Protocol-Wealth / pwos-core

每颗 star 和每个 fork 的添加时间，来自 GitHub 并按天汇总。累计增长位于其构成来源——每日新增——的正上方，二者可相互对照：稳定的自然增长与短暂的突增形态截然不同。当这一差别可被衡量时，它会作为增长真实性予以报告。

来自 GitHub 依赖图的完整解析依赖集合：2 个直接依赖与 242 个间接（传递）软件包。仓库提交锁文件时，传递闭包才是完整的。

该仓库未发布可被索引解析的包，因此评估的是其自身的依赖图——共 239 个包，其中也包含从不交付的开发与测试版本固定：2 个存在已知公告，0 个为直接依赖。 有 5 个无法评估——没有已解析的版本、生态系统不受支持，或不在所列包清单之内。

公告表示依赖图中记录的版本落入某条公告的受影响范围。可达性未经分析，且依赖图包含开发与测试的版本固定——某项发现可能只涉及工具链而非交付的软件。

{
  "data": {
    "repo": {
      "topics": [
        "advisory",
        "ai",
        "compliance",
        "crm-system",
        "digital",
        "fintech",
        "open-source",
        "pii-detection",
        "pii-redaction",
        "productivity-tools",
        "ria",
        "wealth-management",
        "agent-tools",
        "governance",
        "mcp",
        "regulated-finance"
      ],
      "is_fork": false,
      "size_kb": 911,
      "has_wiki": true,
      "homepage": "https://protocolwealthllc.com/opensource",
      "languages": {
        "PLpgSQL": 3240,
        "JavaScript": 13252,
        "TypeScript": 814584
      },
      "pushed_at": "2026-07-20T03:35:56Z",
      "created_at": "2026-04-09T15:13:32Z",
      "owner_type": "Organization",
      "updated_at": "2026-07-19T15:26:04Z",
      "description": "Open source compliance-first AI operating system for SEC-registered investment advisers. Apache 2.0 licensed with defensive patent grant.",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "Apache-2.0",
      "default_branch": "main",
      "license_spdx_raw": "Apache-2.0",
      "primary_language": "TypeScript",
      "significant_languages": [
        "TypeScript"
      ]
    },
    "owner": {
      "blog": "https://protocolwealthllc.com/",
      "name": "Protocol Wealth, LLC",
      "type": "Organization",
      "login": "Protocol-Wealth",
      "company": null,
      "location": "United States of America",
      "followers": 5,
      "avatar_url": "https://avatars.githubusercontent.com/u/247803640?v=4",
      "created_at": "2025-12-04T13:22:42Z",
      "is_verified": null,
      "public_repos": 9,
      "account_age_days": 233
    },
    "license": {
      "state": "standard",
      "spdx_id": "Apache-2.0",
      "raw_spdx": "Apache-2.0",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "@protocolwealthos/audit-log@0.5.0",
          "kind": "other",
          "published_at": "2026-05-19T13:08:36Z"
        },
        {
          "tag": "@protocolwealthos/webhooks@0.2.0",
          "kind": "other",
          "published_at": "2026-05-08T21:13:47Z"
        },
        {
          "tag": "@protocolwealthos/crm@0.3.0",
          "kind": "other",
          "published_at": "2026-05-08T21:13:44Z"
        },
        {
          "tag": "@protocolwealthos/auth@0.2.0",
          "kind": "other",
          "published_at": "2026-05-08T21:13:41Z"
        },
        {
          "tag": "@protocolwealthos/cache-keys@0.2.0",
          "kind": "other",
          "published_at": "2026-05-08T21:13:38Z"
        },
        {
          "tag": "@protocolwealthos/holdings@0.2.0",
          "kind": "other",
          "published_at": "2026-05-08T21:13:35Z"
        },
        {
          "tag": "@protocolwealthos/ledger@0.2.0",
          "kind": "other",
          "published_at": "2026-05-08T21:13:32Z"
        },
        {
          "tag": "@protocolwealthos/audit-log@0.3.0",
          "kind": "other",
          "published_at": "2026-05-08T21:13:29Z"
        },
        {
          "tag": "@protocolwealthos/ai-guardrails@0.2.0",
          "kind": "other",
          "published_at": "2026-05-08T21:13:26Z"
        },
        {
          "tag": "@protocolwealthos/security-headers@0.2.0",
          "kind": "other",
          "published_at": "2026-05-08T21:13:23Z"
        },
        {
          "tag": "@protocolwealthos/gcp-helpers@0.2.0",
          "kind": "other",
          "published_at": "2026-05-08T21:13:20Z"
        },
        {
          "tag": "@protocolwealthos/compliance@0.3.0",
          "kind": "other",
          "published_at": "2026-05-08T21:13:17Z"
        },
        {
          "tag": "@protocolwealthos/pii-guard@0.4.0",
          "kind": "other",
          "published_at": "2026-05-08T21:13:14Z"
        },
        {
          "tag": "@protocolwealthos/pii-guard@0.3.0",
          "kind": "other",
          "published_at": "2026-04-29T17:39:28Z"
        },
        {
          "tag": "@protocolwealthos/mcp-tools@0.3.0",
          "kind": "other",
          "published_at": "2026-04-29T17:39:25Z"
        },
        {
          "tag": "@protocolwealthos/onchain-sdk@0.2.0",
          "kind": "other",
          "published_at": "2026-04-13T21:07:18Z"
        },
        {
          "tag": "@protocolwealthos/pii-guard@0.2.0",
          "kind": "other",
          "published_at": "2026-04-13T21:07:12Z"
        },
        {
          "tag": "@protocolwealthos/document-gen@0.2.0",
          "kind": "other",
          "published_at": "2026-04-13T21:07:09Z"
        },
        {
          "tag": "@protocolwealthos/workflow-engine@0.2.0",
          "kind": "other",
          "published_at": "2026-04-13T21:07:06Z"
        },
        {
          "tag": "@protocolwealthos/mcp-tools@0.2.0",
          "kind": "other",
          "published_at": "2026-04-13T21:07:03Z"
        },
        {
          "tag": "@protocolwealthos/email-archive@0.2.0",
          "kind": "other",
          "published_at": "2026-04-13T21:06:56Z"
        },
        {
          "tag": "@protocolwealthos/audit-log@0.2.0",
          "kind": "other",
          "published_at": "2026-04-13T21:07:14Z"
        },
        {
          "tag": "@protocolwealthos/crm@0.2.0",
          "kind": "other",
          "published_at": "2026-04-13T21:07:00Z"
        },
        {
          "tag": "@protocolwealthos/compliance@0.2.0",
          "kind": "other",
          "published_at": "2026-04-13T21:06:54Z"
        },
        {
          "tag": "v1.0.0",
          "kind": "major",
          "published_at": "2026-04-10T13:24:20Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "68bfd6f84dea5303685a9d7fe1f8e6335784ebce",
          "body": "packages/onchain-accounting-contract declares @protocolwealthos/mcp-tools\nworkspace:^0.3.2, but pnpm-lock.yaml still recorded ^0.3.0 (a prior version\nbump raised the spec without regenerating the lockfile). That drift made\npnpm install --frozen-lockfile fail, which blocked the publish preflight's\ncl\n[…]\n\n\nClaude-Session: https://claude.ai/code/session_01FMEYLXopres1u1mgmL5Gsc\n\nCo-authored-by: Nick Rygiel <nick@protocolwealthllc.com>\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(deps): regenerate lockfile for mcp-tools ^0.3.2 spec (#89)",
          "author_name": "Nick Rygiel",
          "author_login": "rivendale",
          "committed_at": "2026-07-19T15:25:58Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "4c924092b8ed58e5c92dc370ef804fff3bf379d7",
          "body": "Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(release): version packages (#88)",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-19T14:27:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "dce504c6801da7efb720fc5429170050b7acadde",
          "body": "…hape (#87)\n\nEvery published @protocolwealthos/* tarball now carries the full Apache-2.0\nLICENSE text and the root NOTICE, and a CI/publish guard prevents the manifests\nfrom silently regressing to shipping raw TypeScript.\n\nFix A - LICENSE / NOTICE now ship:\n- Add scripts/copy-license-notice.mjs, run\n[…]\nXopres1u1mgmL5Gsc\n\nSigned-off-by: Nick Rygiel <nick@protocolwealthllc.com>\nCo-authored-by: Nick Rygiel <nick@protocolwealthllc.com>\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(packaging): ship LICENSE + NOTICE in tarballs and guard publish s…",
          "author_name": "Nick Rygiel",
          "author_login": "rivendale",
          "committed_at": "2026-07-19T14:05:50Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "2b93926408c500fb4286d258827858ac083c6f7d",
          "body": "Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(release): version packages (#86)",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-19T13:21:32Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8cf65f995518344f1894f2e44edd805c73f79902",
          "body": "…ed link (#85)\n\nverifyChain recomputed each entry's hash from that entry's OWN stored\npreviousHash and never asserted the link matched the real predecessor.\nA deleted middle entry, a front-truncated genesis, or an edited row\nwhose own hash was recomputed all passed as \"intact\", defeating the\ntamper-\n[…]\nnesis-truncation.\n\nSigned-off-by: Nick Rygiel <nick@protocolwealthllc.com>\nCo-authored-by: Nick Rygiel <nick@protocolwealthllc.com>\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(audit-log): verify against running predecessor hash + assert stor…",
          "author_name": "Nick Rygiel",
          "author_login": "rivendale",
          "committed_at": "2026-07-19T10:27:38Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "52bda84de0b09cc548d90602a82cc57c11275fd6",
          "body": "Adds the Node/npm/pnpm publication guard and pins the supported maintainer toolchain.\n\nSigned-off-by: Nick Rygiel <nick@protocolwealthllc.com>",
          "is_bot": false,
          "headline": "fix(release): guard local package publication (#84)",
          "author_name": "Nick Rygiel",
          "author_login": "rivendale",
          "committed_at": "2026-07-17T15:42:37Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "da28a23c6c3c2eaed27fa54428375b1c146c31f9",
          "body": "Bumps [typescript](https://github.com/microsoft/TypeScript) from 6.0.3 to 7.0.2.\n- [Release notes](https://github.com/microsoft/TypeScript/releases)\n- [Commits](https://github.com/microsoft/TypeScript/commits)\n\n---\nupdated-dependencies:\n- dependency-name: typescript\n  dependency-version: 7.0.2\n  dep\n[…]\nrect:development\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps)(deps-dev): bump typescript from 6.0.3 to 7.0.2 (#81)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-17T03:44:54Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "49ab4592f37484fc23fecec36a92f0567b4a772d",
          "body": "Version @protocolwealthos/onchain-accounting-contract at 0.2.0, consume its first-release Changeset, align package tests and release documentation, and retain the explicit maintainer-local npm publication gate.\n\nSigned-off-by: Nick Rygiel <nick@protocolwealthllc.com>",
          "is_bot": true,
          "headline": "chore(release): version packages (#83)",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-16T20:49:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "10d10353b3217274325fdfdfc8da545cdf53908a",
          "body": "Add the strict Nexus accounting contract 0.2.0 TypeScript/runtime mirror, exact response and correlation invariants, structural schema hints, tests, and release metadata.\\n\\nSigned-off-by: Nick Rygiel <nick@protocolwealthllc.com>",
          "is_bot": false,
          "headline": "feat: add onchain accounting contract package (#82)",
          "author_name": "Nick Rygiel",
          "author_login": "rivendale",
          "committed_at": "2026-07-16T20:24:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "06bbb2a75982576597b264d8ecb92c3ea5ece6b9",
          "body": "…(#80)\n\nBumps the minor-and-patch group with 3 updates: [tsx](https://github.com/privatenumber/tsx), [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) and [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node).\n\n\nUpdates `tsx` from 4.23.0 to 4.2\n[…]\nion-update:semver-patch\n  dependency-group: minor-and-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps)(deps-dev): bump the minor-and-patch group with 3 updates …",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-15T13:45:44Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "0dc059d81b1549b42d31a9abe9e20ee79dff41e0",
          "body": "…(#79)\n\nBumps the minor-and-patch group with 2 updates: [tsx](https://github.com/privatenumber/tsx) and [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node).\n\n\nUpdates `tsx` from 4.22.4 to 4.23.0\n- [Release notes](https://github.com/privatenumber/tsx/releases)\n- [Ch\n[…]\nion-update:semver-minor\n  dependency-group: minor-and-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps)(deps-dev): bump the minor-and-patch group with 2 updates …",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-06T11:20:25Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8c3f04b4813344d48d82351a9c9e92689128ba33",
          "body": "Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(release): version packages (#77)",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-03T22:19:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0e3b777b918ed69b6d7ca7e36c4932b06428cb7c",
          "body": null,
          "is_bot": false,
          "headline": "docs: clarify public package contract boundary (#78)",
          "author_name": "ALIEF RYANTO RAHMAN",
          "author_login": "lifrmn",
          "committed_at": "2026-07-03T22:14:08Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "420c388811893ddd202650c2d481a5aaa608559a",
          "body": "Signed-off-by: Nick Rygiel <nick@protocolwealthllc.com>",
          "is_bot": false,
          "headline": "chore: close pwos-core audit state",
          "author_name": "Nick Rygiel",
          "author_login": "pwnick",
          "committed_at": "2026-07-01T22:44:30Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a8b538f59d18ed13a4f9c756380403cac4b1c20f",
          "body": "…(#71)\n\nBumps the minor-and-patch group with 1 update: [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node).\n\n\nUpdates `@types/node` from 26.0.0 to 26.0.1\n- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)\n- [Commits](https://github.com/D\n[…]\nion-update:semver-patch\n  dependency-group: minor-and-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps)(deps-dev): bump @types/node in the minor-and-patch group …",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-29T12:46:51Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b491f3f5d04d66eb2830a85011f5b70904bb9588",
          "body": "Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7.\n- [Release notes](https://github.com/actions/checkout/releases)\n- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/actions/checkout/compare/v6...v7)\n\n---\nupdated-dependenc\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(ci)(deps): bump actions/checkout from 6 to 7 (#70)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-29T12:43:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ab05debfa45063f280a54a75df5cadcfd007be94",
          "body": "Co-authored-by: Nick Rygiel <nick@protocolwealthllc.com>",
          "is_bot": false,
          "headline": "chore(deps): resolve open security alerts (#69)",
          "author_name": "Nick Rygiel",
          "author_login": "rivendale",
          "committed_at": "2026-06-25T22:18:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "496673f0a9fe25e9ff38099d7acce382f92cf924",
          "body": "Publishing is done locally by the maintainer (npm login + pnpm\nchangeset:version + changeset:publish); the NPM_API_KEY CI secret is\nintentionally unused. The prior workflow also ran changeset:publish in CI,\nwhich failed on every run because the npm auth path is local-only — making\na routine red run \n[…]\n\n\nClaude-Session: https://claude.ai/code/session_01Y7oLutd9qxpvTUkXGwQ1RU\n\nCo-authored-by: Nick Rygiel <nick@protocolwealthllc.com>\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "ci(release): trim to version-PR-only (publishing is local) (#68)",
          "author_name": "Nick Rygiel",
          "author_login": "rivendale",
          "committed_at": "2026-06-22T13:08:05Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "2a19ff98050a39139262a6b238de7f1b1a8c97d2",
          "body": "Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 25.9.3 to 26.0.0.\n- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)\n- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)\n\n---\nupdated-depe\n[…]\nrect:development\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps)(deps-dev): bump @types/node from 25.9.3 to 26.0.0 (#67)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-22T12:41:25Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c5307d92c3008702490633e6fc90622cb98d9fa5",
          "body": "Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7.\n- [Release notes](https://github.com/actions/checkout/releases)\n- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/actions/checkout/compare/v6...v7)\n\n---\nupdated-dependenc\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(ci)(deps): bump actions/checkout from 6 to 7 (#66)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-22T12:39:16Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3b902dda888ba83240f71f6f391154fe21f91b7f",
          "body": "…ory with 2 updates (#65)\n\nBumps the minor-and-patch group with 2 updates in the / directory: [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) and [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node).\n\n\nUpdates `vitest` from 4.1.8 to 4.1.9\n- \n[…]\nion-update:semver-patch\n  dependency-group: minor-and-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps)(deps-dev): bump the minor-and-patch group across 1 direct…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-20T21:03:11Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5efe71a7c1671560477b421470e23e26d013d7fd",
          "body": "Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(release): version packages (#64)",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-06-20T21:02:34Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "622e6716ca72842e3db234b90f099783f0f9b58e",
          "body": "…es (#63)\n\nAdd a generic wrapWithCompliance<T>(data, options) primitive to\n@protocolwealthos/compliance. It wraps any tool output (e.g. nexus-core's\noptimize_allocation / build_planning_report, which end in a disclaimer)\nwith the firm's compliance posture: a validated DisclosureCard, the\nfirm-approv\n[…]\non @protocolwealthos/disclosure-card. 9 hermetic vitest\ncases. Minor changeset queued.\n\nSigned-off-by: Nick Rygiel <nick@protocolwealthllc.com>\nCo-authored-by: Nick Rygiel <nick@protocolwealthllc.com>",
          "is_bot": false,
          "headline": "feat(compliance): add wrapWithCompliance for firm tool-output envelop…",
          "author_name": "Nick Rygiel",
          "author_login": "rivendale",
          "committed_at": "2026-06-16T01:43:52Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "64ac8b7740459002c315be5b92333eb0e57ef284",
          "body": "…(#61)\n\nBumps the minor-and-patch group with 2 updates: [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) and [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node).\n\n\nUpdates `vitest` from 4.1.7 to 4.1.8\n- [Release notes](https://github.com/vit\n[…]\nion-update:semver-patch\n  dependency-group: minor-and-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps)(deps-dev): bump the minor-and-patch group with 2 updates …",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-08T13:50:32Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8e0cccedbb77749e4a1bd88bbe9decc9e5783e9d",
          "body": "…-1] (#60)\n\nDev-facing reference: how an MCP-compatible agent platform such as SmythOS can\ncall the @protocolwealthos/* compliance/credential layer over the open Model\nContext Protocol. Compatibility, not a partnership/endorsement; SmythOS does\nnot integrate PWOS today. No tool count cited (unreconc\n[…]\napproves the SmythOS MCP positioning\ndecision doc (shared) by PR comment.\n\nCo-authored-by: Nick Rygiel <nick@protocolwealthllc.com>\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: add PWOS + SmythOS reference-integration note [HELD: CCO 206(4)…",
          "author_name": "Nick Rygiel",
          "author_login": "rivendale",
          "committed_at": "2026-06-04T20:27:28Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "40d70acf4483fc0d123ef9118b765451e56acd56",
          "body": "Co-authored-by: Nick Rygiel <nick@protocolwealthllc.com>\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: add GitHub stars badge to README (#59)",
          "author_name": "Nick Rygiel",
          "author_login": "rivendale",
          "committed_at": "2026-06-04T19:37:15Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "19a6489ff0bfa9079a0fb1ee8536e6a85300d08e",
          "body": "Publishes the system drawing (Fig. 1) of USPTO #64/034,215 as Apache-2.0\nprior art at docs/PW-PROV-001-FIG1.pdf, linked from the README \"Patent & IP\"\nsection and the PATENTS non-assertion pledge.\n\nCo-authored-by: Nick Rygiel <nick@protocolwealthllc.com>\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: add PW-PROV-001 Figure 1 drawing (defensive prior art) (#58)",
          "author_name": "Nick Rygiel",
          "author_login": "rivendale",
          "committed_at": "2026-06-04T16:15:48Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "a85cb8a64a7a6464956a056ab6cfa3ff6cdaad7a",
          "body": "NOTICE → uniform \"Defensive patent posture\" block (matches nexus-core +\npwplan-core): explicit Apache-2.0 Section 3 royalty-free grant + retaliation\nclause, and the canonical OIN line pointing to openinventionnetwork.com + the\nPATENTS file. README \"Patent & IP\" gains the pwos.app/patent disclosure l\n[…]\novisional #64/082,241. pwos-core's\nown patent (#64/034,215) is unchanged.\n\nCo-authored-by: Nick Rygiel <nick@protocolwealthllc.com>\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: standardize defensive-IP NOTICE + list 3rd family patent (#57)",
          "author_name": "Nick Rygiel",
          "author_login": "rivendale",
          "committed_at": "2026-06-04T15:58:37Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "879025c08bc320875b4c3d166e8b5feeca51adc3",
          "body": "…otation (#56)\n\nBy decision, @protocolwealthos packages publish via a local `pnpm publish` after\n`npm login` (account nickrygiel). The CI NPM_API_KEY automation is intentionally\nunused — no token rotation; local auth each release is the standing process. Use\npnpm (not npm) so workspace:^ deps rewrit\n[…]\nublish-path note.\n\nSigned-off-by: Nick Rygiel <nick@protocolwealthllc.com>\nCo-authored-by: Nick Rygiel <nick@protocolwealthllc.com>\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: release process is local pnpm publish (decided), not CI token r…",
          "author_name": "Nick Rygiel",
          "author_login": "rivendale",
          "committed_at": "2026-06-04T13:08:10Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "447cacb8876ed3703d6d09679c712b304dbdff91",
          "body": "Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(release): version packages (#55)",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-06-04T04:11:25Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ea50cc00ef812eaf782cf89f6ade3f14357471ca",
          "body": "Additive, backward-compatible (v1.0.0 consumers unaffected):\n- contract.ts: PLANNING_CONTRACT_VERSION 1.0.0->1.1.0; AccountBalances.employer_plan_aggregate?.\n- analysis.ts: AcaInteraction interface + YearAnalysis.aca?; DoNothingProjection\n  .employer_plan_aggregate? + .survivor_first_year_rmd_margin\n[…]\nts + build green.\n\nSigned-off-by: Nick Rygiel <nick@protocolwealthllc.com>\nCo-authored-by: Nick Rygiel <nick@protocolwealthllc.com>\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(planning-contract): mirror PlanningContract v1.1.0 (#54)",
          "author_name": "Nick Rygiel",
          "author_login": "rivendale",
          "committed_at": "2026-06-04T04:01:33Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "1290c2e64ac1dda2d56d58136232254ec37ea88c",
          "body": "…) (#53)\n\n- 19 -> 20 packages live; add planning-contract@0.2.0 row + disclosure-card 0.2.0\n  -> 0.3.0 (zod 4) across CURRENT-STATE, ROADMAP, README, CLAUDE.md tree.\n- 'What shipped recently' + CHANGELOG: planning-contract published + the zod 3->4\n  migration (disclosure-card; shared was already cle\n[…]\nAPI_KEY is dead).\n\nSigned-off-by: Nick Rygiel <nick@protocolwealthllc.com>\nCo-authored-by: Nick Rygiel <nick@protocolwealthllc.com>\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: record planning-contract publish + zod-4 migration (20 packages…",
          "author_name": "Nick Rygiel",
          "author_login": "rivendale",
          "committed_at": "2026-06-04T02:20:12Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "f415538f3294cb9c82fe854978431c729c1be7c5",
          "body": "Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(release): version packages (#52)",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-06-04T01:38:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3a3372933025af8a63a57ac31085f593b81fb74e",
          "body": "zod 4 removed the `z.SafeParseReturnType` alias, which broke\n`disclosure-card`'s `tsc` build and therefore the monorepo Release workflow's\n'Build all packages' step (failing since the dependabot zod ^3->^4 bump on\n2026-06-02), blocking all publishes. Replace it with the schema-derived\n`ReturnType<ty\n[…]\n test` all green.\n\nSigned-off-by: Nick Rygiel <nick@protocolwealthllc.com>\nCo-authored-by: Nick Rygiel <nick@protocolwealthllc.com>\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(disclosure-card): support zod 4 (unblocks the release build) (#51)",
          "author_name": "Nick Rygiel",
          "author_login": "rivendale",
          "committed_at": "2026-06-04T01:36:44Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "06f5e30aed263cb5f65b9f01986dfbfd8f966555",
          "body": "… 4.22.3->4.22.4) (#50)\n\nThe planning-contract importer pinned vitest's peer resolution to tsx@4.22.3 while\nthe packages section resolved tsx@4.22.4, so the post-merge Release workflow's\n`pnpm install --frozen-lockfile` failed with ERR_PNPM_LOCKFILE_MISSING_DEPENDENCY.\nRegenerated with the pinned pn\n[…]\n\nversions change.\n\nSigned-off-by: Nick Rygiel <nick@protocolwealthllc.com>\nCo-authored-by: Nick Rygiel <nick@protocolwealthllc.com>\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(deps): correct planning-contract vitest peer key in lockfile (tsx…",
          "author_name": "Nick Rygiel",
          "author_login": "rivendale",
          "committed_at": "2026-06-04T00:00:34Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "89ab3e8b5ce243846fe5285f157bda208c488036",
          "body": "New @protocolwealthos/planning-contract package — the TypeScript mirror of the\nnexus-core Roth-conversion + IRMAA planning ABI:\n\n- PlanningContract input shape + RothConversionAnalysis output shape (v1.0.0),\n  PII-free by construction (opaque case_id, birth years not DOBs, aggregated\n  balances).\n- \n[…]\nChangeset queued.\n\nSigned-off-by: Nick Rygiel <nick@protocolwealthllc.com>\nCo-authored-by: Nick Rygiel <nick@protocolwealthllc.com>\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(planning-contract): PII-free TS ABI for Roth/IRMAA planning (#49)",
          "author_name": "Nick Rygiel",
          "author_login": "rivendale",
          "committed_at": "2026-06-03T23:55:16Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "df23b25035676a409f57c0d38509784a22827226",
          "body": "Bumps [zod](https://github.com/colinhacks/zod) from 3.25.76 to 4.4.3.\n- [Release notes](https://github.com/colinhacks/zod/releases)\n- [Commits](https://github.com/colinhacks/zod/compare/v3.25.76...v4.4.3)\n\n---\nupdated-dependencies:\n- dependency-name: zod\n  dependency-version: 4.4.3\n  dependency-type\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps)(deps): bump zod from 3.25.76 to 4.4.3 (#47)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-02T03:59:11Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9babbc1af0e1815b8df31f288b8b6e0e28aa5924",
          "body": "…(#46)\n\nBumps the minor-and-patch group with 3 updates: [tsx](https://github.com/privatenumber/tsx), [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) and [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node).\n\n\nUpdates `tsx` from 4.22.3 to 4.2\n[…]\nion-update:semver-minor\n  dependency-group: minor-and-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps)(deps-dev): bump the minor-and-patch group with 3 updates …",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-02T03:55:25Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "0f0ec6409cdf0ec2c5526d9aa811566df20d76e9",
          "body": "…n-core) (#48)\n\npwos-core had only CHANGELOG + HANDOFF; per the firm state-discipline framework,\nOSS repos keep a public CURRENT-STATE + ROADMAP for adopters (matching\nnexus-core + pwplan-core). Authored from the live package inventory + CLAUDE.md\n+ HANDOFF:\n\n- CURRENT-STATE.md — 19 published packag\n[…]\nate consumes + out-of-scope boundary.\n\nDoc-only; no package code touched.\n\nCo-authored-by: Nick Rygiel <nick@protocolwealthllc.com>\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: add CURRENT-STATE.md + ROADMAP.md (parity with nexus-core/pwpla…",
          "author_name": "Nick Rygiel",
          "author_login": "rivendale",
          "committed_at": "2026-06-01T13:26:27Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "46667125e54e016a7020420526f05ffb9c98e594",
          "body": "…face boundary (#45)\n\nAdds one-paragraph callout to packages/ai-guardrails/README.md explaining\nthat the workspace-assertion check is the runtime enforcement of PW's ZDR\nAPI-surface boundary — preventing accidental routing through a non-ZDR\nworkspace or the Anthropic Workbench / Claude.ai surfaces (\n[…]\np-ai-posture.md v1.3 §1 bullet 4 (internal).\n\nSurgical addition; no other content touched.\n\nCo-authored-by: Nick Rygiel <nick@protocolwealthllc.com>\nCo-authored-by: Claude Code <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs(ai-guardrails): clarify workspace-assertion enforces ZDR API-sur…",
          "author_name": "Nick Rygiel",
          "author_login": "rivendale",
          "committed_at": "2026-05-28T03:23:52Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "1c66b6290b50be79c2e5b796d020a98caa43ef04",
          "body": "Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(release): version packages (#44)",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-05-27T16:08:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4ae4ae1f43ed87d1263993ea605c9792eacb6ed8",
          "body": "* docs(governance): mirror nexus-core style; fix project-name typo\n\n- CONTRIBUTING.md: full rewrite. Removed references to nonexistent\n  .env.example, pnpm migrate/seed scripts, and apps/web/. Expanded\n  package layout from outdated 9-package list to actual 18 packages\n  under packages/*. Added expl\n[…]\n--\n\nSigned-off-by: Nick Rygiel <nick@protocolwealthllc.com>\nCo-authored-by: Nick Rygiel <nick@protocolwealthllc.com>\nCo-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>",
          "is_bot": false,
          "headline": "Feat/governance hardening (#43)",
          "author_name": "Nick Rygiel",
          "author_login": "rivendale",
          "committed_at": "2026-05-27T15:56:09Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "d751254d1d5b704a8158f9a214d52c653928612b",
          "body": "Bumps [typescript](https://github.com/microsoft/TypeScript) from 5.9.3 to 6.0.3.\n- [Release notes](https://github.com/microsoft/TypeScript/releases)\n- [Commits](https://github.com/microsoft/TypeScript/compare/v5.9.3...v6.0.3)\n\n---\nupdated-dependencies:\n- dependency-name: typescript\n  dependency-vers\n[…]\nrect:development\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps)(deps-dev): bump typescript from 5.9.3 to 6.0.3 (#42)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-27T15:25:10Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "75338c50146a4820e1bfe1e19501017bba238cca",
          "body": "…(#41)\n\nBumps the minor-and-patch group with 2 updates: [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) and [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest).\n\n\nUpdates `@types/node` from 25.8.0 to 25.9.1\n- [Release notes](https://github.\n[…]\nion-update:semver-patch\n  dependency-group: minor-and-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps)(deps-dev): bump the minor-and-patch group with 2 updates …",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-27T15:21:50Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3117067249a16806308c469e9dabe258cd63d1ff",
          "body": "…egress canary (CANONICAL) (#40)\n\nBoth registration preconditions met: (a) ADR-b2b-counterparty-\nclassification.md reached ACCEPTED 2026-05-20 (Protocol-Wealth/pw-shared\n#313), and (b) the cross-repo canary-copy sync landed across all three\nbyte-identical copies (pw-api#261 + pw-portal-v2#72 + the p\n[…]\ns eight patterns.\n\nSigned-off-by: Nick Rygiel <nick@protocolwealthllc.com>\nCo-authored-by: Nick Rygiel <nick@protocolwealthllc.com>\nCo-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs(canonical-patterns): register Pattern #8 — classification-aware …",
          "author_name": "Nick Rygiel",
          "author_login": "rivendale",
          "committed_at": "2026-05-20T03:52:13Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "7a8b07528b8e444ee100da0a2d100271da9311df",
          "body": "…EMERGING → CANONICAL (#39)\n\nPromotion paired with the consumer-side ADR promotion DRAFT → ACCEPTED\n(Protocol-Wealth/pw-shared#300 landed 2026-05-19 ~22:41Z). First production\nconsumer path landed via this repo's #38 (composeAndCallLLM + runnable\ndemo + 5-audit-row trail).\n\nPattern #7 now joins Patt\n[…]\n promotion event.\n\nSigned-off-by: Nick Rygiel <nick@protocolwealthllc.com>\nCo-authored-by: Nick Rygiel <nick@protocolwealthllc.com>\nCo-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs(canonical-patterns): promote Pattern #7 three-tier agent memory …",
          "author_name": "Nick Rygiel",
          "author_login": "rivendale",
          "committed_at": "2026-05-20T00:43:24Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "87bb2deda213ca2661f2b08bcc273e5ac4d256e8",
          "body": "…eal Anthropic call + 5th audit row (Component 7 Week 3 Deliverable 3) (#38)\n\nThe first production consumer path for Pattern #7. Extends the reference\nimplementation with composeAndCallLLM() which closes the loop end-to-end:\nRIAAgentSubstrate.buildAgentContext writes 4 audit rows (chain anchor +\n3 t\n[…]\nerified manually)\n\nSigned-off-by: Nick Rygiel <nick@protocolwealthllc.com>\nCo-authored-by: Nick Rygiel <nick@protocolwealthllc.com>\nCo-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(examples): rias-agent-substrate LLM demo — close the loop with r…",
          "author_name": "Nick Rygiel",
          "author_login": "rivendale",
          "committed_at": "2026-05-20T00:40:21Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "99d97a8ce66829359cfc496dee03756a794612de",
          "body": "…ecture reference (Component 7 Week 2) (#37)\n\nAdds the canonical reference implementation for the three-tier agent memory\narchitecture (per-client / per-advisor / per-firm) composing pwos-core\nsubstrate primitives. Component 7 Week 2 deliverable.\n\nCompanion to ADR (consumer-side; lives in adopter's \n[…]\niefing.md Tier 0.\n\nSigned-off-by: Nick Rygiel <nick@protocolwealthllc.com>\nCo-authored-by: Nick Rygiel <nick@protocolwealthllc.com>\nCo-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(examples): rias-agent-substrate — three-tier agent memory archit…",
          "author_name": "Nick Rygiel",
          "author_login": "rivendale",
          "committed_at": "2026-05-19T21:26:59Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "9077fa0ab1e93331a629b85831d7d5644593e095",
          "body": "…oss-refs (Bob-day P2.3) (#36)\n\n* fix(ts): unblock Release build under @types/node 25 (add types + lib to 6 packages)\n\n@types/node v25 dropped auto-injected globals (TextEncoder) and stricter\ndynamic-import name resolution (TS2591 on `await import(\"node:crypto\")`).\nPer-package tsconfig overrides add\n[…]\nhored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Nick Rygiel <nick@protocolwealthllc.com>\nCo-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs(readme): advisor-facing section + package-to-regulation map + cr…",
          "author_name": "Nick Rygiel",
          "author_login": "rivendale",
          "committed_at": "2026-05-19T15:18:46Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "b6e19f63f3958141956d9322a0354ed9f73fc7d1",
          "body": "…to 6 packages) (#35)\n\n@types/node v25 dropped auto-injected globals (TextEncoder) and stricter\ndynamic-import name resolution (TS2591 on `await import(\"node:crypto\")`).\nPer-package tsconfig overrides add `\"types\": [\"node\"]` + `\"lib\": [\"ES2022\",\n\"DOM\"]` to the 6 packages that hit these patterns:\n\n- \n[…]\n shared/strategy/2026-05-19-overnight-diagnostic-followup-todos.md TODO 3\n\nCo-authored-by: Nick Rygiel <nick@protocolwealthllc.com>\nCo-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(ts): unblock Release build under @types/node 25 (add types + lib …",
          "author_name": "Nick Rygiel",
          "author_login": "rivendale",
          "committed_at": "2026-05-19T13:07:36Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "dc1f80e136d2ea5bafc494ea48fa3d25a148b7e3",
          "body": "Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6.\n- [Release notes](https://github.com/actions/checkout/releases)\n- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/actions/checkout/compare/v4...v6)\n\n---\nupdated-dependenc\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(ci)(deps): bump actions/checkout from 4 to 6 (#32)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-19T03:17:19Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6e1d2bc00e7969981bcf4684f005058c60abcd76",
          "body": "Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 22.19.19 to 25.8.0.\n- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)\n- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)\n\n---\nupdated-de\n[…]\nrect:development\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps)(deps-dev): bump @types/node from 22.19.19 to 25.8.0 (#33)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-19T03:17:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "cf7a5a2f061acc5f3b72adbd16feccf80f50760a",
          "body": "…026-05-18→19 cascade (#34)\n\nDoc-refresh-only iteration; no code change. Captures operational depth + recent\nshipping cadence visible at the README + canonical-patterns surface; pwos-core's\npublished packages and CI workflows unchanged.\n\nREADME.md:\n- Added \"Who built this\" section anchoring PW as SE\n[…]\nosture\npreserved.\n\nSigned-off-by: Nick Rygiel <nick@protocolwealthllc.com>\nCo-authored-by: Nick Rygiel <nick@protocolwealthllc.com>\nCo-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: refresh README + CHANGELOG + canonical-patterns reference for 2…",
          "author_name": "Nick Rygiel",
          "author_login": "rivendale",
          "committed_at": "2026-05-19T03:11:56Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "cf6df628e9fe2aba384157fafa01d9741b31149a",
          "body": "Phase 0.5 Tier 2 actual-compaction spike test vehicle. Adds\nconcurrency: cancel-in-progress to prevent overlapping workflow runs\non the same ref. See shared/strategy/dispatch-compaction-spike-tier2-test-design.md.\n\nCo-authored-by: Nick Rygiel <nick@protocolwealthllc.com>\nCo-authored-by: Claude Code <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "ci: add concurrency block to license-compliance + spdx-headers (#31)",
          "author_name": "Nick Rygiel",
          "author_login": "rivendale",
          "committed_at": "2026-05-16T14:41:22Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "c8b054222f9a18380bffcb3267fdfbd0866766f4",
          "body": "…inor-and-patch-00835a11c2\n\nchore(deps)(deps-dev): bump the minor-and-patch group across 1 directory with 3 updates",
          "is_bot": false,
          "headline": "Merge pull request #30 from Protocol-Wealth/dependabot/npm_and_yarn/m…",
          "author_name": "Nick Rygiel (Protocol Wealth)",
          "author_login": "pwnick",
          "committed_at": "2026-05-15T12:00:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ba04dcf511b993314cca1241b9ea77a4da8e3b9c",
          "body": "…ypescript-6.0.3\n\nchore(deps)(deps-dev): bump typescript from 5.9.3 to 6.0.3",
          "is_bot": false,
          "headline": "Merge pull request #26 from Protocol-Wealth/dependabot/npm_and_yarn/t…",
          "author_name": "Nick Rygiel (Protocol Wealth)",
          "author_login": "pwnick",
          "committed_at": "2026-05-15T12:00:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "566ce0e82f268a05ab7947a0127f7225d1487b5a",
          "body": "…ory with 3 updates\n\nBumps the minor-and-patch group with 2 updates in the / directory: [@changesets/changelog-github](https://github.com/changesets/changesets) and [@changesets/cli](https://github.com/changesets/changesets).\n\n\nUpdates `@changesets/changelog-github` from 0.6.0 to 0.7.0\n- [Release no\n[…]\npendency-version: 22.19.19\n  dependency-type: direct:development\n  update-type: version-update:semver-major\n  dependency-group: minor-and-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "chore(deps)(deps-dev): bump the minor-and-patch group across 1 direct…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-15T12:00:15Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "48b1c26b64a222fcc7b613bc17f7bc7b83845741",
          "body": "…inor-and-patch-427e346a8f\n\nchore(deps)(deps-dev): bump the minor-and-patch group with 2 updates",
          "is_bot": false,
          "headline": "Merge pull request #25 from Protocol-Wealth/dependabot/npm_and_yarn/m…",
          "author_name": "Nick Rygiel (Protocol Wealth)",
          "author_login": "pwnick",
          "committed_at": "2026-05-15T12:00:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1249009e261edf062422839c3ecb9c9d63b5684c",
          "body": "…/actions/setup-node-6\n\nchore(ci)(deps): bump actions/setup-node from 4 to 6",
          "is_bot": false,
          "headline": "Merge pull request #22 from Protocol-Wealth/dependabot/github_actions…",
          "author_name": "Nick Rygiel (Protocol Wealth)",
          "author_login": "pwnick",
          "committed_at": "2026-05-15T11:59:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a7f8f170a89b5850aed91042ef11e0c088cf9268",
          "body": "…/actions/upload-artifact-7\n\nchore(ci)(deps): bump actions/upload-artifact from 4 to 7",
          "is_bot": false,
          "headline": "Merge pull request #21 from Protocol-Wealth/dependabot/github_actions…",
          "author_name": "Nick Rygiel (Protocol Wealth)",
          "author_login": "pwnick",
          "committed_at": "2026-05-15T11:59:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cc4ae0e7312662e519a22bb80b0ac98d6a73cbb1",
          "body": "…/pnpm/action-setup-6\n\nchore(ci)(deps): bump pnpm/action-setup from 4 to 6",
          "is_bot": false,
          "headline": "Merge pull request #24 from Protocol-Wealth/dependabot/github_actions…",
          "author_name": "Nick Rygiel (Protocol Wealth)",
          "author_login": "pwnick",
          "committed_at": "2026-05-15T11:59:25Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "fc97ab6aca347710b881ca0cbe0117ec0be9f946",
          "body": "chore(release): version packages",
          "is_bot": false,
          "headline": "Merge pull request #18 from Protocol-Wealth/changeset-release/main",
          "author_name": "Nick Rygiel (Protocol Wealth)",
          "author_login": "pwnick",
          "committed_at": "2026-05-15T11:59:11Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e69d074f231951a4c24abdcbf8aed2844eabbb3e",
          "body": "…/actions/checkout-6\n\nchore(ci)(deps): bump actions/checkout from 4 to 6",
          "is_bot": false,
          "headline": "Merge pull request #23 from Protocol-Wealth/dependabot/github_actions…",
          "author_name": "Nick Rygiel (Protocol Wealth)",
          "author_login": "pwnick",
          "committed_at": "2026-05-15T11:58:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "507b114db099ce1b0cc5f631f548e4e0f8f25cd5",
          "body": "…346a8f",
          "is_bot": false,
          "headline": "Merge branch 'main' into dependabot/npm_and_yarn/minor-and-patch-427e…",
          "author_name": "Nick Rygiel (Protocol Wealth)",
          "author_login": "pwnick",
          "committed_at": "2026-05-15T11:58:47Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a0ddf74da32b090c94a9b349fa9842fbdde78519",
          "body": null,
          "is_bot": false,
          "headline": "Merge branch 'main' into dependabot/npm_and_yarn/typescript-6.0.3",
          "author_name": "Nick Rygiel (Protocol Wealth)",
          "author_login": "pwnick",
          "committed_at": "2026-05-15T11:58:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e4541ab4ece43baa804911a80b7ba50330dbc177",
          "body": "…ypes/node-25.8.0\n\nchore(deps)(deps-dev): bump @types/node from 22.19.17 to 25.8.0",
          "is_bot": false,
          "headline": "Merge pull request #27 from Protocol-Wealth/dependabot/npm_and_yarn/t…",
          "author_name": "Nick Rygiel (Protocol Wealth)",
          "author_login": "pwnick",
          "committed_at": "2026-05-15T11:56:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6184fb5d9b9249d23ca235ac32675311baebe627",
          "body": "Bumps [typescript](https://github.com/microsoft/TypeScript) from 5.9.3 to 6.0.3.\n- [Release notes](https://github.com/microsoft/TypeScript/releases)\n- [Commits](https://github.com/microsoft/TypeScript/compare/v5.9.3...v6.0.3)\n\n---\nupdated-dependencies:\n- dependency-name: typescript\n  dependency-version: 6.0.3\n  dependency-type: direct:development\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "chore(deps)(deps-dev): bump typescript from 5.9.3 to 6.0.3",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-15T11:56:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3064cf883125caab6f9a5e72d112d0f1350e183f",
          "body": null,
          "is_bot": false,
          "headline": "Merge branch 'main' into dependabot/npm_and_yarn/types/node-25.8.0",
          "author_name": "Nick Rygiel (Protocol Wealth)",
          "author_login": "pwnick",
          "committed_at": "2026-05-15T11:55:23Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7f4ecc886c8abe903c1fdac3dbfb52eb1ba1dc42",
          "body": null,
          "is_bot": true,
          "headline": "chore(release): version packages",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-05-15T11:54:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8aa05582250fff01a45b7ccac4480582616cf5bc",
          "body": "…itest-4.1.6\n\nchore(deps)(deps-dev): bump vitest from 2.1.9 to 4.1.6",
          "is_bot": false,
          "headline": "Merge pull request #28 from Protocol-Wealth/dependabot/npm_and_yarn/v…",
          "author_name": "Nick Rygiel (Protocol Wealth)",
          "author_login": "pwnick",
          "committed_at": "2026-05-15T11:53:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0a2eef7283eff49e6cbd851ebd3a735409d87300",
          "body": "Provisions a CI gate that fails the build if any committed .ts/.tsx\nsource under the workspace lacks an SPDX-License-Identifier header.\nPrevents regression of the pattern cli2 backfilled in PR #20 (shared\nutility packages and early-prototype service code skipping the\nboilerplate); current repo basel\n[…]\nject deps; no local\nhusky/lint-staged stack introduced. Pre-commit DX layer can be added\nin a future iteration if developer friction warrants.\n\nCo-authored-by: Nick Rygiel <nick@protocolwealthllc.com>",
          "is_bot": false,
          "headline": "ci: add SPDX-License-Identifier header check workflow (#29)",
          "author_name": "Nick Rygiel",
          "author_login": "rivendale",
          "committed_at": "2026-05-15T01:30:06Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "0ffdc34a6043dd2f2e54e42597dffd9ad0915bf2",
          "body": "Bumps [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) from 2.1.9 to 4.1.6.\n- [Release notes](https://github.com/vitest-dev/vitest/releases)\n- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.6/packages/vitest)\n\n---\nupdated-dependencies:\n- dependency-name: vitest\n  dependency-version: 4.1.6\n  dependency-type: direct:development\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "chore(deps)(deps-dev): bump vitest from 2.1.9 to 4.1.6",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-15T00:31:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ea0e3669a16796e5887c8596370048f0824d8c71",
          "body": "Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 22.19.17 to 25.8.0.\n- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)\n- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)\n\n---\nupdated-de\n[…]\n\n- dependency-name: \"@types/node\"\n  dependency-version: 25.8.0\n  dependency-type: direct:development\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "chore(deps)(deps-dev): bump @types/node from 22.19.17 to 25.8.0",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-15T00:31:03Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c7b2685b95dbed0e7b37cb1ce594976be63d2949",
          "body": "Bumps the minor-and-patch group with 2 updates: [@changesets/changelog-github](https://github.com/changesets/changesets) and [@changesets/cli](https://github.com/changesets/changesets).\n\n\nUpdates `@changesets/changelog-github` from 0.6.0 to 0.7.0\n- [Release notes](https://github.com/changesets/chang\n[…]\ndependency-version: 2.31.0\n  dependency-type: direct:development\n  update-type: version-update:semver-minor\n  dependency-group: minor-and-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "chore(deps)(deps-dev): bump the minor-and-patch group with 2 updates",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-15T00:30:25Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "bcce38bab98ec602adf73d09e23c8c775242c7e2",
          "body": "Bumps [pnpm/action-setup](https://github.com/pnpm/action-setup) from 4 to 6.\n- [Release notes](https://github.com/pnpm/action-setup/releases)\n- [Commits](https://github.com/pnpm/action-setup/compare/v4...v6)\n\n---\nupdated-dependencies:\n- dependency-name: pnpm/action-setup\n  dependency-version: '6'\n  dependency-type: direct:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "chore(ci)(deps): bump pnpm/action-setup from 4 to 6",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-15T00:29:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "58cd5032fec6d93429cbb951105d5a8ef4f0330a",
          "body": "Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6.\n- [Release notes](https://github.com/actions/checkout/releases)\n- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/actions/checkout/compare/v4...v6)\n\n---\nupdated-dependenc\n[…]\n:\n- dependency-name: actions/checkout\n  dependency-version: '6'\n  dependency-type: direct:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "chore(ci)(deps): bump actions/checkout from 4 to 6",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-15T00:29:43Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "65e3b79266bceeb4ad76b92c0f8551424a90ff42",
          "body": "Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 6.\n- [Release notes](https://github.com/actions/setup-node/releases)\n- [Commits](https://github.com/actions/setup-node/compare/v4...v6)\n\n---\nupdated-dependencies:\n- dependency-name: actions/setup-node\n  dependency-version: '6'\n  dependency-type: direct:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "chore(ci)(deps): bump actions/setup-node from 4 to 6",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-15T00:29:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "32b30a3b9cf3af1ee9aad0a08fa3974fb816033c",
          "body": "Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 7.\n- [Release notes](https://github.com/actions/upload-artifact/releases)\n- [Commits](https://github.com/actions/upload-artifact/compare/v4...v7)\n\n---\nupdated-dependencies:\n- dependency-name: actions/upload-artifact\n  dependency-version: '7'\n  dependency-type: direct:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "chore(ci)(deps): bump actions/upload-artifact from 4 to 7",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-15T00:29:37Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "94880b9ee477a11c53dc67624027e8291ea2f22f",
          "body": "…bot provisioning + SPDX header backfill (#20)\n\nThree bundled Queue D items for pwos-core (public adopter-facing reference framework):\n\n1. README.md (For RIAs and Advisors section): qualify Fly.io recommendation with a\n   Note disclosing PW's own Cloud Run posture for production. Adopter-facing\n   g\n[…]\naudit-log 67, pii-guard 33, ledger 56, etc.)\n  - pnpm run typecheck: clean\n  - YAML lint: dependabot.yml parses (version: 2, 2 update entries)\n\nCo-authored-by: Nick Rygiel <nick@protocolwealthllc.com>",
          "is_bot": false,
          "headline": "chore: weekend hygiene bundle — README Fly.io clarification + dependa…",
          "author_name": "Nick Rygiel",
          "author_login": "rivendale",
          "committed_at": "2026-05-15T00:28:50Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "83362718200e187cd3e810781cceca5a3284b7ec",
          "body": "Adds a `## Status` block before any capability description, stating\npwos-core is a reference framework and starting point not a\nproduction-ready product, adopters are responsible for adding their\nown PII/access/auth/data-handling controls appropriate to their own\nregulatory and security context, and\n[…]\nosture unchanged.\n\nSigned-off-by: Nick Rygiel <nick@protocolwealthllc.com>\nCo-authored-by: Nick Rygiel <nick@protocolwealthllc.com>\nCo-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: public-repo honesty disclaimer (README Status block) (#19)",
          "author_name": "Nick Rygiel",
          "author_login": "rivendale",
          "committed_at": "2026-05-14T11:34:33Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "517e3f93ca6f6e4a0eee95a6e695928e4cea8495",
          "body": "Replace the shallow canonicalize in packages/audit-log/src/hash.ts\nwith a deep stable serializer (stableJsonString) that sorts keys\nrecursively at every nesting level.\n\nThe prior implementation called\n  JSON.stringify(obj, Object.keys(obj).sort())\nwhich only sorts top-level keys; nested objects reta\n[…]\nypecheck clean.\n\nChangeset: .changeset/audit-log-v040-deep-stable-json.md\n\nCo-authored-by: Nick Rygiel <nick@protocolwealthllc.com>\nCo-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(audit-log): deep stable-JSON canonicalization (v0.4.0) (#17)",
          "author_name": "Nick Rygiel",
          "author_login": "rivendale",
          "committed_at": "2026-05-12T19:36:23Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "9037096f078c67aec3b9c85322b5100dfbf6e55a",
          "body": "…emd-for-v0.5.0\n\ndocs: refresh README + CLAUDE.md for v0.4.0 + v0.5.0 packages",
          "is_bot": false,
          "headline": "Merge pull request #16 from Protocol-Wealth/docs/refresh-readme-claud…",
          "author_name": "Nick Rygiel",
          "author_login": "rivendale",
          "committed_at": "2026-05-09T03:21:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "47f63e9bfc45e0098609c592e560a732e4175122",
          "body": "The \"What You Get From npm\" table is now grouped into five categories\nreflecting the 17 packages currently in the workspace. Eight new\npackages shipped this release wave (ai-guardrails, auth, webhooks,\ncache-keys, security-headers, gcp-helpers in v0.4.0; ledger, holdings\nin v0.5.0). Existing package\n[…]\n/ bullet.\n\nNo PW-internal info, no client-specific references, no secrets.\n\nCo-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>\nSigned-off-by: Nick Rygiel <nick@protocolwealthllc.com>",
          "is_bot": false,
          "headline": "docs: refresh README + CLAUDE.md for v0.4.0 + v0.5.0 packages",
          "author_name": "Nick Rygiel",
          "author_login": "pwnick",
          "committed_at": "2026-05-09T03:20:04Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "ccf6227d5da0edbe688ef99a8e6b9866525347cd",
          "body": "chore(release): version packages",
          "is_bot": false,
          "headline": "Merge pull request #14 from Protocol-Wealth/changeset-release/main",
          "author_name": "Nick Rygiel",
          "author_login": "rivendale",
          "committed_at": "2026-05-08T21:11:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5bcdeb4fbaac913a2b8334014fe31d95b701ec31",
          "body": null,
          "is_bot": true,
          "headline": "chore(release): version packages",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-05-08T20:51:33Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3e44114348abcf9bd0d472a8a31b8614597a2bd0",
          "body": "…acked\n\nfeat(v0.5.0): ledger + holdings foundation + crm/pii-guard/auth extensions",
          "is_bot": false,
          "headline": "Merge pull request #15 from Protocol-Wealth/feat/v0.5.0-foundation-st…",
          "author_name": "Nick Rygiel",
          "author_login": "rivendale",
          "committed_at": "2026-05-08T20:50:52Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ae1ebbe5fdb8a2cfd383714fae5331771ee00d79",
          "body": "The agentTokens.ts module shipped its own b64url helper (intentionally\nduplicated to keep agentTokens self-contained) that had the same\npolynomial-redos pattern as the one in jwtSession.ts. The v0.4.0 fix\naddressed jwtSession; this commit applies the equivalent fix here so\nCodeQL stays clean.\n\nVerified: 28 auth tests pass.\n\nCo-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>\nSigned-off-by: Nick Rygiel <nick@protocolwealthllc.com>",
          "is_bot": false,
          "headline": "fix(auth): apply same /=+$/g → /=/g redos fix to agentTokens b64url",
          "author_name": "Nick Rygiel",
          "author_login": "pwnick",
          "committed_at": "2026-05-08T20:48:24Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "1a0b47173329d808dd486f05e93cfcea4484633c",
          "body": "…sions\n\nStacks on v0.4.0. The foundation phase of the financial-data primitives\nroadmap — append-only double-entry ledger and the event-stream/snapshot\npattern that makes audit-grade portfolio data possible. Plus the three\nsmall extensions promised in the v0.5.0 plan: household-profile types\nfor the\n[…]\nt/v0.4.0-ai-guardrails-auth-gcp-helpers); merge\nv0.4.0 first, then v0.5.0.\n\nCo-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>\nSigned-off-by: Nick Rygiel <nick@protocolwealthllc.com>",
          "is_bot": false,
          "headline": "feat(v0.5.0): ledger + holdings foundation + crm/pii-guard/auth exten…",
          "author_name": "Nick Rygiel",
          "author_login": "pwnick",
          "committed_at": "2026-05-08T20:47:48Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "70cf7a5862653ebd111630a058d5eedca0522ba8",
          "body": "…-auth-gcp-helpers\n\nfeat(v0.4.0): six new packages + audit-log/compliance extensions + GCP reference architecture",
          "is_bot": false,
          "headline": "Merge pull request #13 from Protocol-Wealth/feat/v0.4.0-ai-guardrails…",
          "author_name": "Nick Rygiel",
          "author_login": "rivendale",
          "committed_at": "2026-05-08T20:47:25Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ccd8e34a5847b377853f3f6d001a5a38efb0a1c0",
          "body": "CodeQL flagged the anchored `+` quantifier on uncontrolled input as\nhigh-severity polynomial-redos. In our use case the input is bounded\nbase64 (`=` only ever appears as 0–2 trailing padding chars), so the\nnon-anchored `/=/g` produces identical output without the regex risk.\n\nSame fix applied to the\n[…]\nns still round-trip.\n\nVerified: 19 auth tests still pass; typecheck clean.\n\nCo-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>\nSigned-off-by: Nick Rygiel <nick@protocolwealthllc.com>",
          "is_bot": false,
          "headline": "fix(auth): swap /=+$/g for /=/g in b64url to silence js/polynomial-redos",
          "author_name": "Nick Rygiel",
          "author_login": "pwnick",
          "committed_at": "2026-05-08T20:45:55Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "4d0f9f62750c5cc0195d200b4f3c2523b967e8c3",
          "body": "…P reference architecture\n\nThis is the v0.4.0 expansion: closes the open-source promise of \"AI\nmodel-call wrappers, JWT session, role guards\" and extracts the\nproduction-tested patterns for inbound webhook verification, cache-key\nPII rejection, application-layer security headers, and GCP-shaped\nhelp\n[…]\ns for the new packages, one minor for\naudit-log, one minor for compliance.\n\nCo-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>\nSigned-off-by: Nick Rygiel <nick@protocolwealthllc.com>",
          "is_bot": false,
          "headline": "feat(v0.4.0): six new packages + audit-log/compliance extensions + GC…",
          "author_name": "Nick Rygiel",
          "author_login": "pwnick",
          "committed_at": "2026-05-08T19:33:17Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "e758361aed3386fd5a9e65becf03da113212ef58",
          "body": "chore(release): version packages",
          "is_bot": false,
          "headline": "Merge pull request #12 from Protocol-Wealth/changeset-release/main",
          "author_name": "Nick Rygiel (Protocol Wealth)",
          "author_login": "pwnick",
          "committed_at": "2026-04-29T17:38:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4498453bf4bba93a10dfddc4e6875d58f0b6b832",
          "body": null,
          "is_bot": true,
          "headline": "chore(release): version packages",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-04-29T16:46:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "bb4ad06d539291f51cffd85636a27b51b0661958",
          "body": "…stream-rehydrator-tool-audit\n\nfeat: v0.3.0 — confirmation gate + streaming rehydrator + tool-call audit",
          "is_bot": false,
          "headline": "Merge pull request #11 from Protocol-Wealth/feat/v0.3.0-confirm-gate-…",
          "author_name": "Nick Rygiel (Protocol Wealth)",
          "author_login": "pwnick",
          "committed_at": "2026-04-29T16:45:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "96a1371cf251b5151f3dae9afb217934d63d5f91",
          "body": "CLAUDE.md captures repo conventions, release flow, package layout,\nand the OSS boundary (no client-specific code; reference consumer\nlives in pw-os-v2). Mirrors the structure of pw-os-v2's CLAUDE.md\nbut tailored for the OSS monorepo.\n\nREADME adds a new \"What You Get From npm\" table mapping each\npack\n[…]\n.3.0 additions\n(createStreamRehydrator, confirmGate, buildToolAuditEntry).\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>\nSigned-off-by: Nick Rygiel <nick@protocolwealthllc.com>",
          "is_bot": false,
          "headline": "docs: add CLAUDE.md + \"What You Get From npm\" table in README",
          "author_name": "Nick Rygiel",
          "author_login": "pwnick",
          "committed_at": "2026-04-29T16:43:57Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "263d189908f4baa9482bb1d7a1462680512bd388",
          "body": "…titution\n\nThe existing rehydrate() works on a complete string. Streaming\nconsumers face a harder problem: a placeholder like <NAME_1> may\narrive split across two chunks (<NA then ME_1>). A naive per-chunk\nreplace would emit garbled output.\n\ncreateStreamRehydrator() buffers any tail starting with < \n[…]\nould throw in rehydrate() is caught so the stream never\naborts mid-flight.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>\nSigned-off-by: Nick Rygiel <nick@protocolwealthllc.com>",
          "is_bot": false,
          "headline": "feat(pii-guard): streaming rehydrator for chunk-safe placeholder subs…",
          "author_name": "Nick Rygiel",
          "author_login": "pwnick",
          "committed_at": "2026-04-29T16:43:49Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "155abb0b5f50a5b5d0a871b55c4dac53051b9c82",
          "body": "Two new primitives extracted from pw-os-v2's chat-tools surface:\n\nconfirmGate() — stateless two-turn gate for write-class LLM tools.\nFirst call returns a deterministic preview + a confirm_token bound\nto the exact payload (sha256 over key-sorted JSON, truncated to 16\nhex chars). Second call requires \n[…]\ncross the package.\n\nAdds @types/node to mcp-tools devDeps for node:crypto.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>\nSigned-off-by: Nick Rygiel <nick@protocolwealthllc.com>",
          "is_bot": false,
          "headline": "feat(mcp-tools): confirmation gate + tool-call audit row builder",
          "author_name": "Nick Rygiel",
          "author_login": "pwnick",
          "committed_at": "2026-04-29T16:43:39Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "2865cae4e25e415cf5632aaed8bcde5a57187f28",
          "body": "Standard responsible-disclosure policy for Protocol Wealth open-source\nrepos. GitHub renders .github/SECURITY.md natively on the repo's\nSecurity tab and surfaces it to researchers who find vulns.\n\nReporting address: security@protocolwealthllc.com (live, monitored).\nAck SLA: 48 hours. Detailed response SLA: 5 business days.\n\nFrom 2026-04-18 audit Finding F16 (P1).\n\nCo-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(security): add responsible-disclosure SECURITY.md (#10)",
          "author_name": "Nick Rygiel",
          "author_login": "rivendale",
          "committed_at": "2026-04-16T22:03:09Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "1937f8ef3076568ca877a512066af94522e23fb9",
          "body": "…-66w2-5vf9) (#9)\n\nTransitive vite (via vitest ^2.1.0) was resolving to 5.4.21, flagged by\nDependabot under the <=6.4.1 vulnerable range for the path-traversal\nadvisory in optimized-deps .map handling. Bumping to the patched 6.x\nline via pnpm override; vitest 2.x peer deps support vite 6 directly.\n\n\n[…]\n\n\nAll 137 tests across 9 packages pass; typecheck + build green.\n\nResolves GHSA-4w7w-66w2-5vf9 on pwos-core (Dependabot alert #2).\n\nCo-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(deps): pin vite >=6.4.2 <7 to resolve CVE-2026-39365 (GHSA-4w7w…",
          "author_name": "Nick Rygiel",
          "author_login": "rivendale",
          "committed_at": "2026-04-16T21:06:35Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "afaab652dbd77fba345f1dce3d4176f7f423dad7",
          "body": "chore: migrate to Claude Opus 4.7",
          "is_bot": false,
          "headline": "Merge pull request #8 from Protocol-Wealth/chore/opus-4-7-migration",
          "author_name": "Nick Rygiel",
          "author_login": "rivendale",
          "committed_at": "2026-04-16T19:52:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        }
      ],
      "releases_count": 25,
      "commits_last_year": 130,
      "latest_release_at": "2026-05-19T13:08:36Z",
      "latest_release_tag": "@protocolwealthos/audit-log@0.5.0",
      "releases_from_tags": false,
      "days_since_last_push": 5,
      "active_weeks_last_year": 15,
      "days_since_latest_release": 67,
      "mean_days_between_releases": 1.2
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": true,
      "health_percentage": 87,
      "has_issue_template": false,
      "has_code_of_conduct": true,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "@protocolwealthos/crm",
          "exists": true,
          "license": "Apache-2.0",
          "keywords": [],
          "ecosystem": "npm",
          "matches_repo": true,
          "registry_url": "https://www.npmjs.com/package/@protocolwealthos/crm",
          "is_deprecated": false,
          "latest_version": "0.3.2",
          "repository_url": "https://github.com/Protocol-Wealth/pwos-core",
          "versions_count": 4,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": 1,
          "monthly_downloads": 357,
          "first_published_at": "2026-04-13T21:06:49.157000Z",
          "latest_published_at": "2026-07-19T15:39:17.477000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 5
        },
        {
          "name": "@protocolwealthos/auth",
          "exists": true,
          "license": "Apache-2.0",
          "keywords": [],
          "ecosystem": "npm",
          "matches_repo": true,
          "registry_url": "https://www.npmjs.com/package/@protocolwealthos/auth",
          "is_deprecated": false,
          "latest_version": "0.2.1",
          "repository_url": "https://github.com/Protocol-Wealth/pwos-core",
          "versions_count": 2,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": 1,
          "monthly_downloads": 182,
          "first_published_at": "2026-05-08T21:13:05.407000Z",
          "latest_published_at": "2026-07-19T15:39:13.228000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 5
        },
        {
          "name": "@protocolwealthos/ledger",
          "exists": true,
          "license": "Apache-2.0",
          "keywords": [],
          "ecosystem": "npm",
          "matches_repo": true,
          "registry_url": "https://www.npmjs.com/package/@protocolwealthos/ledger",
          "is_deprecated": false,
          "latest_version": "0.2.1",
          "repository_url": "https://github.com/Protocol-Wealth/pwos-core",
          "versions_count": 2,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": 1,
          "monthly_downloads": 188,
          "first_published_at": "2026-05-08T21:13:07.790000Z",
          "latest_published_at": "2026-07-19T15:39:23.854000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 5
        },
        {
          "name": "@protocolwealthos/shared",
          "exists": true,
          "license": "Apache-2.0",
          "keywords": [
            "ai-governance",
            "compliance",
            "hitl",
            "human-in-the-loop",
            "provenance",
            "hash-chain",
            "tamper-evident",
            "sec-204-2",
            "ria"
          ],
          "ecosystem": "npm",
          "matches_repo": true,
          "registry_url": "https://www.npmjs.com/package/@protocolwealthos/shared",
          "is_deprecated": false,
          "latest_version": "0.2.2",
          "repository_url": "https://github.com/Protocol-Wealth/pwos-core",
          "versions_count": 4,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": 1,
          "monthly_downloads": 699,
          "first_published_at": "2026-05-27T16:18:22.031000Z",
          "latest_published_at": "2026-07-19T15:39:30.154000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 5
        },
        {
          "name": "@protocolwealthos/holdings",
          "exists": true,
          "license": "Apache-2.0",
          "keywords": [],
          "ecosystem": "npm",
          "matches_repo": true,
          "registry_url": "https://www.npmjs.com/package/@protocolwealthos/holdings",
          "is_deprecated": false,
          "latest_version": "0.2.1",
          "repository_url": "https://github.com/Protocol-Wealth/pwos-core",
          "versions_count": 2,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": 1,
          "monthly_downloads": 187,
          "first_published_at": "2026-05-08T21:13:05.865000Z",
          "latest_published_at": "2026-07-19T15:39:21.736000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 5
        },
        {
          "name": "@protocolwealthos/audit-log",
          "exists": true,
          "license": "Apache-2.0",
          "keywords": [],
          "ecosystem": "npm",
          "matches_repo": true,
          "registry_url": "https://www.npmjs.com/package/@protocolwealthos/audit-log",
          "is_deprecated": false,
          "latest_version": "0.5.3",
          "repository_url": "https://github.com/Protocol-Wealth/pwos-core",
          "versions_count": 5,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": 1,
          "monthly_downloads": 352,
          "first_published_at": "2026-04-13T21:06:51.395000Z",
          "latest_published_at": "2026-07-19T15:39:13.255000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 5
        },
        {
          "name": "@protocolwealthos/mcp-tools",
          "exists": true,
          "license": "Apache-2.0",
          "keywords": [],
          "ecosystem": "npm",
          "matches_repo": true,
          "registry_url": "https://www.npmjs.com/package/@protocolwealthos/mcp-tools",
          "is_deprecated": false,
          "latest_version": "0.3.2",
          "repository_url": "https://github.com/Protocol-Wealth/pwos-core",
          "versions_count": 4,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": 1,
          "monthly_downloads": 2632,
          "first_published_at": "2026-04-13T21:06:49.840000Z",
          "latest_published_at": "2026-07-19T15:39:23.800000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 5
        },
        {
          "name": "@protocolwealthos/pii-guard",
          "exists": true,
          "license": "Apache-2.0",
          "keywords": [],
          "ecosystem": "npm",
          "matches_repo": true,
          "registry_url": "https://www.npmjs.com/package/@protocolwealthos/pii-guard",
          "is_deprecated": false,
          "latest_version": "0.4.2",
          "repository_url": "https://github.com/Protocol-Wealth/pwos-core",
          "versions_count": 5,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": 1,
          "monthly_downloads": 381,
          "first_published_at": "2026-04-13T21:06:51.689000Z",
          "latest_published_at": "2026-07-19T15:39:27.876000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 5
        }
      ]
    },
    "popularity": {
      "forks": 4,
      "stars": 3,
      "watchers": 1,
      "fork_history": {
        "days": [
          {
            "date": "2026-04-24",
            "count": 1
          },
          {
            "date": "2026-07-02",
            "count": 1
          },
          {
            "date": "2026-07-16",
            "count": 1
          },
          {
            "date": "2026-07-17",
            "count": 1
          }
        ],
        "complete": true,
        "collected": 4,
        "total_forks": 4
      },
      "star_history": null,
      "open_issues_and_prs": 6
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [
        "examples"
      ],
      "has_llms_txt": false,
      "has_dockerfile": false,
      "has_mcp_signal": false,
      "bootstrap_files": [],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [
        "apps/evals/tsconfig.json",
        "examples/rias-agent-substrate/tsconfig.json",
        "packages/ai-guardrails/tsconfig.json",
        "packages/audit-log/tsconfig.json",
        "packages/auth/tsconfig.json",
        "packages/cache-keys/tsconfig.json",
        "packages/compliance/tsconfig.json",
        "packages/crm/tsconfig.json",
        "packages/disclosure-card/tsconfig.json",
        "packages/document-gen/tsconfig.json",
        "packages/email-archive/tsconfig.json",
        "packages/gcp-helpers/tsconfig.json",
        "packages/holdings/tsconfig.json",
        "packages/ledger/tsconfig.json",
        "packages/mcp-tools/tsconfig.json",
        "packages/onchain-accounting-contract/tsconfig.json",
        "packages/onchain-sdk/tsconfig.json",
        "packages/pii-guard/tsconfig.json",
        "packages/planning-contract/tsconfig.json",
        "packages/security-headers/tsconfig.json",
        "packages/shared/tsconfig.json",
        "packages/webhooks/tsconfig.json",
        "packages/workflow-engine/tsconfig.json"
      ],
      "toolchain_manifests": [],
      "largest_source_bytes": 43596,
      "source_files_sampled": 205,
      "oversized_source_files": 0,
      "agent_instruction_files": [
        "AGENTS.md",
        "CLAUDE.md"
      ],
      "agent_instruction_max_bytes": 8933
    },
    "dependencies": {
      "manifests": [
        "package.json"
      ],
      "advisories": {
        "error": null,
        "scope": "repository_graph",
        "source": "osv",
        "findings": [
          {
            "name": "js-yaml",
            "direct": false,
            "version": "5.1.0",
            "severity": "high",
            "ecosystem": "npm",
            "cvss_score": 7.5,
            "advisory_ids": [
              "GHSA-724g-mxrg-4qvm",
              "GHSA-g796-fgmg-93mv",
              "GHSA-pm4m-ph32-ghv5"
            ],
            "fixed_version": "5.2.2",
            "advisory_count": 3,
            "oldest_advisory_days": 4
          },
          {
            "name": "postcss",
            "direct": false,
            "version": "8.5.15",
            "severity": "high",
            "ecosystem": "npm",
            "cvss_score": 7.5,
            "advisory_ids": [
              "GHSA-r28c-9q8g-f849"
            ],
            "fixed_version": "8.5.18",
            "advisory_count": 1,
            "oldest_advisory_days": 0
          }
        ],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {
          "high": 2
        },
        "advisory_count": 4,
        "affected_count": 2,
        "assessed_count": 239,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 5,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "npm"
      ],
      "dependencies": [
        {
          "name": "@protocolwealthos/disclosure-card",
          "manifest": "packages/compliance/package.json",
          "ecosystem": "npm",
          "version_constraint": "workspace:^"
        },
        {
          "name": "zod",
          "manifest": "packages/disclosure-card/package.json",
          "ecosystem": "npm",
          "version_constraint": "^4.4.3"
        },
        {
          "name": "@protocolwealthos/mcp-tools",
          "manifest": "packages/onchain-accounting-contract/package.json",
          "ecosystem": "npm",
          "version_constraint": "workspace:^0.3.2"
        },
        {
          "name": "zod",
          "manifest": "packages/onchain-accounting-contract/package.json",
          "ecosystem": "npm",
          "version_constraint": "^4.4.3"
        },
        {
          "name": "@protocolwealthos/mcp-tools",
          "manifest": "packages/planning-contract/package.json",
          "ecosystem": "npm",
          "version_constraint": "workspace:^"
        },
        {
          "name": "zod",
          "manifest": "packages/shared/package.json",
          "ecosystem": "npm",
          "version_constraint": "^4.4.3"
        }
      ],
      "all_dependencies": {
        "error": null,
        "source": "github-sbom",
        "packages": [
          {
            "name": "zod",
            "direct": true,
            "version": "4.4.3",
            "ecosystem": "npm"
          },
          {
            "name": "zod",
            "direct": true,
            "version": "^4.4.3",
            "ecosystem": "npm"
          },
          {
            "name": "@anthropic-ai/sdk",
            "direct": false,
            "version": "0.97.1",
            "ecosystem": "npm"
          },
          {
            "name": "@babel/runtime",
            "direct": false,
            "version": "7.29.2",
            "ecosystem": "npm"
          },
          {
            "name": "@changesets/apply-release-plan",
            "direct": false,
            "version": "7.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "@changesets/assemble-release-plan",
            "direct": false,
            "version": "6.0.10",
            "ecosystem": "npm"
          },
          {
            "name": "@changesets/changelog-git",
            "direct": false,
            "version": "0.2.1",
            "ecosystem": "npm"
          },
          {
            "name": "@changesets/changelog-github",
            "direct": false,
            "version": "0.7.0",
            "ecosystem": "npm"
          },
          {
            "name": "@changesets/cli",
            "direct": false,
            "version": "2.31.0",
            "ecosystem": "npm"
          },
          {
            "name": "@changesets/config",
            "direct": false,
            "version": "3.1.4",
            "ecosystem": "npm"
          },
          {
            "name": "@changesets/errors",
            "direct": false,
            "version": "0.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "@changesets/get-dependents-graph",
            "direct": false,
            "version": "2.1.4",
            "ecosystem": "npm"
          },
          {
            "name": "@changesets/get-github-info",
            "direct": false,
            "version": "0.8.0",
            "ecosystem": "npm"
          },
          {
            "name": "@changesets/get-release-plan",
            "direct": false,
            "version": "4.0.16",
            "ecosystem": "npm"
          },
          {
            "name": "@changesets/get-version-range-type",
            "direct": false,
            "version": "0.4.0",
            "ecosystem": "npm"
          },
          {
            "name": "@changesets/git",
            "direct": false,
            "version": "3.0.4",
            "ecosystem": "npm"
          },
          {
            "name": "@changesets/logger",
            "direct": false,
            "version": "0.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "@changesets/parse",
            "direct": false,
            "version": "0.4.3",
            "ecosystem": "npm"
          },
          {
            "name": "@changesets/pre",
            "direct": false,
            "version": "2.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "@changesets/read",
            "direct": false,
            "version": "0.6.7",
            "ecosystem": "npm"
          },
          {
            "name": "@changesets/should-skip-package",
            "direct": false,
            "version": "0.1.2",
            "ecosystem": "npm"
          },
          {
            "name": "@changesets/types",
            "direct": false,
            "version": "4.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "@changesets/types",
            "direct": false,
            "version": "6.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "@changesets/write",
            "direct": false,
            "version": "0.4.0",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/aix-ppc64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/android-arm",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/android-arm64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/android-x64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/darwin-arm64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/darwin-x64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/freebsd-arm64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/freebsd-x64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/linux-arm",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/linux-arm64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/linux-ia32",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/linux-loong64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/linux-mips64el",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/linux-ppc64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/linux-riscv64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/linux-s390x",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/linux-x64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/netbsd-arm64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/netbsd-x64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/openbsd-arm64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/openbsd-x64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/openharmony-arm64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/sunos-x64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/win32-arm64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/win32-ia32",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/win32-x64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@inquirer/external-editor",
            "direct": false,
            "version": "1.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "@jridgewell/sourcemap-codec",
            "direct": false,
            "version": "1.5.5",
            "ecosystem": "npm"
          },
          {
            "name": "@manypkg/find-root",
            "direct": false,
            "version": "1.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "@manypkg/get-packages",
            "direct": false,
            "version": "1.1.3",
            "ecosystem": "npm"
          },
          {
            "name": "@nodelib/fs.scandir",
            "direct": false,
            "version": "2.1.5",
            "ecosystem": "npm"
          },
          {
            "name": "@nodelib/fs.stat",
            "direct": false,
            "version": "2.0.5",
            "ecosystem": "npm"
          },
          {
            "name": "@nodelib/fs.walk",
            "direct": false,
            "version": "1.2.8",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-android-arm-eabi",
            "direct": false,
            "version": "4.62.2",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-android-arm64",
            "direct": false,
            "version": "4.62.2",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-darwin-arm64",
            "direct": false,
            "version": "4.62.2",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-darwin-x64",
            "direct": false,
            "version": "4.62.2",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-freebsd-arm64",
            "direct": false,
            "version": "4.62.2",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-freebsd-x64",
            "direct": false,
            "version": "4.62.2",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-linux-arm-gnueabihf",
            "direct": false,
            "version": "4.62.2",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-linux-arm-musleabihf",
            "direct": false,
            "version": "4.62.2",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-linux-arm64-gnu",
            "direct": false,
            "version": "4.62.2",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-linux-arm64-musl",
            "direct": false,
            "version": "4.62.2",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-linux-loong64-gnu",
            "direct": false,
            "version": "4.62.2",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-linux-loong64-musl",
            "direct": false,
            "version": "4.62.2",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-linux-ppc64-gnu",
            "direct": false,
            "version": "4.62.2",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-linux-ppc64-musl",
            "direct": false,
            "version": "4.62.2",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-linux-riscv64-gnu",
            "direct": false,
            "version": "4.62.2",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-linux-riscv64-musl",
            "direct": false,
            "version": "4.62.2",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-linux-s390x-gnu",
            "direct": false,
            "version": "4.62.2",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-linux-x64-gnu",
            "direct": false,
            "version": "4.62.2",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-linux-x64-musl",
            "direct": false,
            "version": "4.62.2",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-openbsd-x64",
            "direct": false,
            "version": "4.62.2",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-openharmony-arm64",
            "direct": false,
            "version": "4.62.2",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-win32-arm64-msvc",
            "direct": false,
            "version": "4.62.2",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-win32-ia32-msvc",
            "direct": false,
            "version": "4.62.2",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-win32-x64-gnu",
            "direct": false,
            "version": "4.62.2",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-win32-x64-msvc",
            "direct": false,
            "version": "4.62.2",
            "ecosystem": "npm"
          },
          {
            "name": "@stablelib/base64",
            "direct": false,
            "version": "1.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "@standard-schema/spec",
            "direct": false,
            "version": "1.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "@types/chai",
            "direct": false,
            "version": "5.2.3",
            "ecosystem": "npm"
          },
          {
            "name": "@types/deep-eql",
            "direct": false,
            "version": "4.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "@types/estree",
            "direct": false,
            "version": "1.0.9",
            "ecosystem": "npm"
          },
          {
            "name": "@types/node",
            "direct": false,
            "version": "12.20.55",
            "ecosystem": "npm"
          },
          {
            "name": "@types/node",
            "direct": false,
            "version": "26.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "@types/node",
            "direct": false,
            "version": "^26.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "@typescript/typescript-aix-ppc64",
            "direct": false,
            "version": "7.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "@typescript/typescript-darwin-arm64",
            "direct": false,
            "version": "7.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "@typescript/typescript-darwin-x64",
            "direct": false,
            "version": "7.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "@typescript/typescript-freebsd-arm64",
            "direct": false,
            "version": "7.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "@typescript/typescript-freebsd-x64",
            "direct": false,
            "version": "7.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "@typescript/typescript-linux-arm",
            "direct": false,
            "version": "7.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "@typescript/typescript-linux-arm64",
            "direct": false,
            "version": "7.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "@typescript/typescript-linux-loong64",
            "direct": false,
            "version": "7.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "@typescript/typescript-linux-mips64el",
            "direct": false,
            "version": "7.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "@typescript/typescript-linux-ppc64",
            "direct": false,
            "version": "7.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "@typescript/typescript-linux-riscv64",
            "direct": false,
            "version": "7.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "@typescript/typescript-linux-s390x",
            "direct": false,
            "version": "7.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "@typescript/typescript-linux-x64",
            "direct": false,
            "version": "7.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "@typescript/typescript-netbsd-arm64",
            "direct": false,
            "version": "7.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "@typescript/typescript-netbsd-x64",
            "direct": false,
            "version": "7.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "@typescript/typescript-openbsd-arm64",
            "direct": false,
            "version": "7.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "@typescript/typescript-openbsd-x64",
            "direct": false,
            "version": "7.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "@typescript/typescript-sunos-x64",
            "direct": false,
            "version": "7.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "@typescript/typescript-win32-arm64",
            "direct": false,
            "version": "7.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "@typescript/typescript-win32-x64",
            "direct": false,
            "version": "7.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "@vitest/expect",
            "direct": false,
            "version": "4.1.10",
            "ecosystem": "npm"
          },
          {
            "name": "@vitest/mocker",
            "direct": false,
            "version": "4.1.10",
            "ecosystem": "npm"
          },
          {
            "name": "@vitest/pretty-format",
            "direct": false,
            "version": "4.1.10",
            "ecosystem": "npm"
          },
          {
            "name": "@vitest/runner",
            "direct": false,
            "version": "4.1.10",
            "ecosystem": "npm"
          },
          {
            "name": "@vitest/snapshot",
            "direct": false,
            "version": "4.1.10",
            "ecosystem": "npm"
          },
          {
            "name": "@vitest/spy",
            "direct": false,
            "version": "4.1.10",
            "ecosystem": "npm"
          },
          {
            "name": "@vitest/utils",
            "direct": false,
            "version": "4.1.10",
            "ecosystem": "npm"
          },
          {
            "name": "ansi-colors",
            "direct": false,
            "version": "4.1.3",
            "ecosystem": "npm"
          },
          {
            "name": "ansi-regex",
            "direct": false,
            "version": "5.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "argparse",
            "direct": false,
            "version": "2.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "array-union",
            "direct": false,
            "version": "2.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "assertion-error",
            "direct": false,
            "version": "2.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "better-path-resolve",
            "direct": false,
            "version": "1.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "braces",
            "direct": false,
            "version": "3.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "chai",
            "direct": false,
            "version": "6.2.2",
            "ecosystem": "npm"
          },
          {
            "name": "chardet",
            "direct": false,
            "version": "2.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "convert-source-map",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "cross-spawn",
            "direct": false,
            "version": "7.0.6",
            "ecosystem": "npm"
          },
          {
            "name": "dataloader",
            "direct": false,
            "version": "1.4.0",
            "ecosystem": "npm"
          },
          {
            "name": "detect-indent",
            "direct": false,
            "version": "6.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "detect-libc",
            "direct": false,
            "version": "2.1.2",
            "ecosystem": "npm"
          },
          {
            "name": "dir-glob",
            "direct": false,
            "version": "3.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "dotenv",
            "direct": false,
            "version": "8.6.0",
            "ecosystem": "npm"
          },
          {
            "name": "enquirer",
            "direct": false,
            "version": "2.4.1",
            "ecosystem": "npm"
          },
          {
            "name": "es-module-lexer",
            "direct": false,
            "version": "2.3.1",
            "ecosystem": "npm"
          },
          {
            "name": "esbuild",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "estree-walker",
            "direct": false,
            "version": "3.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "expect-type",
            "direct": false,
            "version": "1.4.0",
            "ecosystem": "npm"
          },
          {
            "name": "extendable-error",
            "direct": false,
            "version": "0.1.7",
            "ecosystem": "npm"
          },
          {
            "name": "fast-glob",
            "direct": false,
            "version": "3.3.3",
            "ecosystem": "npm"
          },
          {
            "name": "fast-sha256",
            "direct": false,
            "version": "1.3.0",
            "ecosystem": "npm"
          },
          {
            "name": "fastq",
            "direct": false,
            "version": "1.20.1",
            "ecosystem": "npm"
          },
          {
            "name": "fdir",
            "direct": false,
            "version": "6.5.0",
            "ecosystem": "npm"
          },
          {
            "name": "fill-range",
            "direct": false,
            "version": "7.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "find-up",
            "direct": false,
            "version": "4.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "fs-extra",
            "direct": false,
            "version": "7.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "fs-extra",
            "direct": false,
            "version": "8.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "fsevents",
            "direct": false,
            "version": "2.3.3",
            "ecosystem": "npm"
          },
          {
            "name": "glob-parent",
            "direct": false,
            "version": "5.1.2",
            "ecosystem": "npm"
          },
          {
            "name": "globby",
            "direct": false,
            "version": "11.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "graceful-fs",
            "direct": false,
            "version": "4.2.11",
            "ecosystem": "npm"
          },
          {
            "name": "human-id",
            "direct": false,
            "version": "4.1.3",
            "ecosystem": "npm"
          },
          {
            "name": "iconv-lite",
            "direct": false,
            "version": "0.7.2",
            "ecosystem": "npm"
          },
          {
            "name": "ignore",
            "direct": false,
            "version": "5.3.2",
            "ecosystem": "npm"
          },
          {
            "name": "is-extglob",
            "direct": false,
            "version": "2.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "is-glob",
            "direct": false,
            "version": "4.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "is-number",
            "direct": false,
            "version": "7.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "is-subdir",
            "direct": false,
            "version": "1.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "is-windows",
            "direct": false,
            "version": "1.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "isexe",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "js-yaml",
            "direct": false,
            "version": "5.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "json-schema-to-ts",
            "direct": false,
            "version": "3.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "jsonfile",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss-android-arm64",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss-darwin-arm64",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss-darwin-x64",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss-freebsd-x64",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss-linux-arm-gnueabihf",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss-linux-arm64-gnu",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss-linux-arm64-musl",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss-linux-x64-gnu",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss-linux-x64-musl",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss-win32-arm64-msvc",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "lightningcss-win32-x64-msvc",
            "direct": false,
            "version": "1.32.0",
            "ecosystem": "npm"
          },
          {
            "name": "locate-path",
            "direct": false,
            "version": "5.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "lodash.startcase",
            "direct": false,
            "version": "4.4.0",
            "ecosystem": "npm"
          },
          {
            "name": "magic-string",
            "direct": false,
            "version": "0.30.21",
            "ecosystem": "npm"
          },
          {
            "name": "merge2",
            "direct": false,
            "version": "1.4.1",
            "ecosystem": "npm"
          },
          {
            "name": "micromatch",
            "direct": false,
            "version": "4.0.8",
            "ecosystem": "npm"
          },
          {
            "name": "mri",
            "direct": false,
            "version": "1.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "nanoid",
            "direct": false,
            "version": "3.3.15",
            "ecosystem": "npm"
          },
          {
            "name": "node-fetch",
            "direct": false,
            "version": "2.7.0",
            "ecosystem": "npm"
          },
          {
            "name": "obug",
            "direct": false,
            "version": "2.1.3",
            "ecosystem": "npm"
          },
          {
            "name": "outdent",
            "direct": false,
            "version": "0.5.0",
            "ecosystem": "npm"
          },
          {
            "name": "p-filter",
            "direct": false,
            "version": "2.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "p-limit",
            "direct": false,
            "version": "2.3.0",
            "ecosystem": "npm"
          },
          {
            "name": "p-locate",
            "direct": false,
            "version": "4.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "p-map",
            "direct": false,
            "version": "2.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "p-try",
            "direct": false,
            "version": "2.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "package-manager-detector",
            "direct": false,
            "version": "0.2.11",
            "ecosystem": "npm"
          },
          {
            "name": "path-exists",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "path-key",
            "direct": false,
            "version": "3.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "path-type",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "pathe",
            "direct": false,
            "version": "2.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "picocolors",
            "direct": false,
            "version": "1.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "picomatch",
            "direct": false,
            "version": "2.3.2",
            "ecosystem": "npm"
          },
          {
            "name": "picomatch",
            "direct": false,
            "version": "4.0.4",
            "ecosystem": "npm"
          },
          {
            "name": "picomatch",
            "direct": false,
            "version": "4.0.5",
            "ecosystem": "npm"
          },
          {
            "name": "pify",
            "direct": false,
            "version": "4.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "postcss",
            "direct": false,
            "version": "8.5.15",
            "ecosystem": "npm"
          },
          {
            "name": "prettier",
            "direct": false,
            "version": "2.8.8",
            "ecosystem": "npm"
          },
          {
            "name": "quansync",
            "direct": false,
            "version": "0.2.11",
            "ecosystem": "npm"
          },
          {
            "name": "queue-microtask",
            "direct": false,
            "version": "1.2.3",
            "ecosystem": "npm"
          },
          {
            "name": "read-yaml-file",
            "direct": false,
            "version": "1.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "resolve-from",
            "direct": false,
            "version": "5.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "reusify",
            "direct": false,
            "version": "1.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "rollup",
            "direct": false,
            "version": "4.62.2",
            "ecosystem": "npm"
          },
          {
            "name": "run-parallel",
            "direct": false,
            "version": "1.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "safer-buffer",
            "direct": false,
            "version": "2.1.2",
            "ecosystem": "npm"
          },
          {
            "name": "semver",
            "direct": false,
            "version": "7.8.0",
            "ecosystem": "npm"
          },
          {
            "name": "shebang-command",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "shebang-regex",
            "direct": false,
            "version": "3.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "siginfo",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "signal-exit",
            "direct": false,
            "version": "4.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "slash",
            "direct": false,
            "version": "3.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "source-map-js",
            "direct": false,
            "version": "1.2.1",
            "ecosystem": "npm"
          },
          {
            "name": "spawndamnit",
            "direct": false,
            "version": "3.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "stackback",
            "direct": false,
            "version": "0.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "standardwebhooks",
            "direct": false,
            "version": "1.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "std-env",
            "direct": false,
            "version": "4.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "strip-ansi",
            "direct": false,
            "version": "6.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "strip-bom",
            "direct": false,
            "version": "3.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "term-size",
            "direct": false,
            "version": "2.2.1",
            "ecosystem": "npm"
          },
          {
            "name": "tinybench",
            "direct": false,
            "version": "2.9.0",
            "ecosystem": "npm"
          },
          {
            "name": "tinyexec",
            "direct": false,
            "version": "1.2.4",
            "ecosystem": "npm"
          },
          {
            "name": "tinyglobby",
            "direct": false,
            "version": "0.2.17",
            "ecosystem": "npm"
          },
          {
            "name": "tinyrainbow",
            "direct": false,
            "version": "3.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "to-regex-range",
            "direct": false,
            "version": "5.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "tr46",
            "direct": false,
            "version": "0.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "ts-algebra",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "tsx",
            "direct": false,
            "version": "4.23.1",
            "ecosystem": "npm"
          },
          {
            "name": "tsx",
            "direct": false,
            "version": "^4.23.1",
            "ecosystem": "npm"
          },
          {
            "name": "typescript",
            "direct": false,
            "version": "7.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "typescript",
            "direct": false,
            "version": "^7.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "undici-types",
            "direct": false,
            "version": "8.3.0",
            "ecosystem": "npm"
          },
          {
            "name": "universalify",
            "direct": false,
            "version": "0.1.2",
            "ecosystem": "npm"
          },
          {
            "name": "vite",
            "direct": false,
            "version": "6.4.3",
            "ecosystem": "npm"
          },
          {
            "name": "vitest",
            "direct": false,
            "version": "4.1.10",
            "ecosystem": "npm"
          },
          {
            "name": "vitest",
            "direct": false,
            "version": "^4.1.10",
            "ecosystem": "npm"
          },
          {
            "name": "webidl-conversions",
            "direct": false,
            "version": "3.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "whatwg-url",
            "direct": false,
            "version": "5.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "which",
            "direct": false,
            "version": "2.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "why-is-node-running",
            "direct": false,
            "version": "2.3.0",
            "ecosystem": "npm"
          }
        ],
        "collected": true,
        "truncated": false,
        "total_count": 244,
        "direct_count": 2,
        "indirect_count": 242
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 2,
        "merged_prs": 83,
        "open_issues": 4,
        "closed_ratio": 0.2,
        "closed_issues": 1,
        "closed_unmerged_prs": 1
      },
      "bus_factor": 1,
      "bot_contributors": 2,
      "top_contributors": [
        {
          "type": "User",
          "login": "rivendale",
          "commits": 63,
          "avatar_url": "https://avatars.githubusercontent.com/u/19810292?v=4"
        },
        {
          "type": "User",
          "login": "pwnick",
          "commits": 30,
          "avatar_url": "https://avatars.githubusercontent.com/u/306649463?v=4"
        },
        {
          "type": "User",
          "login": "lifrmn",
          "commits": 1,
          "avatar_url": "https://avatars.githubusercontent.com/u/139601351?v=4"
        }
      ],
      "contributors_sampled": 3,
      "top_contributor_share": 0.67
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "ci.yml",
        "license-compliance.yml",
        "release.yml",
        "spdx-headers.yml"
      ],
      "has_docs_dir": true,
      "linter_configs": [],
      "has_editorconfig": false,
      "has_linter_config": false,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "pnpm-lock.yaml"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 9,
            "reason": "28 out of 29 merged PRs checked by a CI test -- score normalized to 9",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 1/15 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 3,
            "reason": "project has 1 contributing companies or organizations -- score normalized to 3",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 10,
            "reason": "update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 10,
            "reason": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": null,
            "reason": "packaging workflow not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 0,
            "reason": "dependency not pinned by hash detected -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 9,
            "reason": "SAST tool is not run on all commits -- score normalized to 9",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 10,
            "reason": "security policy file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": null,
            "reason": "no releases found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 6,
            "reason": "4 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "68bfd6f84dea5303685a9d7fe1f8e6335784ebce",
        "ran_at": "2026-07-25T13:44:31Z",
        "aggregate_score": 5.6,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": true,
      "has_dependabot_config": true
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-20T03:35:37Z",
      "oldest_open_prs": [
        {
          "number": 90,
          "created_at": "2026-07-20T03:35:35Z",
          "last_comment_at": "2026-07-20T03:35:35Z",
          "last_comment_author": "dependabot"
        },
        {
          "number": 91,
          "created_at": "2026-07-20T03:35:57Z",
          "last_comment_at": "2026-07-20T03:35:57Z",
          "last_comment_author": "dependabot"
        }
      ],
      "last_merged_pr_at": "2026-07-19T15:25:58Z",
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": [
        {
          "number": 72,
          "created_at": "2026-06-29T12:35:27Z",
          "last_comment_at": "2026-06-29T12:52:13Z",
          "last_comment_author": "rivendale"
        },
        {
          "number": 73,
          "created_at": "2026-07-01T22:41:10Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 74,
          "created_at": "2026-07-01T22:41:24Z",
          "last_comment_at": "2026-07-17T17:30:50Z",
          "last_comment_author": "siyametj"
        },
        {
          "number": 75,
          "created_at": "2026-07-01T22:41:24Z",
          "last_comment_at": null,
          "last_comment_author": null
        }
      ]
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/Protocol-Wealth/pwos-core",
    "host": "github.com",
    "name": "pwos-core",
    "owner": "Protocol-Wealth"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "moderate",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 66,
      "inputs": {
        "security": 65,
        "vitality": 84,
        "community": 49,
        "governance": 50,
        "engineering": 80
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "good",
        "name": "Vitality",
        "value": 84,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "good",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 74,
            "inputs": {
              "commits_last_year": 130,
              "human_commit_share": 0.65,
              "days_since_last_push": 5,
              "active_weeks_last_year": 15
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 5 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 5
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "15/52 weeks with commits",
                "points": 10.4,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 15
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "130 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 130
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "releases_count": 25,
              "latest_release_tag": "@protocolwealthos/audit-log@0.5.0",
              "releases_from_tags": false,
              "days_since_latest_release": 67,
              "mean_days_between_releases": 1.2
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "25 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 25
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 67 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 67
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~1.2 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 1.2
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "at_risk",
        "name": "Community & Adoption",
        "value": 49,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 9,
            "inputs": {
              "forks": 4,
              "stars": 3,
              "watchers": 1,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "3 stars",
                "points": 4.9,
                "status": "partial",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 3
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "4 forks",
                "points": 4,
                "status": "partial",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 4
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "1 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "excellent",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": true,
              "has_issue_template": false,
              "has_code_of_conduct": true,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (Apache-2.0)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "Apache-2.0"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 18,
                "status": "met",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 13.5,
                "status": "met",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          },
          {
            "key": "ecosystem_adoption",
            "band": "moderate",
            "name": "Ecosystem adoption (downloads)",
            "note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "registry_dependents"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 62,
            "inputs": {
              "packages": [
                "@protocolwealthos/crm",
                "@protocolwealthos/auth",
                "@protocolwealthos/ledger",
                "@protocolwealthos/shared",
                "@protocolwealthos/holdings",
                "@protocolwealthos/audit-log",
                "@protocolwealthos/mcp-tools",
                "@protocolwealthos/pii-guard"
              ],
              "dependents": null,
              "ecosystems": "npm",
              "total_downloads": null,
              "monthly_downloads": 4978
            },
            "components": [
              {
                "key": "monthly_downloads",
                "name": "Monthly downloads",
                "detail": "4,978 downloads/month across npm",
                "points": 49.3,
                "status": "partial",
                "details": [
                  {
                    "code": "downloads_monthly",
                    "params": {
                      "count": 4978,
                      "ecosystems": "npm"
                    }
                  }
                ],
                "max_points": 80
              },
              {
                "key": "registry_dependents",
                "name": "Registry dependents",
                "detail": "not reported by this ecosystem",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_reported_by_this_ecosystem",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "moderate",
        "name": "Sustainability & Governance",
        "value": 50,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 24,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 3,
              "top_contributor_share": 0.67
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 67% of commits",
                "points": 7.4,
                "status": "partial",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 67
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "3 contributors",
                "points": 4.1,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 3
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 1 contributing companies or organizations -- score normalized to 3",
                "points": 3,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "at_risk",
            "name": "Issue & PR responsiveness",
            "note": null,
            "notes": [],
            "value": 47,
            "inputs": {
              "merged_prs": 83,
              "open_issues": 4,
              "closed_issues": 1,
              "issue_closed_ratio": 0.2,
              "closed_unmerged_prs": 1
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "20% of issues closed",
                "points": 9.3,
                "status": "partial",
                "details": [
                  {
                    "code": "issues_closed_share",
                    "params": {
                      "share": 20
                    }
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "83/84 decided PRs merged",
                "points": 37.8,
                "status": "partial",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 83,
                      "decided": 84
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 1/15 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "at_risk",
            "name": "Ownership & stewardship",
            "note": null,
            "notes": [],
            "value": 44,
            "inputs": {
              "followers": 5,
              "owner_type": "Organization",
              "is_verified": null,
              "owner_login": "Protocol-Wealth",
              "public_repos": 9,
              "account_age_days": 233
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "organization-owned",
                "points": 30,
                "status": "met",
                "details": [
                  {
                    "code": "owner_organization",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "5 followers of Protocol-Wealth",
                "points": 5.6,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 5,
                      "login": "Protocol-Wealth"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "9 public repos, account ~0 yr old",
                "points": 8.6,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 9
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 0
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "@protocolwealthos/crm",
                "@protocolwealthos/auth",
                "@protocolwealthos/ledger",
                "@protocolwealthos/shared",
                "@protocolwealthos/holdings",
                "@protocolwealthos/audit-log",
                "@protocolwealthos/mcp-tools",
                "@protocolwealthos/pii-guard"
              ],
              "ecosystems": "npm",
              "any_deprecated": false,
              "min_days_since_publish": 5
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "8 package(s) on npm",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 8,
                      "ecosystems": "npm"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 5 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 5
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "5 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 5
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "good",
        "name": "Engineering Quality",
        "value": 80,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "moderate",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 66,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": false,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "4 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 4
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "28 out of 29 merged PRs checked by a CI test -- score normalized to 9",
                "points": 18,
                "status": "partial",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "excellent",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "topics": [
                "advisory",
                "ai",
                "compliance",
                "crm-system",
                "digital",
                "fintech",
                "open-source",
                "pii-detection",
                "pii-redaction",
                "productivity-tools",
                "ria",
                "wealth-management",
                "agent-tools",
                "governance",
                "mcp",
                "regulated-finance"
              ],
              "has_wiki": true,
              "homepage": "https://protocolwealthllc.com/opensource",
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": "https://protocolwealthllc.com/opensource",
                "points": 15,
                "status": "met",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": "16 topics",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "topics_count",
                    "params": {
                      "count": 16
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "moderate",
        "name": "Security",
        "value": 65,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "moderate",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): Packaging, Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "packaging",
                    "signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 56,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 16,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 2,
              "scorecard_aggregate": 5.6
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "28 out of 29 merged PRs checked by a CI test -- score normalized to 9",
                "points": 2.2,
                "status": "partial",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 1/15 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 1 contributing companies or organizations -- score normalized to 3",
                "points": 0.8,
                "status": "partial",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "update tool detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow not detected",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool is not run on all commits -- score normalized to 9",
                "points": 4.5,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "4 existing vulnerabilities detected",
                "points": 4.5,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "excellent",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 239 resolved dependencies against OSV; 5 could not be assessed (no resolved version, an unsupported ecosystem, or beyond the reported package list). This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "indirect_dependencies_free_of_known_advisories",
                    "no_advisories_left_outstanding"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_repository",
                "params": {
                  "assessed": 239
                }
              },
              {
                "code": "advisories_unassessed",
                "params": {
                  "count": 5
                }
              },
              {
                "code": "advisories_repo_graph_caveat",
                "params": {}
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "source": "osv",
              "advisories": 4,
              "affected_packages": 2,
              "assessed_packages": 239,
              "unassessed_packages": 5,
              "affected_by_severity": "high 2",
              "direct_affected_packages": 0
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "no direct dependency carries a known advisory",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "no_direct_advisories",
                    "params": {}
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "transitive set not separable from development and test dependencies in this scope",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_scope_not_separable",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory carries a publication date",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_no_publication_date",
                    "params": {}
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 239,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 2
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "good",
        "name": "AI Readiness",
        "value": 71,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "excellent",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 0.954,
              "agent_instruction_files": [
                "AGENTS.md",
                "CLAUDE.md"
              ],
              "agent_instruction_max_bytes": 8933
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "AGENTS.md, CLAUDE.md",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "AGENTS.md, CLAUDE.md"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "62 of 65 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 62,
                      "sampled": 65
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "moderate",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 61,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "pnpm-lock.yaml"
              ],
              "has_dockerfile": false,
              "typed_language": true,
              "bootstrap_files": [],
              "has_devcontainer": false,
              "has_linter_config": false,
              "typecheck_configs": [
                "apps/evals/tsconfig.json",
                "examples/rias-agent-substrate/tsconfig.json",
                "packages/ai-guardrails/tsconfig.json",
                "packages/audit-log/tsconfig.json",
                "packages/auth/tsconfig.json",
                "packages/cache-keys/tsconfig.json",
                "packages/compliance/tsconfig.json",
                "packages/crm/tsconfig.json",
                "packages/disclosure-card/tsconfig.json",
                "packages/document-gen/tsconfig.json",
                "packages/email-archive/tsconfig.json",
                "packages/gcp-helpers/tsconfig.json",
                "packages/holdings/tsconfig.json",
                "packages/ledger/tsconfig.json",
                "packages/mcp-tools/tsconfig.json",
                "packages/onchain-accounting-contract/tsconfig.json",
                "packages/onchain-sdk/tsconfig.json",
                "packages/pii-guard/tsconfig.json",
                "packages/planning-contract/tsconfig.json",
                "packages/security-headers/tsconfig.json",
                "packages/shared/tsconfig.json",
                "packages/webhooks/tsconfig.json",
                "packages/workflow-engine/tsconfig.json"
              ],
              "agent_commit_share": 0.37,
              "toolchain_manifests": [],
              "dependency_bot_commit_share": 0.24
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "apps/evals/tsconfig.json, examples/rias-agent-substrate/tsconfig.json, packages/ai-guardrails/tsconfig.json, packages/audit-log/tsconfig.json, packages/auth/tsconfig.json, packages/cache-keys/tsconfig.json, packages/compliance/tsconfig.json, packages/crm/tsconfig.json, packages/disclosure-card/tsconfig.json, packages/document-gen/tsconfig.json, packages/email-archive/tsconfig.json, packages/gcp-helpers/tsconfig.json, packages/holdings/tsconfig.json, packages/ledger/tsconfig.json, packages/mcp-tools/tsconfig.json, packages/onchain-accounting-contract/tsconfig.json, packages/onchain-sdk/tsconfig.json, packages/pii-guard/tsconfig.json, packages/planning-contract/tsconfig.json, packages/security-headers/tsconfig.json, packages/shared/tsconfig.json, packages/webhooks/tsconfig.json, packages/workflow-engine/tsconfig.json",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "apps/evals/tsconfig.json, examples/rias-agent-substrate/tsconfig.json, packages/ai-guardrails/tsconfig.json, packages/audit-log/tsconfig.json, packages/auth/tsconfig.json, packages/cache-keys/tsconfig.json, packages/compliance/tsconfig.json, packages/crm/tsconfig.json, packages/disclosure-card/tsconfig.json, packages/document-gen/tsconfig.json, packages/email-archive/tsconfig.json, packages/gcp-helpers/tsconfig.json, packages/holdings/tsconfig.json, packages/ledger/tsconfig.json, packages/mcp-tools/tsconfig.json, packages/onchain-accounting-contract/tsconfig.json, packages/onchain-sdk/tsconfig.json, packages/pii-guard/tsconfig.json, packages/planning-contract/tsconfig.json, packages/security-headers/tsconfig.json, packages/shared/tsconfig.json, packages/webhooks/tsconfig.json, packages/workflow-engine/tsconfig.json"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "37 of the last 100 commits agent-authored or agent-credited",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "agent_authored_commits",
                    "params": {
                      "count": 37,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "24 of the last 100 commits are automated dependency updates",
                "points": 8,
                "status": "met",
                "details": [
                  {
                    "code": "dependency_bot_commits",
                    "params": {
                      "count": 24,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "TypeScript",
              "largest_source_bytes": 43596,
              "source_files_sampled": 205,
              "oversized_source_files": 0
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "TypeScript (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "TypeScript"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "0/205 source files over 60KB",
                "points": 55,
                "status": "met",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 205,
                      "oversized": 0
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "at_risk",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "example_dirs": [
                "examples"
              ],
              "has_mcp_signal": false,
              "api_schema_files": []
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": "examples",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "examples"
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-25T13:44:47.535326Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/p/Protocol-Wealth/pwos-core.svg",
  "full_name": "Protocol-Wealth/pwos-core",
  "license_state": "standard",
  "license_spdx": "Apache-2.0"
}