for\neach. Covers the strict-mode rules that closed QA-011, the API-gap\nlimitations (privacy labels, reviewer messages), and a maintainer\nguide for adding new rules.",
          "is_bot": false,
          "headline": "docs: preflight rules reference for v1 rule set",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T11:15:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "486eff23846c42bc06d3661612c16d7721b85e2f",
          "body": "skipper lint <state.yaml> runs every Mode=Offline rule against the\nauthored YAML. Schema diagnostics are merged into the lint output so\nusers see one stream covering structural validation and rule findings.\nSourcePath is threaded into CheckContext so strict-yaml rules can read\nthe raw bytes for AST \n[…]\nvia a typed\nerrLintErrors. Warnings emit to stderr; full 0/1/2 mapping in main.go\ndeferred to a follow-up.\n\nAdds Severity.UnmarshalJSON so consumers (and our tests) round-trip\nthe JSON output cleanly.",
          "is_bot": false,
          "headline": "feat(cmd): lint + preflight commands wire the rule engine",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T11:04:37Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "22580b99e6d4fa0c9512ef99aa28237b96269694",
          "body": "Three rules cover the loader quirks the schema validator misses:\n\n- strict.yaml-coercion (Error): walks the raw YAML AST and flags\n  yes/no/on/off/y/n on known bool fields. Quoting does NOT suppress\n  yaml.v3's YAML 1.1 coercion when decoding into *bool, so both\n  quoted and unquoted forms fire with\n[…]\n lint layer avoids a global validator switch that would break\n  existing files.\n\nAdds CheckContext.SourcePath so strict-yaml rules can read raw bytes;\nrunner field is opt-in and other rules ignore it.",
          "is_bot": false,
          "headline": "feat(lint): strict YAML rules closing QA-011 loader quirks",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T10:58:41Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c941707b111c599c7cafee847586e13a104f6a47",
          "body": "Apple blocks Submit-for-Review until the version has a build attached\nAND that build's processingState == VALID. Live-only.\n\nFailure modes:\n- 404 / empty data block on /v1/appStoreVersions/{id}/build => \"no build\n  attached\" diagnostic with attach-instructions fix hint.\n- attached but processingState != VALID => \"build attached but\n  processingState=%q\" diagnostic. Common values: PROCESSING (still\n  ingesting; wait), FAILED / INVALID (re-upload).",
          "is_bot": false,
          "headline": "feat(lint): build.attached-and-valid rule",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T10:53:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "18c69021bc9e93a5b247b985087fb2379c1fde42",
          "body": "Apple's submission flow blocks Submit-for-Review until each locale has\nscreenshots for both APP_IPHONE_69 and APP_IPHONE_67. Mode=Both:\n\n- Offline: scans State.Spec.Screenshots.Locales[locale][device] and\n  flags every locale missing either device class.\n- Live: walks /v1/appStoreVersionLocalization\n[…]\nainst the wire shape.\n\nRequired-device list (APP_IPHONE_69 + APP_IPHONE_67) is currently\nhardcoded; will rotate with Apple's device-launch cadence — easier\nto bump a slice than to plumb a config knob.",
          "is_bot": false,
          "headline": "feat(lint): screenshots.required-devices rule",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T10:52:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "79de23975d25588d5ad8b47d90007cbb85fe08be",
          "body": "Detect locales that appear in one localizable surface (metadata,\nscreenshots, IAP localizations) but are missing from another. The\nunion-vs-per-surface diff catches the typical authoring slip — adding\na French metadata block but forgetting to ship French screenshots —\nwhich Apple may reject because \n[…]\n\nSeverity Warning, not Error, because a one-surface locale is sometimes\nintentional (e.g., metadata-only legal-text translations).\n\nOutput is sorted by Path so the JSON contract is stable across runs.",
          "is_bot": false,
          "headline": "feat(lint): localizations.completeness rule",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T10:51:38Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "670dc5241c39a455c8d21f252b4d58b0e8b5982c",
          "body": "Apple's account-deletion attestation lives in App Store Connect's web UI\nbehind App > Distribution > App Privacy > Account Deletion. The public API\ndoes not expose the attestation field on AppInfo or anywhere else — there\nis no endpoint to query it.\n\nUntil Apple ships an API surface, this rule emits\n[…]\n can manually verify\nthe toggle. Apps with user accounts that miss this attestation are a\nfrequent Guideline 5.1.1(v) rejection.\n\nWhen Apple's API exposes the field we'll upgrade to a hard Error rule.",
          "is_bot": false,
          "headline": "feat(lint): version.account-deletion-attested reminder rule",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T10:50:44Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ac811864cb31f2f52f88b69c975438a07b280c19",
          "body": "Apple blocks Submit-for-Review until every age-rating prompt has a value.\nMode=Both:\n\n- Offline: scans State.Spec.AgeRating via reflection, reporting every\n  pointer field that is nil. Pointer-typed fields use nil to mean\n  \"unanswered\" (not \"false / NONE\"); the schema requires non-nil at\n  submissi\n[…]\nape (empty string\n  or nil pointer == unanswered). Schema-shape names are emitted in\n  Path so offline + live diagnostics merge cleanly.\n\nReflection-based offline pass survives schema field additions.",
          "is_bot": false,
          "headline": "feat(lint): version.age-rating-answered rule",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T10:49:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7848324941c870733ad953298a66d776c5b1e2f1",
          "body": "Apple blocks submission until usesNonExemptEncryption is set. Mode=Both:\n\n- Offline: when spec.exportCompliance is managed (non-nil), require\n  UsesNonExemptEncryption to be set. Unmanaged (nil) is intentionally\n  not flagged — the user may rely on Info.plist instead.\n- Live: read the build attached\n[…]\non and check its\n  usesNonExemptEncryption attribute. No attached build is silent here\n  (rules_build_attached_and_valid covers that).\n\nAdds asc_helpers.go to share resolveVersionIDOnApp across rules.",
          "is_bot": false,
          "headline": "feat(lint): version.export-compliance-answered rule",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T10:48:20Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7df1d0db3acebda36df6be18b78f320868a3fb26",
          "body": "Apple Guideline 2.3.2 forbids reusing a store screenshot as IAP promotional\nart. Apple's public API does not expose IAP promotional artwork directly,\nso the rule compares the IAP review screenshot hash (the closest accessible\nasset) against every app screenshot's sourceFileChecksum. A clash means th\n[…]\nsame file is in two surfaces.\n\nScreenshot enumeration walks versions -> localizations -> sets -> shots,\ncollecting checksums. IAP fetch errors degrade to no-op (404 == no\nscreenshot, not a violation).",
          "is_bot": false,
          "headline": "feat(lint): iap.promotional-image-distinct rule",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T10:46:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e07d98416e690bb80f3f0f66200b4b29747bd984",
          "body": "Apple requires an App Store review screenshot for any IAP submitted for\nreview. The rule iterates IAPs in submission-eligible states and calls\nGET /v2/inAppPurchases/{id}/appStoreReviewScreenshot — empty\nattributes (no fileName, no templateUrl) means no screenshot uploaded\nand a hard-rejection cause.\n\n404s and empty data blocks both map to \"missing\"; transient errors\nbecome warnings rather than errors so a flaky network doesn't false-\ngate preflight.",
          "is_bot": false,
          "headline": "feat(lint): iap.review-screenshot-exists rule",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T10:44:52Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0d5830b1021533d77c0f5c405d6efcea421dc476",
          "body": "The #1 IAP rejection cause: developers mark an IAP READY_TO_SUBMIT, ship\nthe app for review, and discover at approval time that the IAP went out\nunattached. This rule fetches the latest in-flight review submission and\nflags every READY_TO_SUBMIT IAP whose id is missing from its items.\n\nLive-only rule. Picks the highest-priority submission state when more than\none exists (IN_REVIEW > WAITING_FOR_REVIEW > READY_FOR_REVIEW > COMPLETING)\nso we don't false-flag against a stale completed submission.",
          "is_bot": false,
          "headline": "feat(lint): iap.attached-to-review-submission rule",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T10:43:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a3e12de2be363a4c51922ae97902e5d1b87df1a6",
          "body": "Rule interface (ID/Severity/Mode/Check) and Runner (deterministic ID-sorted\nexecution, panic recovery, aggregated diagnostics) form the contract that\nevery rule file plugs into via Register() at init().\n\nRules declare a Mode bitmask (Offline | Live | Both); Filter(mode) builds\nthe right set for lint\n[…]\neckContext.Live lets Both-mode rules\nbranch on whether they have an ASC client.\n\nSeverity is an int with MarshalJSON so the JSON output stays stringly-typed\n(error / warning / info) for LLM consumers.",
          "is_bot": false,
          "headline": "feat(lint): rule registry and Runner infrastructure",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T10:41:36Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2c188d0f151bc9aa1c0e8c8847e24681ac47b7e8",
          "body": "Add an end-to-end stateful fixture proof of the L2 keystone write\ncontract: applying a state.yaml against a backend that differs from\ndesired, then re-applying after a refetch+rediff, must produce zero\nPATCH/POST/DELETE calls on the second run.\n\nThe fixture is an httptest server with an in-memory mo\n[…]\natcher would PATCH even with no Change to dispatch.\n\nSurfaces excluded by design (typed errors deferring to L1 verbs per\nQA-010): screenshots, IAP review screenshot, customProductPages.\nlocalizations.",
          "is_bot": false,
          "headline": "test(state): apply idempotency contract — second run is zero PATCHes",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T10:28:00Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6128087fcbbe03fe67a0127abdb6c403651041a0",
          "body": "Add TestRoundTrip_AllSurfacesPopulated alongside the keystone diff-empty\ninvariant. The diff-empty test catches projection/diff drift but is\nsilently consistent if a whole surface drops out of both fetch.go and\nthe diff engine simultaneously — both rounds would skip the surface and\nthe diff would st\n[…]\nmed per-surface\nchecks. A future regression that drops customProductPages, pricing, or\nany other surface from fetch.go now fails with a precise pointer to\nthe missing section instead of a silent pass.",
          "is_bot": false,
          "headline": "test(state): pin per-surface coverage on round-trip reload",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T10:25:07Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f70a1a8753d0b8b7f224270d55d6f51b088f7e2f",
          "body": "Drive every YAML in testdata/{good,bad,quirks} through LoadState +\nValidate. Bad fixtures pair with .expected.json sidecars declaring the\ndiagnostic stage (load|schema), JSON-Pointer path, line marker, and\nmessage substring — the assertion is \"at least one actual diagnostic\nmatches each expected ent\n[…]\n-checks-disabled gap\nand the yaml.v3 yes/no-as-bool coercion. When the gap is closed those\ntests will start failing, signalling that the fixture should move from\nquirks/ to bad/ with a proper sidecar.",
          "is_bot": false,
          "headline": "test(config): loader corpus with sidecar diagnostic assertions",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T10:24:05Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "03cbbd2828eeb9e942571264dcddf04b3550d973",
          "body": "Copy-pasteable 5-step tutorial using passdmv (com.under5.passdmv) as\nthe example. Covers fetch, field edit, plan output reading, apply with\n--confirm, and idempotency verification. Documents all command variants\n(--exit-on-changes for CI, --dry-run, --resume after interruption) plus\nthe two active limitations (asset-upload QA-010, privacy labels API gap)\nand a troubleshooting section for the four most common failure modes.",
          "is_bot": false,
          "headline": "docs: state-yaml-quickstart.md — fetch → edit → plan → apply walkthrough",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T02:35:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "839bf5a3b47e5f074d7a9061a134e5ee8a889ce3",
          "body": "Covers every section in schemas/skipper.schema.json: version, build,\nmetadata, screenshots, iap, ageRating, exportCompliance, reviewerDemo,\ncategories, pricing, testflight, customProductPages. Includes per-field\ntables with types, maxLength constraints, and gotchas (YAML coercion\ntraps, cross-resour\n[…]\nISSUE-002).\n\nAlso fixes the seventeenPlus schema description in skipper.schema.json\nand syncs internal/config/schema.json — the field had no description\ntext despite being write-blocked at apply time.",
          "is_bot": false,
          "headline": "docs: state-yaml.md — full field reference for v1alpha1 AppState",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T02:35:49Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "609e3b788455aa7faf4bb9f52a159ab7ccc42247",
          "body": "Adds dispatcher tests asserting one Change → one expected API\nsequence for the new surfaces (categories, metadata, testflight tester\nadd, reviewerDemo, IAP). The reviewer-demo test exercises both the\nschema-to-wire rename (username → demoAccountName) and the env-ref\npassword resolution path (env:DEM\n[…]\nstone L2 invariant: fetch → marshal yaml → reload →\nre-fetch → diff must be empty. Drift here means users would see\nphantom diffs on re-apply.\n\nRefs build-plan.md task 4.2.5 round 2 and 4.2.9 round 2.",
          "is_bot": false,
          "headline": "test(state): per-surface dispatcher coverage + L2 round-trip invariant",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T02:26:42Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e21b7bff18941b59c0c52f427d777fa3924b9037",
          "body": "Extends Fetch with per-surface projectors so every surface in\nschemas/skipper.schema.json (except privacy labels — ISSUE-002, Apple\nAPI gap) round-trips into a typed *config.State:\n\n- metadata.locales[*]   — appStoreVersionLocalizations + appInfoLocalizations\n- screenshots.locales   — per-locale, pe\n[…]\nFullSurfaceCoverage asserts every spec surface is populated\nagainst a single fixture handler — the \"this is what we cover\"\ncontract test.\n\nRefs build-plan.md task 4.2.4 round 2; closes most of QA-009.",
          "is_bot": false,
          "headline": "feat(state): full Fetch coverage for every v1alpha1 spec surface",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T02:23:01Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "414f554d230edc9343eb6cd23089daaa6877b4fe",
          "body": "… table\n\nReplaces the package-level SetApplyContext/ResetApplyContext globals\n(plus the sync.Mutex guarding them) with an ApplyContext field on\nApplyOpts. Apply is now reentrant — multiple goroutines can dispatch\nagainst different bundles without contention or cross-talk.\n\nAlso lands the full dispat\n[…]\new screenshots + custom product page\nlocalizations defer to the L1 verbs with a typed error pointing at\nQA-010 (orchestrator-side multipart upload integration).\n\nRefs build-plan.md task 4.2.5 round 2.",
          "is_bot": false,
          "headline": "refactor(state): thread ApplyContext through ApplyOpts; full dispatch…",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T02:17:19Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d8c5bca0c70a9737c17cfd48f480d45264c46725",
          "body": "Without --confirm and without --dry-run, apply prints the plan and\nrefuses to write — same guardrail as terraform plan. With --confirm,\neach change dispatches to the L1 writer via state.Apply, with a\ncheckpoint persisted after every success so a Ctrl-C resumes cleanly\nvia --resume.\n\nPer-change progress prints to stderr; the JSON-stable ApplyResult\nenvelope on stdout summarizes Applied / Skipped / Errors.\n\nRefs build-plan.md task 4.2.8.",
          "is_bot": false,
          "headline": "feat(cmd): apply <state.yaml> with --confirm gate, --resume, --dry-run",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T01:57:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4d275749363cf01202c77935346a73e9d346d1d0",
          "body": "…or CI\n\nLoads state.yaml, runs schema validation against the embedded JSON\nSchema, fetches live ASC state, runs plan.Diff, prints the change set\nin table or JSON. Read-only — never writes.\n\n--exit-on-changes returns exit code 2 when changes exist (clean signal\nfor CI hooks); otherwise exit 0 even with diffs. Exit 1 stays reserved\nfor actual errors.\n\nRefs build-plan.md task 4.2.7.",
          "is_bot": false,
          "headline": "feat(cmd): plan <state.yaml> diffs desired vs live, exit-on-changes f…",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T01:56:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f175a51a2d0a2fa5c03b98f618357f5f46b1a894",
          "body": "Pulls live ASC state via state.Fetch and emits a Skipper state file.\nDefault output is YAML with the yaml-language-server schema directive\nprepended for editor autocomplete; --output json bypasses YAML for\nmachine consumers; -o file.yaml writes to disk at mode 0600.\n\nSelf-registers via init(); the cobra root only owns its persistent\nflags so the wiring stays additive.\n\nRefs build-plan.md task 4.2.6.",
          "is_bot": false,
          "headline": "feat(cmd): fetch <bundleId> writes live state.yaml",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T01:55:47Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "76dbac223422ae9e865dfba776840b8d32b95549",
          "body": "Apply walks a Path-sorted []plan.Change in order, dispatches each to\nthe L1 write (PATCH /v1/appStoreVersions/{id} for version,\n/v1/ageRatingDeclarations/{id} for ageRating, /v1/builds/{id} for\nexportCompliance.usesNonExemptEncryption), and persists a checkpoint\nto $XDG_CACHE_HOME/skipper/apply/<bun\n[…]\nh to a typed\nErrUnmappedChange error, named in the dispatch table comment as the\nQA-009 gap. The dispatch table is the canonical \"what Skipper can\napply today\" surface.\n\nRefs build-plan.md task 4.2.5.",
          "is_bot": false,
          "headline": "feat(state): Apply orchestrator with checkpointed dispatch",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T01:54:18Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "94d6ef6e4ad762d2b864693f12cfd7b848e65233",
          "body": "Fetch(ctx, c, bundleID, opts) resolves the appId, picks the editable\nversion + appInfo, and projects four spec surfaces today:\n\n- version (releaseType, earliestReleaseDate, copyright, downloadable)\n- ageRating (full questionnaire, with Apple-name → schema-name mapping\n  for the renamed fields like v\n[…]\nviewerDemo, categories, pricing, testflight, customProductPages)\nreturn nil so the diff engine correctly treats them as \"not managed\".\nQA-009 tracks the staged fill-in.\n\nRefs build-plan.md task 4.2.4.",
          "is_bot": false,
          "headline": "feat(state): Fetch projects live ASC into typed *config.State",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T01:51:05Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "037d20a6b4691219ca61fe158c4ff0825c6ea280",
          "body": "Diff(desired, live) walks every spec sub-tree and emits a typed Change\n{Op, Resource, Path, From, To, Hint} per leaf-level mutation. Output is\nPath-sorted so plan output is deterministic and CI diffs stay clean.\n\nIdempotency contract: Diff(s, s) == nil. Nil sub-specs in desired mean\n\"not managed\" — \n[…]\neenshots-by-locale-by-device, custom product pages)\ninto one Change per leaf so the apply orchestrator can dispatch one\nAPI call per change with per-change checkpoints.\n\nRefs build-plan.md task 4.2.3.",
          "is_bot": false,
          "headline": "feat(plan): leaf-level diff engine for desired vs live state",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T01:47:54Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "261a454c359bdece337506a8c151e81c07eaa41d",
          "body": "…json\n\nValidate(file, *State) []Diagnostic round-trips the typed tree through\nJSON, runs the embedded schema, and emits one Diagnostic per leaf\nValidationError with a JSON-Pointer Path. Cross-field rules (enums,\npatterns, required, oneOf) that Go types can't express live in the\nschema; the loader ha\n[…]\nchema.json. A test guards against drift.\n\nAdds dep github.com/santhosh-tekuri/jsonschema/v6 — pure-Go, no cgo,\n2020-12 dialect support, structured ValidationError tree.\n\nRefs build-plan.md task 4.2.2.",
          "is_bot": false,
          "headline": "feat(config): JSON Schema validation against embedded skipper.schema.…",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T01:44:56Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "eaafc1a901004c9d9b71e68e623e9df8a5e05d49",
          "body": "LoadState reads YAML state files into the typed *State tree mirroring\nschemas/skipper.schema.json. yaml.v3 KnownFields(true) catches typos\nand unknown keys; errors surface as Diagnostic{File,Line,Column,Path,\nMessage,Severity} so cmd/plan and cmd/apply can render them uniformly.\n\nCoercion footguns (yes/no, leading zeros) are out of scope here —\nthey belong to the lint layer in Phase 5.\n\nRefs build-plan.md task 4.2.1.",
          "is_bot": false,
          "headline": "feat(config): typed state loader with diagnostic errors",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T01:39:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "223beb43004dbbadddf62a30236058adf8af0f75",
          "body": "Phase 4.1 sequential head — the schema everything in Phase 4 consumes.\nschemas/skipper.schema.json (~370 lines, JSON Schema 2020-12) covers:\n\n- apiVersion: skipper.corelift.io/v1alpha1, kind: AppState\n- metadata.{bundleId, version, platform}\n- spec.version (releaseType, copyright, downloadable, sche\n[…]\n apply time.\n\nschemas/example.state.yaml ships a passdmv-flavoured example exercising\nevery section. jv (santhosh-tekuri/jsonschema CLI) confirms schema is\nself-valid and example validates against it.",
          "is_bot": false,
          "headline": "feat(schemas): JSON Schema for Skipper AppState (v1alpha1)",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T01:24:24Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e240e05677de50b6ebb8210f9cb741e58adb4095",
          "body": "Two production bugs surfaced by qa-eng's Phase 3.4 write-path stress\ntests, both fixed inline before the Phase 3 gate.\n\nQA-007 (HIGH): deleteCommon was draining the response body for\nkeep-alive reuse BEFORE calling errorFromResponse. On 4xx/5xx that\nsilently dropped Apple's errors[] envelope — *APIE\n[…]\n(*APIError).Error() appends \"(retry after N)\" to the message.\n\nBoth QAs moved to closed/. Tests in write_errors_test.go used t.Logf\nfor the broken-behaviour observation, so the fix doesn't break them.",
          "is_bot": false,
          "headline": "fix(asc): preserve errors[] on DELETE 4xx + surface Retry-After on 429",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T00:53:13Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c8658722e1af70a4e961c0ad63568371a8d125c9",
          "body": "Adds the full fail-then-succeed resume cycle the build plan calls out:\n\n1. Round 1 fixture fails chunk 1 PUT. Upload returns the chunk error and\n   persists a checkpoint with UploadedChunks=[0].\n2. Round 2 with ResumeFromCheckpoint=true. Verifies chunk 0 is NOT\n   re-PUT, chunk 1 succeeds (the one-s\n[…]\nft alone on disk\n\nExisting upload_test.go already covered: per-chunk happy path,\nmanually-seeded resume, MD5 mismatch, post-commit cleanup, atomic-write\ntorture, path-traversal rejection on asset IDs.",
          "is_bot": false,
          "headline": "test(asc): end-to-end multipart upload resume cycle",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T00:34:33Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b66510c6b906ccd795ac6e3caeb19cbf48288c81",
          "body": "Adds an error-fixture server that serves a single canned response with\nconfigurable status + Retry-After. Each test exercises a write verb\n(POST/PATCH/DELETE/DeleteWithBody) against an Apple-shaped error payload\nand asserts:\n\n- 422 surfaces every errors[] item's code+title+detail in the user-facing\n\n[…]\nredactor\n  scrubs JWT-shaped + Bearer-header tokens from any error string.\n\nAdds the missing error_422_validation.json fixture (modelled on the\nshape Apple returns for ENTITY_ERROR.ATTRIBUTE.INVALID).",
          "is_bot": false,
          "headline": "test(cmd): write-path error stress for 401/422/429/5xx",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T00:32:45Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "65f56ed3ec3c715fdb6f9a2bf455263044f686f5",
          "body": "Adds a counting fixture server that tracks every method+path it serves,\nthen exercises each v1 write command's read-then-decide-to-write flow\ntwice. The contract: when current state already matches desired state,\nthe second pass produces zero PATCH/POST/DELETE/PUT requests.\n\nCatches drift in any wri\n[…]\ner-command \"PATCH route absent → 404\" assertions: the\ncounter records every method against every path, so an accidental write\nto an unrelated route is caught instead of masquerading as a fixture\ntypo.",
          "is_bot": false,
          "headline": "test(cmd): cross-cutting idempotency corpus for write paths",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T00:29:07Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7b092fe4a18842d88cc30666adb8257031ffc664",
          "body": "The audit during Phase 3.5 found two redaction gaps:\n\n1. The keyID regex \\b[A-Z0-9]{10}\\b doesn't match keyIDs embedded in\n   AuthKey_<KEYID>.p8 filenames because _ is a word char, breaking \\b.\n   Auth errors carrying that path leaked the keyID to stderr.\n\n2. Issuer UUIDs were not redacted at all.\n\n\n[…]\ncmd/skipper/main.go now runs every error string through asc.Redact()\n  before stderr — defense in depth for the auth / fs / net error paths\n  that bypass *APIError entirely.\n\nSEC-002 moved to closed/.",
          "is_bot": false,
          "headline": "sec: extend Redact patterns + apply at outermost printer (SEC-002)",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T00:20:41Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "bf456f2b645706fd300d1feee2fa00147c2a77be",
          "body": "Adds the three write verbs to the custom-product-pages command group:\n\n  - create <bundleId> --name <name> — POST /v1/appCustomProductPages.\n    Idempotent on (app, name): if a page with the same name already\n    exists for the app, the existing page is returned with\n    changed=false rather than PO\n[…]\ng so re-runs of a delete script\n    are safe.\n\nVersions and localizations on a page remain L1 read-only — they're\nmodeled separately and need their own write surfaces (next phase or\nL2 state-as-code).",
          "is_bot": false,
          "headline": "feat(cmd): custom-product-pages create / update / delete write verbs",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T00:14:19Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4c29a66b1428e4e602380042034573781eacde6a",
          "body": "… beta-review submit\n\nAdds the full TestFlight write surface to the testflight command group:\n\n  - testflight groups create <bundle> — POST /v1/betaGroups, idempotent\n    on (app, name): an existing group with the requested name is returned\n    with changed=false rather than POSTed.\n\n  - testflight \n[…]\ning Client.Delete didn't support — added\nClient.DeleteWithBody alongside Delete. Both share a deleteCommon helper.\nTests cover the body transmission, 4xx surfacing, and the relationship\nlinkage shape.",
          "is_bot": false,
          "headline": "feat(cmd): testflight write surface — groups CRUD, tester add/remove,…",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T00:08:56Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "cc749f1def5479f2b2e482f402d79dc599622558",
          "body": "…tent diff\n\nPhase 3.2.5. Configures the per-version appStoreReviewDetail Apple shows\nreviewers — contact name/email/phone, demo account username/password, and\nnotes. Diffs against the existing record (when present) and PATCHes only\nfields the user actually supplied AND that differ; otherwise issues \n[…]\nady correct server-side, so the idempotent contract treats\n  password-supplied as \"always patch\").\n\nReuses splitContactName for \"Jane Doe\" → first/last and the existing\nstrPtr helper from versions.go.",
          "is_bot": false,
          "headline": "feat(cmd): reviewer-demo set with password-aware redaction and idempo…",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-03T00:00:44Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "bdfd3923f31ee8292d760776465a716e47113fb0",
          "body": "…stic as get\n\nPhase 3.2.4. Apple's App Store Connect API v4.3 still does not expose\nappPrivacyDetails (per ISSUE-002), so the write-side stub returns the\nidentical typed diagnostic the read-side returns. Centralizes the view\nconstructor in privacyLabelsDiagnostic so consumers see byte-for-byte\nthe s\n[…]\n on.\n\nThe --from flag is wired but unused; keeping it on the surface means the\nCLI shape doesn't shift when Apple eventually ships the endpoint and we\nflip Supported to true plus add the labels block.",
          "is_bot": false,
          "headline": "feat(cmd): privacy-labels set returns the same supported=false diagno…",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-02T23:56:49Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7ec615cc0eb6ff8dc0a25ce2252a36c1dd821ba1",
          "body": "Adds skipper pricing set <bundle> --base-territory <code> --tier <pp-id>\nto apply a price schedule via POST /v1/appPriceSchedules. Apple's pricing\nmodel is replace-by-create (no in-place PATCH), so the verb fetches the\ncurrent schedule's base manual price first and short-circuits when the\nrequested \n[…]\ne\nand --end-date optional (omitted when empty so Apple defaults apply).\n\nL1 keeps the surface narrow to a single base-territory pairing;\nmulti-territory manual schedules will land in L2 state-as-code.",
          "is_bot": false,
          "headline": "feat(cmd): pricing set L1 verb with idempotent base-territory diff",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-02T23:56:29Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6283bd1707e741fc7cbe21ed3d81273c11165951",
          "body": "…on boolean\n\nPhase 3.2.3. PATCHes /v1/builds/{id} with the requested\nusesNonExemptEncryption value after diffing against the build's current\nanswer — same idempotent contract as the rest of the L1 write surface.\nResolves bundleId+version+platform → appStoreVersion ID → attached build,\nreturning a ty\n[…]\n)\nshape than the build boolean. Rather than half-wire it now they fail\nfast with a typed sentinel pointing at the follow-up; users who only\nneed the boolean answer (the 95% case) get the working path.",
          "is_bot": false,
          "headline": "feat(cmd): export-compliance set on the build's usesNonExemptEncrypti…",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-02T23:55:28Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "809c78fb7f26ae9140eb34e5d5ab1a4675afcb61",
          "body": "Extracts validation, target-resolution, and per-file processing into\nnamed helpers so the top-level RunE reads top-down at < 15 cyclomatic\ncomplexity. Behaviour is unchanged; tests still pass against the same\nfixture surface.",
          "is_bot": false,
          "headline": "refactor(cmd): split runScreenshotsUpload to satisfy gocyclo",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-02T23:54:08Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "319e7922843419e5892d4147c18c3f75b722177f",
          "body": "…payload\n\nPhase 3.2.2. Loads --from as JSON or YAML based on extension, validates the\npayload's keys against Apple's documented questionnaire wire shape (typos\nfail loudly with the bad key named, not silently dropped to nil), gates\nfrequency-enum values against the canonical set, then diffs against \n[…]\nlone). Without the gate, a partial YAML would clobber every\nunmentioned field to its zero value.\n\nPromotes go.yaml.in/yaml/v3 from indirect (already pulled by viper) to\ndirect so the import is honest.",
          "is_bot": false,
          "headline": "feat(cmd): age-rating set with idempotent diff against questionnaire …",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-02T23:52:35Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2fb24df96ba975e22cfcdb1baf13e25238c999f2",
          "body": "Adds `skipper screenshots upload <bundle> --version <v> --locale <code>\n--device-set <set> <files...>`. Wraps the multipart helper from 3.1.1.\n\nWire dance per file: hash MD5 -> probe the target set's existing slot\nindex -> skip if a slot already carries that checksum (sourceFile\nChecksum is what App\n[…]\n\nIncludes a fixture-server-backed integration test that exercises the\nfull reserve -> chunk PUT -> commit path with a separate chunk endpoint,\nso the cmd-layer wiring against asc.Upload doesn't drift.",
          "is_bot": false,
          "headline": "feat(cmd): screenshots upload with checksum-keyed idempotency",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-02T23:52:32Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "70226d2c5d7f99a420f6a38c78241fc5a55e7d16",
          "body": "Adds skipper categories set <bundle> to assign primary/secondary\ncategories and their subcategory slots on the editable appInfo via PATCH\n/v1/appInfos/{id}. Reads the six to-one relationships first, diffs\nagainst the desired state from flags, and only PATCHes when at least\none slot moves. --clear-se\n[…]\nedundant PATCHes but they\ncost rate-limit tokens. Result surfaces 'changed', per-field changes,\nand the post-state CategoryAssignmentView so plan/apply consumers can\ndetect no-ops without re-querying.",
          "is_bot": false,
          "headline": "feat(cmd): categories set write verb with idempotent diff",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-02T23:49:15Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3a647e1c4d381a6897a13917310434112bb0041f",
          "body": "Adds `skipper metadata set <bundle> --version <v> --locale <code> ...`\nwhich spans two Apple resources transparently:\n\n  - description, keywords, whatsNew, promotionalText, marketingUrl,\n    supportUrl  -> appStoreVersionLocalizations\n  - name, subtitle                                -> appInfoLocal\n[…]\nnt flags is a hard error rather than a silent success.\n\nThe appInfo lookup reuses pickAppInfoForVersion from age_rating.go to\ntarget the editable bucket rather than mutating already-shipping listings.",
          "is_bot": false,
          "headline": "feat(cmd): metadata set with cross-resource idempotent PATCH",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-02T23:48:52Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9e9233c534065cbe9e4966f459094ffd715bc9da",
          "body": "…view-screenshot upload\n\nPhase 3.2.1. Idempotent throughout: create returns the existing record with\nnoop=true when the productId already exists; update reads current state and\nPATCHes only differing fields; delete is a noop when the record is already\ngone and refuses to act without --yes; localizat\n[…]\nre-upload bytes that are already in place.\n\nFiles in iap_write.go rather than appended to iap.go to keep each file under\nthe 300-line guideline now that the module covers both read and write surfaces.",
          "is_bot": false,
          "headline": "feat(cmd): IAP writes — create/update/delete + localizations set + re…",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-02T23:47:45Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d5701a38bf67383d380054a1a02c8fd66e3c6c1d",
          "body": "Adds `skipper builds attach <bundle> --version <v> --build <n>` over\nPATCH /v1/appStoreVersions/{id}/relationships/build. Reads the current\nlinkage first; emits action=noop when the version already points at the\nrequested build, otherwise PATCHes only the differing linkage. The PATCH\nreturns 204 — doJSON decodes that as zero-value, no extra logic needed.\n\nResolves QA-004 (builds attach stub).",
          "is_bot": false,
          "headline": "feat(cmd): builds attach with idempotent linkage diff",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-02T23:43:32Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9a017deb8cb55c1ba97e60ef8932d07e2ea3848f",
          "body": "Adds the L1 write surface over /v1/appStoreVersions. Both verbs honor the\n\"flag -> diff -> minimal PATCH\" idempotency contract: only flags the user\nexplicitly set reach the wire body, and the PATCH is skipped entirely\nwhen no field would change. The action/changed/version envelope is the\nstable JSON contract for downstream LLM consumers.",
          "is_bot": false,
          "headline": "feat(cmd): versions create + update with idempotent diff-then-PATCH",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-02T23:39:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9ffc49fdbf682e23497253ac932f61614ddd6ce3",
          "body": "…nshots\n\nImplements Apple's reserve -> PUT chunks -> commit dance as a\npackage-level Upload helper consumed by Phase 3.1.5 (app screenshots)\nand Phase 3.2.1 (IAP review screenshots). Chunk PUTs go through\nhttp.DefaultClient with no Authorization header so Apple's CDN signed\nURLs validate; the JWT-in\n[…]\nersisted on chunk failure with the right uploaded-set,\ncheckpoint removed after successful commit, MD5 golden vector,\natomic-rename torture under chmod 0500, and path-traversal rejection\non asset IDs.",
          "is_bot": false,
          "headline": "feat(asc): multipart upload helper for screenshots + IAP review scree…",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-02T23:34:00Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "611e4ec1e6e61a3dce11e63b763da7fe4ae6b17a",
          "body": "Apple's /v1/salesReports and /v1/financeReports endpoints respond\nexclusively with content-type \"application/a-gzip\" and reject the\ndefault \"Accept: application/json\" with HTTP 406 Not Acceptable.\n\nSurfaced live during Phase 2A.4 gate smoke against the real ASC for\nthe dev-corelift account: skipper \n[…]\nw negotiate correctly.\n\nThe existing async tests didn't catch this — they used inline httptest\nservers that ignore Accept. A future qa pass should add an Accept\nassertion in the report-endpoint mocks.",
          "is_bot": false,
          "headline": "fix(asc): add Accept-header override on c.do for gzip report endpoints",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-02T23:22:24Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "114d8793590bbb6fc00ce80d258e98ce3620e7bc",
          "body": "Threads a single httptest backend across two distinct *Client\ninstances to model an operator hitting Ctrl-C mid-poll and a fresh\nprocess resuming. Verifies:\n\n  * Run 2 sees RPT-A and RPT-B re-emitted by the wrapper (the\n    wrapper does not dedup against AsyncState — the contract is\n    caller-side)\n[…]\nny analytics-backend\n    HTTP call (asserted via the fixture's reportListCalls canary).\n  * DownloadedSegments round-trips through Persist/Load so segment\n    dedup works the same way as report dedup.",
          "is_bot": false,
          "headline": "test(asc): resume-after-Ctrl-C integration coverage",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-02T23:06:14Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e033d93ded00da46982c7075d4e84778efb293b0",
          "body": "Adds a hand-crafted canonical state fixture under\ntestdata/golden/async/ and verifies it round-trips byte-for-byte\nthrough Load + Persist. Catches accidental json-tag drift,\nfield-order swaps, and MarshalIndent format changes.\n\nThree corruption fixtures (truncated, future schema, invalid json)\nexerc\n[…]\nre by chmod'ing\nthe state directory read-only mid-flow, then verifies the original\nfile is byte-equivalent to its pre-state and no orphan tmp files\nremain. Skipped on Windows and when running as root.",
          "is_bot": false,
          "headline": "test(asc): golden round-trip + corruption coverage for AsyncState",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-02T23:04:22Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "09675b922779e9d0fbfde2d0d8ddb36ce64c9af4",
          "body": "Apple represents a failed/stopped analytics request via\nstoppedDueToInactivity rather than a discrete error status. Add a\nfixture covering that state so the cross-state coverage is complete:\nreports_queued (empty), reports_processing, reports_completed, and now\nreports_failed (a request response with stoppedDueToInactivity=true).",
          "is_bot": false,
          "headline": "test(asc): add failed-state analytics fixture",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-02T23:02:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "da2525d46594150c7ee9e6d6868edfd437d1bd38",
          "body": "Adds `subscriptions reports` subcommand under the existing\nsubscriptions group. Distinct from `subscriptions list` /\n`subscriptions get` (Phase 2.4 configuration view) — this is\nthe analytical time-series surface backed by /v1/salesReports\nwith reportType ∈ {SUBSCRIPTION, SUBSCRIPTION_EVENT, SUBSCRI\n[…]\ne rest of the report family: table / json / tsv.\n\nReuses fetchSalesAcrossDates from sales.go for the per-date\nfan-out loop — these reports share Apple's wire endpoint and\ngunzip+TSV decoding pipeline.",
          "is_bot": false,
          "headline": "feat(cmd): subscription time-series reports (summary/events/retention)",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-02T20:58:29Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "66976a77fb85be297196223f7459898c57a39475",
          "body": "Wraps /v1/financeReports with --month YYYY-MM and --year YYYY\nflags (mutually exclusive). Apple only produces monthly and\nyearly finance reports — daily granularity belongs to the\nsales command. Region defaults to Z1 (worldwide) and can be\nnarrowed with --region (e.g. US, GB).\n\nThe bundleId arg filt\n[…]\nefix; --output tsv streams Apple's raw wire format\nunfiltered. Table mode collapses the per-row data into a\ncountry/currency partner-share breakdown, which is how Apple\nactually settles these payouts.",
          "is_bot": false,
          "headline": "feat(cmd): finance settlement report fetch (monthly/yearly)",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-02T20:56:39Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1109fcee9b8af94d24404ffdf2264c7b9da2b051",
          "body": "Wraps /v1/salesReports with mutually-exclusive date flags:\n--days N (default 7) for daily windows, --month YYYY-MM for\nsingle-month, --week YYYY-MM-DD for week-aligned, --year YYYY\nfor annual. Frequency is inferred from the date flag and can\nbe overridden with --frequency.\n\nSales reports are vendor-\n[…]\nfan out one API call per date — Apple returns a\nsingle date per /v1/salesReports invocation regardless of\nfrequency. Tests use a programmable gz-TSV httptest server\nsince helpers_test.go is JSON-only.",
          "is_bot": false,
          "headline": "feat(cmd): sales report fetch with table/json/tsv output",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-02T20:54:43Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "15c1162212fce926dd71591c20a1a10ac21384df",
          "body": "Apple's /v1/salesReports and /v1/financeReports respond with\ngzipped TSV (not CSV). The 2A.1 async wrapper gunzips; this\nfile decodes the resulting bytes into typed Go structs the\ncmd-layer renders.\n\nHeader-driven dispatch keeps the decoder forward-compatible:\nwhen Apple adds a column, unknown heade\n[…]\nhly basic) covering\nreturns, multi-currency, subscriptions, and the empty-file\nshape Apple sends on no-sales days. Vendor number 99999999\nand bundleId com.example.testapp throughout — never real data.",
          "is_bot": false,
          "headline": "feat(asc): typed sales/finance TSV row models + decoders",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-02T20:51:15Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "19cdd66cafa443eacc8feec509fdd1e640bb8996",
          "body": "Wires the four-verb analytics CLI on top of the async-poll wrapper:\n\n- `analytics request <bundleId> --access-type ...` submits a new\n  request, persists state via PersistAsyncState, and (with --wait)\n  drives PollAnalyticsReport until the request reaches a terminal\n  state. --max-duration is mandat\n[…]\nics.json\nand every read verb errors with a clear remediation hint when no\nprior state exists.\n\nHand-crafted golden fixtures for each lifecycle stage land under\ninternal/asc/testdata/golden/analytics/.",
          "is_bot": false,
          "headline": "feat(cmd): analytics request/list-instances/download/status verbs",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-02T20:49:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "31a266e8f632050028f6174988c3e548f907dbf7",
          "body": "Adds the wrapper-side helpers the analytics CLI consumes on top of\nthe async-poll primitives in async.go:\n\n- AnalyticsReportFilter + (*Client).FilterAnalyticsReports for the\n  client-side narrowing of /v1/analyticsReportRequests/{id}/reports\n  responses (Apple's endpoint accepts no query parameters)\n[…]\n SegmentDownloadResult + ParseSegmentDownload to surface the parsed\n  CSV header alongside the gunzipped bytes. Bytes are intentionally\n  excluded from the JSON contract — the CLI writes them to disk.",
          "is_bot": false,
          "headline": "feat(asc): analytics report filter + segment download view",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-02T20:37:26Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a9f97ec90c83664b29c23e8cd8829d2fa3bc644e",
          "body": "Programmable httptest.Server harness (asyncFixture) lets each test step\nthrough Apple's analytics request lifecycle by mutating the in-memory\nreport/instance/segment model between polls. Coverage:\n\nPollAnalyticsReport\n- queued → completed: yields each report exactly once, terminates cleanly\n  on the\n[…]\nl\n  state file\n- Resume-after-Ctrl-C: state survives a fresh process and the de-dup set\n  reconstructs from saved Reports so PollAnalyticsReport on a second run\n  yields only the newly-arrived reports",
          "is_bot": false,
          "headline": "test(asc): async-poll lifecycle + state-persistence coverage",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-02T20:32:13Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4b989b0d1f2ebcf2481c2a4494bd1f3572094f03",
          "body": "…e errs\n\n- Decompose the polling iterator into runPollStep / yieldNewReports /\n  sleepWithCancel / nextBackoff so the public iterator stays under the\n  cyclomatic-complexity threshold without losing the inline narrative\n  comments that explain the lifecycle.\n- ErrStateCorrupt now wraps the underlyin\n[…]\n the sentinel AND the inner json.SyntaxError.\n\nNo behavioural change — the iterator's contract is unchanged, the state\nfile format is unchanged, and the test suite passes identically before\nand after.",
          "is_bot": false,
          "headline": "refactor(asc): split PollAnalyticsReport iterator + wrap corrupt-stat…",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-02T20:31:56Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "062aebb350ec540eaea39702e033a9a78a384218",
          "body": "Analytics requests can take hours, so a Ctrl-C, ssh disconnect, or reboot\nbetween submit and download must not lose work. AsyncState is the JSON-\non-disk shape that lets a fresh Skipper invocation resume from where the\nprevious one stopped.\n\n- Path layout: $XDG_STATE_HOME/skipper/<bundleId>/<reportC\n[…]\ndocumented in user-facing surfaces.\n\nDownloadedSegments and Reports give 2A.3's resume path the data it needs\nto skip already-fetched segments and to reconstruct the iterator's\nde-dup set across runs.",
          "is_bot": false,
          "headline": "feat(asc): on-disk state for resumable async-poll lifecycles",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-02T20:28:06Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c3108a76fd562ba95e96480518a34effd5fc537c",
          "body": "Apple's analytics, sales, and finance report APIs all use a request → wait\n→ poll → download flow that's distinct from the rest of the surface. This\nadds the wrapper-level public API every Phase 2A.2 / 2A.3 command will\nconsume:\n\n- RequestAnalyticsReport submits POST /v1/analyticsReportRequests with\n[…]\nGranularity,\nSalesFrequency, SalesReportType, SalesReportSubType, FinanceReportType\nmirror the spec literals exactly.\n\nNo new deps — stdlib net/http, compress/gzip, encoding/json, iter,\ncontext, time.",
          "is_bot": false,
          "headline": "feat(asc): async-poll wrapper for analytics + sales/finance reports",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-02T20:26:55Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d08a332f807c976576ffc71d1a1cc8811d3ec9cc",
          "body": "Phase 2.5 qa-eng pass. Two new test files closing two coverage gaps\nthat emerged once Phase 2 hit 22 commands.\n\njson_stability_test.go: table-driven snapshot of top-level + nested-row\nJSON keys for every Phase 1+2 command. The keys are a contract — adding\nfields is fine, renaming or removing breaks \n[…]\n. Asserts errors.Is sentinel preservation, errors.As\nHTTPStatus extraction, no JWT/key-id/issuer-id leakage in user-facing\noutput, and pagination-error bubbling. Resolves QA-003 (closed in same\nturn).",
          "is_bot": false,
          "headline": "test(cmd): cross-cutting json-stability + error-redaction coverage",
          "author_name": "ul0gic",
          "author_login": "ul0gic",
          "committed_at": "2026-05-02T20:09:44Z",
          "body_truncated": true,
          "is_coding_agent": false
        }
      ],
      "releases_count": 3,
      "commits_last_year": 129,
      "latest_release_at": "2026-07-21T01:41:28Z",
      "latest_release_tag": "v0.7.0",
      "releases_from_tags": false,
      "days_since_last_push": 9,
      "active_weeks_last_year": 4,
      "days_since_latest_release": 9,
      "mean_days_between_releases": 8.6
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": true,
      "health_percentage": 71,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "github.com/ul0gic/flightline",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": true,
          "registry_url": "https://pkg.go.dev/github.com/ul0gic/flightline",
          "is_deprecated": false,
          "latest_version": "v0.7.0",
          "repository_url": "https://github.com/ul0gic/flightline",
          "versions_count": 4,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-21T01:36:44Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 9
        }
      ]
    },
    "popularity": {
      "forks": 1,
      "stars": 3,
      "watchers": 0,
      "fork_history": {
        "days": [
          {
            "date": "2026-07-28",
            "count": 1
          }
        ],
        "complete": true,
        "collected": 1,
        "total_forks": 1
      },
      "star_history": null,
      "open_issues_and_prs": 0
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [],
      "has_llms_txt": false,
      "has_dockerfile": false,
      "has_mcp_signal": false,
      "bootstrap_files": [
        "Makefile"
      ],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [
        "go.mod"
      ],
      "largest_source_bytes": 45786,
      "source_files_sampled": 186,
      "oversized_source_files": 0,
      "agent_instruction_files": [],
      "agent_instruction_max_bytes": null
    },
    "dependencies": {
      "manifests": [
        "go.mod"
      ],
      "advisories": {
        "error": null,
        "scope": null,
        "source": null,
        "findings": [],
        "collected": false,
        "malicious": [],
        "truncated": false,
        "by_severity": {},
        "advisory_count": 0,
        "affected_count": 0,
        "assessed_count": 0,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "go"
      ],
      "dependencies": [
        {
          "name": "github.com/santhosh-tekuri/jsonschema/v6",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v6.0.2"
        },
        {
          "name": "github.com/spf13/cobra",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.10.2"
        },
        {
          "name": "github.com/spf13/viper",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.21.0"
        },
        {
          "name": "go.yaml.in/yaml/v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.0.4"
        }
      ],
      "all_dependencies": {
        "error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
        "source": null,
        "packages": [],
        "collected": false,
        "truncated": false,
        "total_count": null,
        "direct_count": null,
        "indirect_count": null
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 0,
        "open_issues": 0,
        "closed_ratio": null,
        "closed_issues": 0,
        "closed_unmerged_prs": 0
      },
      "bus_factor": 1,
      "bot_contributors": 0,
      "top_contributors": [
        {
          "type": "User",
          "login": "ul0gic",
          "commits": 129,
          "avatar_url": "https://avatars.githubusercontent.com/u/243013912?v=4"
        }
      ],
      "contributors_sampled": 1,
      "top_contributor_share": 1
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "ci.yml",
        "codeql.yml",
        "release.yml"
      ],
      "has_docs_dir": true,
      "linter_configs": [
        ".golangci.yml"
      ],
      "has_editorconfig": true,
      "has_linter_config": true,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "go.sum"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": null,
            "reason": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": null,
            "reason": "no pull request found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/30 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 0,
            "reason": "project has 0 contributing companies or organizations -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 0,
            "reason": "no update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 0,
            "reason": "project was created within the last 90 days. Please review its contents carefully",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": 10,
            "reason": "packaging workflow detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 8,
            "reason": "dependency not pinned by hash detected -- score normalized to 8",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 10,
            "reason": "SAST tool detected: CodeQL",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 10,
            "reason": "security policy file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": 8,
            "reason": "3 out of the last 3 releases have a total of 3 signed artifacts.",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 10,
            "reason": "GitHub workflow tokens follow principle of least privilege",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 8,
            "reason": "2 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "e2ac4bfe78bd0bb88a43caf2f3e1414013b28069",
        "ran_at": "2026-07-30T02:52:44Z",
        "aggregate_score": 6.2,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": true,
      "has_security_policy": true,
      "has_dependabot_config": false
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-27T08:02:18Z",
      "oldest_open_prs": [],
      "last_merged_pr_at": null,
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": []
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/ul0gic/flightline",
    "host": "github.com",
    "name": "flightline",
    "owner": "ul0gic"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "moderate",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 55,
      "inputs": {
        "security": 62,
        "vitality": 69,
        "community": 35,
        "governance": 31,
        "engineering": 79
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "moderate",
        "name": "Vitality",
        "value": 69,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "moderate",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 50,
            "inputs": {
              "commits_last_year": 129,
              "human_commit_share": 1,
              "days_since_last_push": 9,
              "active_weeks_last_year": 4
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 9 days ago",
                "points": 28.8,
                "status": "partial",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 9
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "4/52 weeks with commits",
                "points": 2.8,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 4
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "129 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 129
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": null,
            "notes": [],
            "value": 98,
            "inputs": {
              "releases_count": 3,
              "latest_release_tag": "v0.7.0",
              "releases_from_tags": false,
              "days_since_latest_release": 9,
              "mean_days_between_releases": 8.6
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "3 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 3
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 9 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 9
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~8.6 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 8.6
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "3 out of the last 3 releases have a total of 3 signed artifacts.",
                "points": 8,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "at_risk",
        "name": "Community & Adoption",
        "value": 35,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 5,
            "inputs": {
              "forks": 1,
              "stars": 3,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "3 stars",
                "points": 4.9,
                "status": "partial",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 3
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "1 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "good",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 70,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": true,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (MIT)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "MIT"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 18,
                "status": "met",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "at_risk",
        "name": "Sustainability & Governance",
        "value": 31,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 10,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 1,
              "top_contributor_share": 1
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 100% of commits",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 100
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "1 contributors",
                "points": 1.4,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 0 contributing companies or organizations -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "critical",
            "name": "Issue & PR responsiveness",
            "note": "Excluded from scoring (no data or not applicable): Issue resolution, PR acceptance. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "issue_resolution",
                    "pr_acceptance"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 1,
            "inputs": {
              "merged_prs": 0,
              "open_issues": 0,
              "closed_issues": 0,
              "issue_closed_ratio": null,
              "closed_unmerged_prs": 0
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "no issues or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_issues_or_data",
                    "params": {}
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "no decided pull requests or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_decided_prs_or_data",
                    "params": {}
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "at_risk",
            "name": "Ownership & stewardship",
            "note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "verified_domain"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 37,
            "inputs": {
              "followers": 16,
              "owner_type": "User",
              "is_verified": null,
              "owner_login": "ul0gic",
              "public_repos": 16,
              "account_age_days": 262
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "personal (user) account",
                "points": 10,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_personal",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": "not applicable to user accounts",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_applicable_to_user_accounts",
                    "params": {}
                  }
                ],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "16 followers of ul0gic",
                "points": 8.8,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 16,
                      "login": "ul0gic"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "16 public repos, account ~0 yr old",
                "points": 10.4,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 16
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 0
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 92,
            "inputs": {
              "packages": [
                "github.com/ul0gic/flightline"
              ],
              "ecosystems": "go",
              "any_deprecated": false,
              "min_days_since_publish": 9
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on go",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "go"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 9 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 9
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "4 published versions",
                "points": 12,
                "status": "partial",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 4
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "good",
        "name": "Engineering Quality",
        "value": 79,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "excellent",
            "name": "Engineering practices",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_ci_tests"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 88,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": true,
              "has_linter_config": true,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "3 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 3
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": ".golangci.yml",
                "points": 16,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yml"
                    }
                  }
                ],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 6.4,
                "status": "met",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "moderate",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 65,
            "inputs": {
              "topics": [],
              "has_wiki": false,
              "homepage": null,
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "moderate",
        "name": "Security",
        "value": 62,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "moderate",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): Branch-Protection, CI-Tests. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "branch_protection",
                    "ci_tests"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 62,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 16,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 2,
              "scorecard_aggregate": 6.2
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 0 contributing companies or organizations -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "no update tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 8",
                "points": 4,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool detected: CodeQL",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "3 out of the last 3 releases have a total of 3 signed artifacts.",
                "points": 6,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "GitHub workflow tokens follow principle of least privilege",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "2 existing vulnerabilities detected",
                "points": 6,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 2
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "moderate",
        "name": "AI Readiness",
        "value": 69,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "at_risk",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 0.99,
              "agent_instruction_files": [],
              "agent_instruction_max_bytes": null
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "no CLAUDE.md / AGENTS.md / editor rules",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_instructions",
                    "params": {}
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "99 of 100 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 99,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "good",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 80,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "go.sum"
              ],
              "has_dockerfile": false,
              "typed_language": true,
              "bootstrap_files": [
                "Makefile"
              ],
              "has_devcontainer": false,
              "has_linter_config": true,
              "typecheck_configs": [],
              "agent_commit_share": 0,
              "toolchain_manifests": [
                "go.mod"
              ],
              "dependency_bot_commit_share": 0
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "Makefile",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Makefile"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": ".golangci.yml",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yml"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "Go (statically typed)",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "no agent-authored commits among the last 100",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_authored_commits",
                    "params": {
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "no automated dependency updates observed",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_dependency_automation",
                    "params": {}
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 8",
                "points": 8,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "Go",
              "largest_source_bytes": 45786,
              "source_files_sampled": 186,
              "oversized_source_files": 0
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Go (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "0/186 source files over 60KB",
                "points": 55,
                "status": "met",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 186,
                      "oversized": 0
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
    "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-30T02:52:48.899043Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/u/ul0gic/flightline.svg",
  "full_name": "ul0gic/flightline",
  "license_state": "standard",
  "license_spdx": "MIT"
}